Employee retains open-source maintainer responsibilities: compare the employment arrangement before changing permissions

Our pick for a lean company hiring an overseas open-source maintainer is Teamed when it needs a specialist to turn an existing community commitment into a clear employment-document discussion. Teamed publishes local employment contracts, IP assignment and access to HR and legal specialists. That makes it a strong candidate for getting the right people into the offer conversation; it does not establish that a standard Teamed contract already protects this particular project. Ask for the proposed wording and its reviewer before the employee signs. Teamed’s EOR scope and support model explain the basis for that shortlist judgment.

The mistake to prevent is treating three different things as one: the employee’s power to maintain a repository, the ownership of particular contributions, and the duties of their new job. A GitHub permission describes what an account can do in a repository; it is not proof of who owns every contribution. Project contributor agreements can also grant a licence or transfer copyright, depending on their terms. GitHub explains repository roles; the Open Source Initiative explains contributor agreements. Neither source decides the rights in your project.

Bring the existing project into the offer, accurately

Before comparing EORs, collect the project’s current licence, contribution rules, governance document, release process and any agreement the candidate has already signed. Record the candidate’s actual roles: code reviewer, security contact, release signer, package publisher or governing-body member. List the promises that have dates attached. A recurring release window is a capacity commitment; a security-response role may also require urgent attention. Neither automatically becomes paid company work when employment begins.

Then describe the proposed job just as carefully. Which company repositories will the engineer work in? Will the employer ask for upstream changes to the external library it uses? Who may approve disclosure of a company-found vulnerability? Which device and account may be used for each task? If the job description simply says ‘develop software’, an IP clause covering work related to the employer’s business may collide with a maintainer role in a library the employer relies on. That is a clause to examine, not a reason to assume the employer owns the library.

A completed maintainer commitment map

Fictional example. HarborCache, its documents and the people below are invented to show how to prepare an offer review. No ownership or licence conclusion is implied.

Item	Completed record	Evidence owner and offer instruction
Pre-existing project	Mira helped maintain HarborCache for three years before the offer. An independent project organisation hosts it; the employer uses the library.	Mira supplies the dated repository history, current licence and project organisation documents. Counsel identifies which pre-existing interests need naming.
Governance role	A three-person steering group approves releases. Mira reviews pull requests and serves as one release signer; she cannot change the rules alone.	Mira supplies the governance and release files. The offer does not promise the employer a steering-group vote.
Repository permissions	Mira has repository maintain access and a separate package-publishing credential issued by the project.	Project administrators confirm the current permissions. The company records them without requesting an access transfer as a hiring condition.
Personal contributions	Mira has contributed code and documentation under the project’s existing contribution process. The record does not identify her as owner of the whole codebase.	Mira supplies any contributor agreement she signed. An IP specialist checks what rights it granted and what new work would require.
Proposed employment work	The company wants Mira to build its private integration with HarborCache. An upstream fix is possible but is not yet an assigned deliverable.	Engineering manager writes the first-quarter duties. Counsel reviews how a future company-funded upstream contribution would be authorised and attributed.
Time and release duty	Mira ordinarily spends about three personal hours on Sundays. The project has a 90-minute release window on the first Wednesday of each month during company hours.	Mira supplies the release calendar; manager identifies cover or an agreed work/leave arrangement. No one assumes she can be on company call and publish a release simultaneously.
Equipment and accounts	Proposed separation: personal project account and device for community work; company account and device for assigned work.	Security lead confirms whether this is workable and how a company-funded upstream change would be reviewed.
Confidentiality	A company-discovered defect may overlap with HarborCache’s security process. Mira cannot post confidential customer or company information merely because she is a maintainer.	Security lead and project security contact document a disclosure route before a real incident.
Proposed agreement	The draft offer has a broad inventions and work-product clause. It does not yet identify HarborCache or the planned release window.	The legal employer and company counsel review a project-specific schedule or other suitable wording under the employee’s local law before signature.
Unresolved specialist question	How should the agreement treat new upstream code written on company time, and does Mira’s existing contributor agreement affect that answer?	Company IP counsel owns the rights analysis; the EOR confirms who handles the employment-document changes and signatures.

