Adopted 2012-03-16

Policy on the Use of Linerva Administrative Rights

Users of Linerva have a reasonable expectation that the data, processes, and
credentials used on Linerva will not be improperly accessed, used, modified, or
destroyed by anyone else, including Linerva maintainers. To fulfill this
expectation, we define a policy governing the maintainers' use of their
permissions.

Such use of administrative rights shall only be permitted under any of the
following circumstances.

* Maintenance of the Linerva service itself that is unrelated
  to individual users.

* Any access that is explicitly authorized by the users in question.

* Actions that are necessary for server security or reliability. In general,
  users should be notified when they are affected. Minor changes affecting all
  users don't need to be sent out, but serious changes affecting a large number
  of users should be sent out to linerva-announce or similar, and affected
  users should be notified of targeted actions (e.g., killing memory-intensive
  processes).

* Actions required to comply with duly-authorized directives of IS&T, MIT,
  or the law.

When using administrative rights, consider the following:

* When possible, rather than using admin permissions directly, maintainers
  should contact users and ask them to make changes (e.g., users actively on
  zephyr should be informed of a memory-intensive process, rather than killing
  the process directly).

  - We should aim not to contact users unless their usage of Linerva is causing
    problems, or reasonably likely to cause problems in the near
    future. As Linerva has historically aimed to be a platform for running
    nearly anything needing a Linux dialup, contacting users and asking them to
    make changes due to trivial matters is reasonably likely to reduce their
    comfort with using Linerva freely, which is unfortunate.

* Particularly avoid using credentials or accessing private data. Killing a 
  process or running a quick chmod is much less intrusive and less likely to be
  abusive than resuming a screen session, reading a file, or editing a file.
  Respect users' privacy, and their trust.

  [ Adopted 2012-03-16 by agreement of all Linerva maintainers as of that date:
  * Alex Chernyakhovsky <achernya>
  * Alex Dehnert <adehnert>
  * Anders Kaseorg <andersk>
  * Geoffrey Thomas <geofft>
  * Edward Yang <ezyang>
  * Bethany Lapenta <lapentab>
  * Josh Oreman <oremanj>
  ]