We wrote a custom controller that manages Google workspace and github groups. This allows us to use those groups for identity.

Changes to those groups happen solely by the PR process.

HR, is only responsible for adding them to the single group which allows single sign on access not does not give any other access.