Overview
Security groups are only useful when membership stays understandable. In Tessact, the membership governance job is simple:- make sure each group still has a clear purpose
- make sure the right people belong
- remove people when the cohort no longer matches reality
What To Review
For each custom group, ask:- Does the group still represent a real operating cohort?
- Is the description specific enough for another admin to understand it?
- Are the listed members still the right people?
- Is the group duplicating an organization role or workspace membership pattern?
Signals That A Group Needs Cleanup
- The name is generic, but the members are highly specific.
- The description is empty or no longer true.
- The group has one member and no clear reason to exist as a reusable cohort.
- Different admins would disagree about who should belong.
- The same function could be expressed more clearly with workspace membership or org role assignment.
Default Group Handling
The built-in All Organization group is auto-managed. Admins should review it for understanding, not for manual curation. Use it as a conceptual baseline:- everyone belongs there automatically
- it should not be used to express a special cohort
- it should not be treated like a cleanup target
Recommended Review Rhythm
This is usually enough. Security groups do not need daily attention unless the organization is changing rapidly.
Best Practices
- Make every group answer a clear business question.
- Remove groups that exist only because nobody wanted to decide the right role or workspace.
- Keep descriptions current.
- Use membership reviews as part of quarterly access governance.
- Prefer clarity over theoretical flexibility.
Next Steps
Security groups basics
Return to the main model behind the security groups directory.
When to use security groups
Decide whether a new group is warranted before creating one.