From 7a7e9acb690766ef054690ad96f1bb3111a457e7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 9 Jul 2026 10:48:51 +0000
Subject: [PATCH 1/2] Add security-managers org role and assign maxisbey

Model GitHub's pre-defined security_manager organization role in the
IaC: new GitHub-only security-managers team wired to the org role via
ORG_ROLE_ASSIGNMENTS, following the existing all_repo_admin pattern.
Add Max Isbey (maxisbey) as its first member so he can view draft
security advisories for coordinated disclosure work.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147Pp292yN9cQKCQBphVyMy
---
 src/config/orgRoles.ts | 6 +++++-
 src/config/roleIds.ts  | 1 +
 src/config/roles.ts    | 6 ++++++
 src/config/users.ts    | 7 ++++++-
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/config/orgRoles.ts b/src/config/orgRoles.ts
index 576ec51..1354cf1 100644
--- a/src/config/orgRoles.ts
+++ b/src/config/orgRoles.ts
@@ -8,7 +8,8 @@ export type OrgRoleName =
   | 'all_repo_triage'
   | 'all_repo_write'
   | 'all_repo_maintain'
-  | 'all_repo_admin';
+  | 'all_repo_admin'
+  | 'security_manager';
 
 export interface OrgRoleAssignment {
   /** GitHub team slug */
@@ -20,4 +21,7 @@ export interface OrgRoleAssignment {
 export const ORG_ROLE_ASSIGNMENTS: OrgRoleAssignment[] = [
   { team: 'lead-maintainers', role: 'all_repo_admin' },
   { team: 'core-maintainers', role: 'all_repo_admin' },
+  // Security managers can view and manage security alerts and draft security
+  // advisories (GHSAs) across all repositories in the org.
+  { team: 'security-managers', role: 'security_manager' },
 ];
diff --git a/src/config/roleIds.ts b/src/config/roleIds.ts
index d47968d..4a0621f 100644
--- a/src/config/roleIds.ts
+++ b/src/config/roleIds.ts
@@ -10,6 +10,7 @@ export const ROLE_IDS = {
   CORE_MAINTAINERS: 'core-maintainers',
   LEAD_MAINTAINERS: 'lead-maintainers',
   MODERATORS: 'moderators',
+  SECURITY_MANAGERS: 'security-managers', // GitHub only (org security_manager role)
   ADMINISTRATORS: 'administrators', // Discord only
   COMMUNITY_MANAGERS: 'community-managers', // Discord only
 
diff --git a/src/config/roles.ts b/src/config/roles.ts
index 86e53a3..1c4fc3d 100644
--- a/src/config/roles.ts
+++ b/src/config/roles.ts
@@ -102,6 +102,12 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'community moderators (synced)' },
     google: { group: 'moderators', provisionUser: true },
   },
+  {
+    id: ROLE_IDS.SECURITY_MANAGERS,
+    description: 'Organization security managers (security_manager org role via orgRoles.ts)',
+    github: { team: 'security-managers' },
+    // GitHub only - grants org-wide visibility into security alerts and draft advisories
+  },
 
   // ===================
   // Maintainer Groups
diff --git a/src/config/users.ts b/src/config/users.ts
index 0df85f2..248fe37 100644
--- a/src/config/users.ts
+++ b/src/config/users.ts
@@ -532,7 +532,12 @@ export const MEMBERS: readonly Member[] = [
     firstName: 'Max',
     lastName: 'Isbey',
     googleEmailPrefix: 'max',
-    memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.PYTHON_SDK, ROLE_IDS.TYPESCRIPT_SDK_COLLABORATORS],
+    memberOf: [
+      ROLE_IDS.MAINTAINERS,
+      ROLE_IDS.PYTHON_SDK,
+      ROLE_IDS.SECURITY_MANAGERS,
+      ROLE_IDS.TYPESCRIPT_SDK_COLLABORATORS,
+    ],
   },
   {
     github: 'michaelneale',

From ac1cc2c1f7ae9595edd1dfaec10a772a6f8d52a4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 9 Jul 2026 11:28:09 +0000
Subject: [PATCH 2/2] Add jenn-newton to security-managers team

Paul Carleton asked for Jenn to join the new security-managers team
alongside Max Isbey. Resolved to Jenn Newton (jenn-newton), already a
member of the security working group in this config.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 src/config/users.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/config/users.ts b/src/config/users.ts
index 248fe37..2cf4f67 100644
--- a/src/config/users.ts
+++ b/src/config/users.ts
@@ -367,7 +367,7 @@ export const MEMBERS: readonly Member[] = [
   },
   {
     github: 'jenn-newton',
-    memberOf: [ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_MANAGERS, ROLE_IDS.SECURITY_WG],
   },
   {
     github: 'jeongukjae',