Re-scope step 8: Help Desk Admin through a group

[rachmo]

Docs only. Re-scopes lifecycle step 8 (capability G) after we found the original plan could not work.

Why. The 2026-09-26 plan had hawk-mod report who holds which delegated admin role. Google lets only a Super Admin see role assignments, and no custom-role privilege changes that, so hawk-mod@ could never have read them.

Decided with Rachel on 2026-10-02 (now in docs/lifecycle-sync.md, step 8):

• Help Desk Admin (password resets) is the only delegated role. Groups Admin is no longer given out, because group membership comes from the sheet.
• The role is carried by a new security group, computed from Mentor_Admin_Roles: Active Mentors whose CORI is current.
• Every change to that group is a click, re-read at the click. Leavers are taken out by their existing Remove from groups.
• Any other account Google flags as an admin is reported. Each Super Admin is acknowledged once.
• Slack administrators get a step of their own.

Still open (listed in the doc): who may click the group's change (any Slack admin, or only Google Super Admins), and the group's name. Before anything depends on them, two things must be proven with a real call: whether hawk-mod@ can change the members of a group that carries an admin role, and whether Google then flags those members as admins.

Also updates google-setup.md (step 8 now adds no delegated scope) and lifecycle-sheet.md (Help Desk Admin is the only dropdown value; Rachel changes the sheet's Reference_Lists).

🤖 Generated with Claude Code