[] Create shell user (can connect to bastions)
[] server root shell (membership in ops group)
[] Phabricator User + 2FA
[] Phabricator permissions to see NDA and Ops restricted tickets, and added to trusted users for antivandal exempt: https://phabricator.wikimedia.org/project/profile/29/ https://phabricator.wikimedia.org/project/profile/61/ https://phabricator.wikimedia.org/project/profile/974/
[x] Add to private IRC channels https://office.wikimedia.org/wiki/IRC#Channel_operators_commands
[] Add to ops mailing lists (`ops` and `ops-private` minimum requirements)
[] Add to Exim mail aliases (`root` via `private.git:modules/privateexim/files/wikimedia.org`)
[] Icinga contact in `private.git`
[] Icinga user and permissions (icinga commands, paging/notifications)
[] Add to wmf and ops LDAP groups
[] Gerrit login and +2 on operations/puppet (this is automatic from being added to LDAP groups above)
[x] Access to Office Wiki (OIT grants that)
[] Access to pwstore
[] Access to Google group for maint-announce mails (directly added user via "web only partecipation" option from https://groups.google.com/a/wikimedia.org/forum/#!managemembers/ops-maintenance/add though anyone in wikimedia org should be able to join)