GitLab Working at GitLab, 3 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: New Role Based Access Request Template Automation

Description

Role Based Entitlements - Information for Managers: https://about.gitlab.com/handbook/business-ops/it-ops-team/access-requests/#role-based-entitlements---information-for-managers

Access Request issue creation: https://about.gitlab.com/handbook/people-group/engineering/#access-request-issue-creation

GitLab Access Request template repository: https://gitlab.com/gitlab-com/team-member-epics/access-requests/-/blob/master/README.md#automated-role-based-ars

A

Do you wanna do Italy no I. Do you want me to do I'll start with.

B

It and if you see things that I miss just jump in okay, okay I will just make sure that I'm at the right projects and everyone else feel free to ask questions if they, if something isn't clear, I've been in these projects for a while, so they might. Things might seem obvious for me.

C

B

Screen, okay, so for where we start on day, one well before they want the on boarding ticket for a team member is created and currently for the manager on day one. It will say just.

C

B

I am on a big screen. That might be the problem, but let's see does this help.

C

B

That helps okay, so on day one, it always used to say something about an excess request, but it used to say they managed to create an access request for a role based entitlements, but now it changed that into but actually I'm going. To be honest, there's already a mistake here. This should move to day two, but so now it says on day one but okay, there isn't I'm already or I'm making one to say the row based entitlement exists. Request will be created automatically if the pre approved template exists.

B

The pre approved templates are the ones that have always been there in the access requests project. So we didn't come up with any new ones. We just use the existing ones and now we're, of course, I'm right I think now it will be more rewarding to create templates, because because if you have a template, when the new person on boards on their second day, we create an access request for them. For those who don't have a template, we're not doing that.

B

So it's a bit of a downside, so we're still asking the manager to to check if the AR, if the request covers the correct entitlements just to be sure, but the manager is also pink in that access request. So next I will go to an access request. So you can see that so yeah, it's not like we're trying to get not get blame or not want to take responsibility, but you know, which is access, requests, we're giving people yeah provisions to tools. So we want to make sure that those are the right ones.

B

Of course, after a while we should be sure but I still I think it's still not a bad thing to please check if the access request covers, because maybe something needs to be added that wasn't in the template and then they also realize all we need to update the template. So this is on the onboarding issue. So in.

C

There I'm sorry, you know I I know some of the managers will get it. Some of the managers into news and I and I work with will say well. How do I know how do I find this AR put in there to something like you will be tagged when that's created.

D

C

For it, you know, I want.

B

That's fine also with the way that these things work now, although is that this is for new people that everything is in an epoch. So let me see there was one I created it yesterday for someone in sales, I think, but and.

A

I see that's a good one. A second.

B

One but yeah this is a special one, because actually his name is different. I think he prefers an answer yeah, but so normally, if names didn't change, let me check anyway. It should be all in the epic, their onboarding and their access requests. So that's one way to look for it because, as you're in someone's onboarding issue, let me see with this person you see.

D

B

In the epic, both the onboarding issue and the access request is there. So if you are in their issue, then you can see on the right, the epic Melissa and you can click on there and then you get access to the access request as well. But, as I said, the manager is also ping, but we can definitely change the messaging in the onboarding template. This is open. I mean you can even contribute to this.

B

If you're like, we know the text is long and we see a lot because we wanted to make sure we were covering everything and people weren't confused, but we might be seeing too much or not enough or not the right things. So you do see that here the manager is stacked. So he knows jeremy is aware: okay I need to go check this or, however, he follows up on his to do this so.

C

The general boarding issue they, if they're, not sure if it the access request template, is created. They can need a couple ways one they're tagged in, and so it should be in their email somewhere. But the easiest would be look on the right side.

C

B

Kind of why we started the epic it so that everything for one member is in one place.

C

B

If the least I would ever do a transition issued, and that would also get in her epoch and things like that, so that we really can see okay, this was the tragic. This is the thing that a team member does for Kate Clapp kind of keeping it all in one place, yeah anything else that currently isn't cleared, or that would help so.

D

All the sales rules do have templates right.

C

And I worked with Jamie Carrie a while back to create them to newgen one of the things that I haven't got to yet is now that Michelle is hiring a bunch of folks for the channel team. We need to create some for the channel folks as an interim solution, they're just using the sales templates, but that was one of the questions I want to have for you. I was like yeah. Well, what is the process to request? A creation of a new access request template that.

