Manage user groups

Grant the devops team the web-admin group and ensure Alice and Martin are added; confirm group membership works by having Alice create a temp file in /var/www and Martin list it; then remove old account 'tempbuilder' and report back by Friday.

Before I change group memberships for production, make the approval easy: show which files under /var/www are owned by current groups, surface any setgid bits or ACLs that would let web-admins edit without sudo, and flag files owned by users outside devops that a reviewer might block.

I was asked to add Jenna to the web-admin group for the deployment tonight. I don't know whether the web-admin group already has write on the target directories, who last modified the group ACLs, or whether adding her will give unintended sudo-like access to service files. What is the likely risk and the safest immediate steps I should take before granting membership?

We keep getting ad-hoc requests to add people to sys groups and then revert when something breaks, which eats time and causes occasional outages. Which habit should we change so future requests are safer and faster: a checklist of evidence to require before any group change, a short approval matrix for common groups, or a weekly scheduled review window? Recommend one change and a simple enforcement step I can implement this week.