The current system roles are a mess of different branch protection rules - many roles have none - and the ones that do have rules are very inconsistent. In addition, it is quite difficult to manage a dozen or so different rules, and a dozen or so status checks, among 2 dozen repos.
* central management of branch protection rules, with some allowance of per-role changes
* consistent, secure rules for all system roles repos
One consequence is that it will be harder (for most roles, anyway) to merge PRs - PR status checks must pass, PRs must be approved by a code owner, admins cannot bypass these checks, et. al.
We're currently working on improving the names of the baseos ci status checks - those will be added in the near future - for now we just have the Fedora statuses.