# **Non-TSC Community Roles and Working Groups**

This document defines the roles and responsibilities of key groups and individuals within the Digital Supply Chain Authority and Cryptographic (DSAC) ecosystem that operate outside the Technical Steering Committee (TSC)'s policy-making scope.

These groups are responsible for technical execution, auditing, and community engagement.

## **1\. Specification Steering Committee (SSC)**

The SSC is the primary technical body responsible for the maintenance and evolution of the DSAC specification.

### **Responsibilities:**

1. **Specification Management:** Govern the technical structure and integrity of the provenance\_schema.json.  
2. **Versioning:** Approve and release new major and minor versions of the specification.  
3. **Technical Review:** Conduct in-depth review of all technical Pull Requests (PRs) related to the schema, implementation guides, and APIs.  
4. **Adherence to Risk Model:** Ensure that all changes to the specification align with the requirements and mitigations defined in the **Threat and Risk Model**.  
5. **Reporting:** Provide regular technical status updates and recommendations for policy changes to the TSC.

### **Membership & Leadership:**

* **Chair:** Appointed by the TSC, serves as the SSC's primary liaison to the TSC.  
* **Members:** Experienced software engineers, cryptographers, or security architects with deep familiarity with supply chain security and JSON schema standards.

## **2\. Audit and Compliance Working Group (ACWG)**

The ACWG is responsible for defining, executing, and reporting on the adherence of implementations to the DSAC specification and governance model.

### **Responsibilities:**

1. **Template Development:** Maintain and evolve the DSAC Audit & Compliance Template (dsac\_audit\_compliance\_template.md) to reflect current threats and specification requirements.  
2. **Implementation Review:** Review and validate official DSAC reference implementations and certified third-party tooling against the specification.  
3. **Vulnerability Reporting:** Act as the initial point of contact for vulnerability reports related to the specification or core reference implementations, coordinating with the TSC for public disclosure policy.  
4. **Risk Assessment:** Annually assess the compliance landscape across the ecosystem and report major compliance gaps or emerging risks back to the TSC.  
5. **Decision Logging:** Ensure that all audit decisions, findings, and compliance certifications are logged using the **Decision Log Template**.

### **Membership & Leadership:**

* **Chair:** Security compliance officer or auditor with experience in regulatory frameworks and technical auditing.  
* **Members:** Security engineers, formal verification specialists, and compliance experts.

## **3\. Community Liaison & Documentation**

This role focuses on external engagement, documentation, and the onboarding experience for new contributors and adopters.

### **Responsibilities:**

1. **Contribution Workflow:** Maintain and enforce the contribution guidelines detailed in **CONTRIBUTING.md**.  
2. **Public Communication:** Manage official public announcements, social media, and presentations on behalf of the project (with approval from the TSC for sensitive topics).  
3. **Documentation Maintenance:** Ensure the public-facing documentation (tutorials, getting started guides, FAQs) is accurate and user-friendly.  
4. **Onboarding:** Facilitate the onboarding of new contributors and guide them to the appropriate working group (SSC or ACWG).  
5. **Event Coordination:** Coordinate community meetings, public forums, and maintain the public meeting calendar.  
6. **Code of Conduct Enforcement:** Serve as an initial confidential point of contact for Code of Conduct issues, escalating severe matters to the TSC.

### **Position Requirement:**

* This role is often filled by a single individual (or a small team) who is an excellent technical communicator and community manager.