People & Identity Rosters

People and Identity rosters answer the question: “Who is in what state right now?” They carry no privileges and grant no access. They’re membership lists that other groups and automation reference.

People Rosters

People rosters track humans by their organizational lifecycle state.

prv-{scope}-people-{audience}@{domain}

By OU Branch

Each Organizational Unit (OU) branch gets a corresponding People roster:

Executive Team

Roster	Who Belongs
`prv-org-people-execs-active`	Active founders / executive leadership
`prv-org-people-execs-admins`	Execs with admin roles
`prv-org-people-execs-offboarded`	Suspended former executives

W-2 Employees

Roster	Who Belongs
`prv-org-people-w2-active`	Active employees
`prv-org-people-w2-probation`	New/rejoining employees (30-60 day tighter controls)
`prv-org-people-w2-offboarded`	Suspended former employees

Contractors

Roster	Who Belongs
`prv-org-people-contractors-eng-active`	Active engineering contractors
`prv-org-people-contractors-biz-active`	Active business contractors
`prv-org-people-contractors-fractional-active`	Active fractional/part-time contractors
`prv-org-people-contractors-*-offboarded`	Offboarded variants for each type

Interns

Roster	Who Belongs
`prv-org-people-interns-eng-active`	Active engineering interns
`prv-org-people-interns-biz-active`	Active business interns
`prv-org-people-interns-*-offboarded`	Offboarded variants

Partners & Vendors

Roster	Who Belongs
`prv-org-people-partners-active`	Provisioned partner users
`prv-org-people-vendors-active`	Provisioned vendor users
`prv-org-people-partners-offboarded`	Offboarded partner users
`prv-org-people-vendors-offboarded`	Offboarded vendor users

Aggregate (Rollup) Rosters

Rollup rosters combine multiple branch rosters for broad targeting (e.g., all-hands mail, org-wide policies):

Roster	What It Rolls Up
`prv-org-people-all-active`	All active humans across all branches
`prv-org-people-all-internal`	W-2 + Execs (no contractors/interns/externals)
`prv-org-people-all-offboarded`	All offboarded/suspended humans

Display Name & Description

Name:  PRV – People – W-2 – Active
Desc:  PRV – People – W-2 – Active: Dynamic roster for active employees
       | Feeds Role eligibility | Non-security group (communication-only + no privileges)

Group Settings

Security label: OFF (rosters don’t grant access)
Membership: Managed dynamically (CEL rules or SCIM sync)
External members: OFF
Posting: Members only (or disabled — rosters aren’t for mail)

Identity Rosters

Identity rosters track non-human accounts — service accounts, bots, and automation identities.

prv-{scope}-ident-{audience}@{domain}

Roster	Who Belongs
`prv-org-ident-auto-active`	Active automation accounts
`prv-org-ident-auto-disabled`	Disabled/retired automation accounts

Display Name & Description

Name:  PRV – Identity – Automation – Active
Desc:  PRV – Identity – Automation – Active: Active automation/service accounts
       | Lifecycle tracking | Non-security group (roster-only + no privileges)

OU Model

OUs describe who the account is and its lifecycle state. Groups control what it can access. Never put content ACLs on OUs.

/exec-team
  /execs-active
  /execs-admins
  /execs-offboarded
  /execs-breakglass-users

/w2
  /w2-active
  /w2-probation
  /w2-offboarded

/contractors
  /contractors-engineering-active
  /contractors-engineering-offboarded
  /contractors-business-active
  /contractors-business-offboarded
  /contractors-fractional-active
  /contractors-fractional-offboarded

/interns
  /interns-engineering-active
  /interns-engineering-offboarded
  /interns-business-active
  /interns-business-offboarded

/partners
  /partners-active
  /partners-offboarded

/vendors
  /vendors-active
  /vendors-offboarded

/automation-accounts
  /automation-accounts-active
  /automation-accounts-disabled

Guardrails

Never put people-* or ident-* groups directly on content ACLs (drive permissions, system roles).
People rosters feed Role eligibility — they don’t grant access themselves.
Offboarded rosters exist for audit trails and retention, not for access.
Every active roster should have a corresponding offboarded roster.