some todo notes for TPA-RFC-11

policy/tpa-rfc-11-svn-retirement.md

@@ -62,6 +62,16 @@ In [issue 32273][], a set of requirements was proposed:
    (e.g. are Nextcloud access controls? sufficient? can we put stuff
    on Google Docs? what about share.riseup.net or pad.riseup.net? etc)
 
+## Access controls
+
+TODO: send this to isa
+
+ * Groups: whoever the group admins decide
+ * Admins: anarcat, gaba, hiro, linus, micah
+ * Sysadmins: Riseup
+
+TODO: Mention encryption.
+
 # Proposal
 
 The proposal is to retire the SVN service by December 1st 2021. All