Add enterprise team membership support

[buckelij]

The Revenue org wants to ship Copilot plugins to Revenue Hubbers via Copilot enterprise-managed settings https://github.com/github/agent-control-plane/issues/1290. Enterprise-managed settings work by applying policy to members of Enterprise Teams. Entitlements does not appear to currently support syncing to enterprise teams.

This PR adds support for enterprise team sync.

GitHub enterprise teams use a separate REST API from organization teams, so the existing backend cannot manage their membership. This adds a dedicated github_enterprise_team backend for synchronizing members of existing Enterprise Cloud teams.

The backend reads paginated membership state, computes entitlement differences, and applies additions and removals through the bulk membership endpoints.

Enterprise team creation is intentionally out of scope because the referenced API manages membership only. Authentication requires a classic PAT with read:enterprise and admin:enterprise; GitHub App and fine-grained tokens are not supported by these endpoints. Do we have an existing token configured with those scopes?

I ran into some hiccups trying to follow https://github.com/github/entitlements/blob/master/script/dev/README.md (I think these instructions are infrequently used) but I was able to get Copilot to set things up enough to smoke test.

[Copilot]

Pull request overview

Adds enterprise-team membership synchronization alongside existing organization and team backends.

Changes:

• Adds controller, provider, and REST API service components.
• Supports paginated reads and bulk membership updates.
• Adds configuration documentation and unit tests.

Show a summary per file

File	Description
README.md	Documents enterprise-team configuration.
lib/entitlements/backend/github_enterprise_team.rb	Loads the new backend.
lib/entitlements/backend/github_enterprise_team/controller.rb	Registers and orchestrates synchronization.
lib/entitlements/backend/github_enterprise_team/provider.rb	Caches state and computes differences.
lib/entitlements/backend/github_enterprise_team/service.rb	Implements enterprise-team API operations.
spec/unit/spec_helper.rb	Loads the backend for tests.
spec/unit/entitlements/backend/github_enterprise_team/controller_spec.rb	Tests controller behavior.
spec/unit/entitlements/backend/github_enterprise_team/provider_spec.rb	Tests caching, diffs, and commits.
spec/unit/entitlements/backend/github_enterprise_team/service_spec.rb	Tests API reads and updates.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 9/9 changed files
• Comments generated: 3
• Review effort level: Balanced

[buckelij]

@github/entitlements-reviewers @jar349 do you have a rough estimate of when you'll be able to review this PR?

[jar349]

rough estimate: By End of Next week plus or minus 2-3 business days

[TarteNouveau]

@TarteNouveau to schedule a call to discuss this PR and understand the larger context. @buckelij is there anyone else we should add to that call to discuss this ask?

[buckelij]

@TarteNouveau you could also invite @gpadak and @travisgosselin

[TarteNouveau]

meeting invite sent for 2026/09/10

[gpadak]

Hello 👋 I want to connect this effort also to Product Ops and Design teams who are also looking to get onboarded to dogfood managed settings for Copilot client customization. The cc's there are @spaltrowitz and @cmcnally.

https://github.com/github/agent-control-plane/issues/1290 describes all the steps we need to take - enterprise teams management is one component of it. We also need help with the access required to enable managed-settings for the github enterprise.