B

You as a manager are responsible to create the tickets, and so it's you make a merge request to this project. The accessory project on team member epochs, but I think Liz. You made a handbook change right. This is all right. Okay, let me down so.

A

If you look for access request, code, lab I, think.

B

If you cannot find a template, please create one by following this format and place it in the correct department directory. What we could do is make a little video and embed it here. So we can you go through creating one, but the steps are here and it's in a nutshell. It's you add a template to the to the department folder of the department of that role, so I mean if it.

D

Would be very helpful, yeah I can I.

B

Can do that today, yeah so I do take. Videos are helpful, but we also want to make sure it's in the handbook, because videos are outdated so quickly and it's way more work to rerecord a video than just to make a change to the handbook. But definitely I can see why no technical people also like to see things, but so, if now.

C

Engineering, not engineering.

B

If you're in the department, commercial sales and you're like oh, we are actually we're adding a role or there's a role who isn't here? What we would do is, you would add, a file to this to this folder, but.

A

We have a template for adding new ones. I, don't know if you want me to walk through that lean like a template. How to you said a.

B

Template to get you started yeah that.

A

B

C

A

B

A

One is kind of what it looks like and there's instructions. So if you follow the instructions on the page like this is the template for ourselves. We do have region, but we don't need public, SSH, key I, think most cases so.

B

C

Me sorry about this.

A

You will remove that so if you add it, if you go and edit the file- and you copy that and you paste it in and like and then you go and create the file in the right directory, then you just place these and then start sucking up information.

A

So they stop for I need to do their stuff for data to do more people or sales operations. Legal.

C

I can see where this is super helpful for, if you're starting from scratch, I think what we would do is copy.

B

Yeah, of course, you would probably have to fill in less so definitely go ahead in the way that you, if you're, like oh yeah, if I can take this and I just add some things than to that if you're like. Oh, this is completely new Department with new rules and you would start from the base one, but indeed you would kind of have to decide that on your own, which which want to start from but I, think that's for tooling, then you know kinda what what the basic is for us. Yeah.

C

Last question on this: one: I: don't wanna, get way too off on that tangent, but uh does that automatically assign it to the right people when we submit a new template request, or is there a certain person or persons we need to assign it to.

A

That depends on to take stock, and it's also instructions here so in the promotion.

C

Is in terms of the tip blanket on the bottom, you have to figure out who the provisioners are, but the step before that of I guess. Is there any involved, maybe maybe a different question? Is there any involvement, people ops to create the template or I? Imagine at some point you need to activate a bot to automate it right.

B

The template is something you create with the issues that isn't it about, but a template. That's the bot has nothing to do with that. So who have anyone in guitar company can create templates, they do have to go through merge, request and I. Think people need to prove so that I cannot go and say. Okay from now on, the people, ops for second jr. gets full access to. You know all the tools that needs to be approved, probably by IT security, but so much you just make America's it gets merged in.

B

If, if people agree and then the template is there and the body can then use it to make the issues for that role.

C

Okay, thank you.

A

So yeah besides, the creating template is like how like yeah the board, just uses the template, but we don't have to activate or do anything besides. Creating the template and I was gonna mention something else. Let me see if it come back. It comes back to me a little bit. I'm.

C

Tunisia any questions about this.

D

So far, I'm okay, I, think I kind of mostly.

B

Repeat things I don't mind at all: I feel free to double-check. You.

C

Know what I really interrupted earlier when you were to explaining I'm saying all right just but for Tunisia and everybody else's benefit, and then correct me if I'm wrong here, but you were saying that, depending like the tags who you tag is going to depend on what part of the tech stack you're asking to provision, you want to say a little bit more about that. Yeah.

A

These you can see that yeah, just as an example that we have amber Stein and we have jameson burton and amber so depending on the team they are in, like, for example, we have ID to do so, we'll need to add the label I think to do then fill ops, that's our cheese, just sell soaps and marketing to do things. There's also marketing to do then. There's also some basic ones that we have like new access requires ready for provisioning. Those should be copied over I.

A

Think I did mention that in the handbook page as well, that the ones that I have there shouldn't.

