Security Team

[j01tz]

Rendered link to RFC document

This is a proposal to create a security team for Grin.

[lehnberg]

@j01tz it was brought to my attention that as both security team and core team are intermixed in the document, vetoes that the security team members have might mistakenly be read as applying to core team decisions. Perhaps it could be made clearer that the vetoes only apply on security team decisions?

Also following gov meeting just now, would be great if you could drop "sub-team" for just "team" instead in the doc. :)

[j01tz]

Following your comment, I'm debating language use in veto section

Any member of the security team may veto an impactful security-related decision

or

Any member of the security team may veto an impactful security team decision

The former gives the team the ability to broadly veto any impactful security-related decision (though doesn't guarantee its awareness of these situations). The latter restricts it to "security team decisions" which would be narrowly interpreted as what is specified in the RFC document and what is explicitly delegated by core.

Depending on the approach we could do a better job in the RFC of spelling out what are explicitly security team decisions if we don't want to leave "security-related decisions" up to interpretation.

[lehnberg]

I’d be inclined to go with the latter: security team decision

Practically speaking, the remits of the security team is contained within the security team itself. It cannot get veto powers on matters that are not handled by the team.

[j01tz]

Thanks very much for the feedback.

• Changed the "subteam" language to reflect updates from the meeting
• Added language to clarify "security team decisions" for vetoes and deadlocks

[lehnberg]

Looks good @j01tz, bar any objections from others I'm going to recommend that this RFC moves into Final Comment Period with a disposition to merge tomorrow during the governance meeting. 👍

[lehnberg]

Following discussion in today's Governance meeting, and in line with our governance process, this RFC can be considered being in Final Comment Period from today, with a disposition to merge in two weeks time, on February 25.

Please ensure any comments are made before then! ⏳

[lehnberg]

Took quite a detailed pass @j01tz, let me know what you think 👍

[j01tz]

Thanks for the feedback @lehnberg. I think I was able to address your comments. I also added a line for clarification in the decision making section.

[yeastplume]

Looks good to go as is, thanks @j01tz for putting all of this together.

[lehnberg]

Following discussion in yesterday's Governance meeting, and in line with our governance process, following two weeks of final comment period, this RFC can now be considered Accepted. 🎉