Enterprise Managed Users: Guest role users cannot see internal repositories

[github-product-roadmap]

Summary

Enterprise Managed Users provides an enterprise with an isolated set of organizations and repositories, that are not visible unless you're a member of the enterprise. They support only internal and private repositories, and users must sign in from the linked IdP in order to access them.

This improvement introduces a new user role, guest, alongside the existing member and admin roles. The role is set by the IdP at provisioning time, and limits these users to seeing repositories they are added to only. They can not see internal repositories by default.

Intended Outcome

Companies can safely inner-source their code using the internal access level, while also allowing guests into their environment to work on select parts of the codebase.

How will it work?

Users provisioned to an EMU enterprise as "Guests" will have access only to orgs and repos they are explicitly added to. They will not automatically receive access to internal repositories just by being a member of the parent org.

Users will still need to sign in from the linked IdP in order to access the enterprise, in order to keep access control at the IdP. Provisioning rules can be set up to automatically apply the Guest role to guests in the tenant, pivoting off of the user type stored in the IdP.