B

A

You know the under a the confidential quick action. All those ones are the basic ones that you should always so New York's is request, ready for provisioning access, request, workload, manager, proof and based on environment, that's kind of the bay, the basic ones, and then you can add the other ones. There's some things who do depend on these to get their stuff done because they have boards, so they have created boards and they look at the labels, other things just to based on like if they're assigned they will just get it done.

A

So we just both things like we assigned, and we are the labels just to me to cover all grounds. This.

B

Part should be the same as it's always been that the labels were added, and then people knew okay. I have to act upon this and note that, yes, the the templates has this, but even if you forget it, the bots will only create confidential issues just to be sure, and the project is also private to everything except there's extra steps, but it will always be a confidential, ensure that ya can.

A

See something that I was gonna mention like all this stuff with, like the labels and everything it's a bit hard for some people and like the IT team and the business operations team, we usually check the templates before the gamers. So as long as as the permissions like what each team has to do like I think has to do. Give us these permissions and cells has to give us these permissions.

A

If you are struggling to add the labels, then you can just tag us in that VSA or ite ops in the issues, and then we can help you figure out like sorry marks, and we can help you figure out like what's missing or if you miss a person or if you miss the label, that shouldn't be too much problem like. Why would we really need from the managers is mostly the permission section.

C

That's helpful and then, when we do have that in more template when we're ready to submit the mr who do, we assign the mr2 for a new access request employed. So.

A

For the image it has to be approved by I will was at that at the bottom of the page, that has to be added approved by the director of your department and also a manager or senior manager, sometimes like. If the director approves with an approval of this year manager, but I prefer Chamba for recruiting. You only have the VP of recruiting what works, but it has to be a senior leader and once that's approved, like PMI, is a profile and we can proceed with it can be. The BSA is the accumulated.

A

If anyone in business operations or LP they can mesh the access requests so um also something I wanted to mention is that we haven't actually changed like the templates were just pleading to. We haven't actually changed the content of the templates or the format. Really it's just that before we had in the templates, we had the personal details and then we have the parishioner section. What we did was just split that into two and the personal details are filled out by the board and then the probationer section is just joined to that person victims.

A

So it's the same format, same process as before. We just remove the personal details.

C

Managers have reported as they we're trying to submit a role based access request, template, but until the user and set up their gait lab account and set up a slack like you know, there wasn't enough information. That's great.

B

Those taste they can always make it and issue bodies can always be changed, so I mean I, get that that stop sign, but it shouldn't stop them. You can always update it later, just that they should be aware of that they just started already, but now for if they have the role base template now, they should not be worrying about it anymore for all future hires. So that will be interesting. Yeah.

A

And also something I already said that remembering what's happening and we'd love, but if you have new hires or new roles starting next week, it's better. If you create the rule base entitlement like a week before at least a week before the new role person sites, just so that it can get matched in time. You can get approved in time and then and then yeah.

A

You don't have to worry for like about future hires with that role, which was like one-time thing, I'll I'll also I have created issues so that I'm gonna type every department leader and tell them. Oh. These are the templates that we already have, and these are the roles that you have, that don't have templates so that they are aware of that, and also something to keep in mind is that we do need official, bamboo, HR names for the roads.

A

So I noticed that we have an alliance partner manager, I think role in in the organizational chart. But then, if you go to bamboo HR, that role doesn't exist so that will not create an AR and.

B

I type when boot titles are the source of truth, so if a title needs to be changed that needs to be discussed to it. I think Britney is the DRI on job titles. We just need to make sure, but actually that's something another topic that we should not to go too deep in it, but we should make sure that job titles on bamboo are the same as job titles on the team page and the organizational chart. But yeah that's another thing, but if it's specific for your team definitely make sure that you figure it out.

B

So it's it's! It's correct. So.

D

I have a point, a question of clarification here. For so anytime, I am creating a new AR.

B

D

Anytime, I'm creating a new template for the access request. Do I need to submit it to Jack Brennan or do I need to submit it to someone on like a director and the people, ops team, or so you.

A

Mean for approval yeah for the merge, so it will be both because Jackie's a senior manager and then we also need the director. So at the end of we usually say in the in the template that I created to create templates, it says a senior manager in a director should be approve, and also, if it's like something, you know like admin, permissions or a permission. That's kind of controversial I will also need security approval, but yeah, it's probably we're. Probably before making it.

