SIMD-0007

TL;DR

3 levels of access, in the order of increasing access: 1. Triage Requirement: One voucher from anyone with level 2 or above access. 2. Write Requirement: One voucher from anyone with level 3 access or two from anyone with level 2 access. If only vouched by those with level 2 access, the user must have Triage access to be promoted. 3. Maintain Requirement: One voucher from anyone with level 3 access. This permission is usually reserved for those maintaining the SIMD process. Each of the levels implies having the previous levels - e.g. level 2 implies level 1. A contributor with Write access will be able to triage pull requests in accordance with Github access policies.

Summary

3 levels of access, in the order of increasing access: 1. Triage Requirement: One voucher from anyone with level 2 or above access. 2. Write Requirement: One voucher from anyone with level 3 access or two from anyone with level 2 access. If only vouched by those with level 2 access, the user must have Triage access to be promoted. 3. Maintain Requirement: One voucher from anyone with level 3 access. This permission is usually reserved for those maintaining the SIMD process. Each of the levels implies having the previous levels - e.g. level 2 implies level 1. A contributor with Write access will be able to triage pull requests in accordance with Github access policies.

Motivation

Shamelessly borrowing from [Mozilla's access policy](https://www.mozilla.org/en-US/about/governance/policies/commit/access-policy/) : ``` There are two sorts of control which can be used to stop people checking in - technical and social. A "full technical" implementation would have per-directory permissions everywhere, but would lead to a greatly-increased management overhead for IT, vouchers and developers alike. A "full social" implementation would just have a single permission which gave you complete access to everything, but (depending on the height of the barrier to that permission) there is a risk of making developer's lives more difficult when they are excluded, or of giving the untrustworthy or incompetent power to mess things up. Therefore, a good policy balances the use of technical and social controls to minimize both management overhead and risk to the development process. ```

Key Changes

• Open an issue on the [Solana Improvement
• Gather your vouchers to add a comment on the issue expressing their support.
• Once the issue has received enough support, notify the users with Maintain
• Other users with the appropriate level of access should comment on the issue
• Once the issue has received enough support, the user's access will be
• If a user's level 3 access is being revoked, support from at least two other
• If a user's level 1 or 2 access is being revoked, support from at least two
• If a user opens the issue to revoke their own access, no support from others

Impact

Setting a permissive way of contributing to the SIMD process will help remove engineering overhead.

Security Considerations

In the event of a malicious actor gaining any level of access, users must follow the Access Removal Process to revoke that actor's access.