A

It will notice that security has approved or something like that will also import them if needed. It.

B

Depends on the the entitlements you give the the template, if you say, admin, access to bamboo HR, then that template needs to be approved by the DRI of bamboo HR. If you say, admin access on Salesforce and it's the director of sales that needs to this. This rule can get that type of access, that's kind of how it has to go and how it's always been just to make sure that you can't just create a template.

B

That would give fairies, give too much access to someone, and there is a sort of control yeah, but also you.

D

B

Always think people like you can always being someone from business or you know there were people ops, even like hey, who should check you know it's not like you're on your own, and you can always ask who can approve this and.

C

Generally, the sales, the sales role entitlements, Tanuja have been there's an IT section, a sales, ops, I think that's filled, ops but sales, ops and then marketing ops, so I think what I would recommend for sales out and not Jack, but we should get it approved by I'm, James, Harrison, okay,.

A

C

And then probably Dara from a marketing ops perspective and then maybe work with amber or the this team to get the IT staff approved.

B

Currently, for, for example, for the role Account Executive mid-market, it says that changes to the template have to be approved by the Director of Sales Operations and the sales operation manager. So that could be something that you can use for. You know you can look at other templates to see who should it be.

C

It's just a time. I just went checked our last couple days. I know we're about out of time. Today, I will talk about communicating the new process to field managers in terms of number three. Thank you for identifying those folks that started this week, yeah the real. We would love your help. If you don't mind of going back even a week or two I know, the process is to is asking managers to do it. The reality is, we've often see that they don't so. Okay,.

B

C

Can help us even look back. You know one week, two weeks, I don't know there hasn't been a proliferation of hiring of late. So hopefully it's not a big ordeal, but any chance. You could take a look at the last hires for the last couple weeks.

C

Thank you. Okay,.

A

That's also something that we wanted to avoid, because we notice a lot of managers forget to create access requests and then the new team members are just completely losing that, like how do I get access.

A

Everyone lives. Oh yes,.

C

And we love you for that, because what happens? The manager won't, do it and they're busy right, nobody Arius intent, but ends up. They don't get asked us to write system, they get frustrated, they don't know why, and then they pointed us and say you're responsible for onboarding like you're, it's wrong the system's broken and you can't really say: well, you didn't do it.

B

Good yeah you're right about that and I will check and four point four I take that, as we said, we're gonna do a retro about the project, but definitely in the sake of iteration, a better step would have been let's work with one team or one department and with this access request, automation with them get feedback, and then you know and they're all more and more teams. We did it.

B

We can't go back if we would roll back, it would be even more confusing but definitely learned from it and will be more iterative in future projects, but yeah. It is what it is.

C

This is such a wonderful improvement. Thank you for all your efforts, so yeah. Please know it was coming from best intent to just.

D

C

Mistakes everything this was a mistake like can always improve on things. Indeed,.

B

Yeah and afterwards it's always easy to see, we could have split it up. You know yeah, of course, but anyway I'm glad that you spoke up and you give your feedback.

B

It would be great, if maybe you could share this video or upload it on our debt, weapon, filter, I, don't think I shared anything that wasn't public, so I think then we can maybe even post it in you know, what's happening at kids lap again and ask people okay, if you're so confused, you can read more and I will make sure to check the back for two weeks for your department and I think there was another I had other to do us to make sure that on the onboarding template we changed it to day two instead of day one.

B

If, if you start making templates- and you need help, feel free to also pick me, I, don't mind, jumping on a call sharing a screen recording it I think that makes even more sense than us making a video faking. We make a template and actually really going through, making a template, because then we have to figure it all out.

B

You know from start to having it assigned to the right people, so if you want feel free to set up a call with me and and this could be involved, which I mean we could do it without her I I, think that would be useful. So if you have a template, you're about to make feel free to set that up, yeah.

C

We'd love to do that. Cuz I previously worked with Jamie Kerry set stuff up, but since then Tanuja has the responsibilities for sales onboarding. So I was looking for an opportunity to how can I transition astern, so I think this would be great to go through that.

B

That sounds good yeah feel free to set that up with me. We.

C

Will do it? Okay,.

B

If anything else are gonna way, wrap it up. That's.

C

It thanks so much. Okay,.

B

Have a great weekend, I.