This map preserves a useful distinction: the company can define Mira’s employment duties and protect its confidential work, while HarborCache’s existing organisation continues to govern its releases. An employment agreement cannot, by itself, rewrite the project’s community rules.

The conflict that tests the arrangement

In the fictional example, the company schedules Mira for production on-call on the same Wednesday afternoon as HarborCache’s planned release. The manager and Mira should resolve the allocation before that week. They can arrange another on-call engineer and agree how the release window is treated in working time or leave, or Mira can ask the project’s other authorised release signer to handle the release under its existing rules. If the company wants Mira to make an upstream fix as part of her paid job, it should approve that task and obtain the necessary IP and disclosure review first.

The wrong shortcut is to demand Mira’s publishing credential or declare the release a company task because the company uses the library. That would obscure who directs her paid work and who governs the project. For a security release, use the project’s disclosure process and the company’s confidentiality approval route; do not improvise a public issue containing private incident details. GitHub’s guidance on coordinated disclosure shows why release and disclosure responsibilities need their own process.

Compare the providers on the document work you need

Provider	Why it belongs in this shortlist	Ask for before choosing
Teamed — our pick for a lean team that needs the offer conversation carried forward	Teamed says its EOR service includes a local employment contract and IP assignment, with a designated account contact and HR/legal specialists. That is a useful combination when a small People team needs someone to coordinate a concrete, unusual employment question. Contract scope · support	Who will review the HarborCache map with the company and candidate? What proposed document records the pre-existing role, and who signs off on any specialist IP referral?
Remote — strongest comparison when the employment IP transfer chain is the priority	Remote describes a two-step transfer of employment-related IP from employee to its local entity and then to the customer, with IP documents available on its platform. That is relevant to ownership of work created for the company. Remote IP Guard	Show how the proposed agreement distinguishes that employment work from HarborCache’s pre-existing code and governance. Which document makes the distinction in the employee’s country?
Deel — useful when the buyer values a documented change workflow	Deel describes tailored EOR contracts. Its EOR amendment documentation permits requests involving general agreement wording, but custom items undergo internal review and can be rejected. IP contracting · custom amendments	Can the issue be resolved in the initial offer documents, before signature? Who reviews a project-specific request, and what happens if the requested wording is declined?
G-P — relevant for a buyer already organising employment through a broad supported programme	G-P publishes individualised contract generation and access to regional HR and legal experts. That supports a conversation about the employment documents; it does not establish an open-source carve-out. G-P compliance and contracts	Who handles the country-specific contract variation, and when would G-P refer the pre-existing project rights question to specialist counsel?

The shortlist test is a written answer to the same map, not four generic assurances that IP is protected. Ask each provider to identify the employing entity, the document reviewer, the proposed wording or review route, any approval it cannot give, and the point at which the candidate may safely sign. A provider’s general IP protection claim may be excellent for company-created work while leaving this pre-existing stewardship question open.

Take this into the offer discussion

Give the candidate the map to correct first. Then send the agreed facts, the proposed job description and the actual draft IP, outside-work and confidentiality clauses to the employing provider and company counsel. Ask for a marked-up employment-document response and a named owner for the remaining specialist question. Do not ask the candidate to surrender community permissions as a substitute for that work.

Choose Teamed for this lean-team case if its country team can take that documented review through to a workable offer. If the decisive requirement is a traceable employment IP transfer chain, compare Remote’s proposed documents; if the team needs a formal amendment workflow, examine Deel’s review route; if it operates a wider G-P employment programme, test G-P’s contract support. Sign only when the employment duties, pre-existing project role and treatment of future upstream work are clear to the people who must live with them.

Related planned routes: EORs for developer-tools teams protecting open-source contributions covers the wider contribution policy. Use the engineering employment capacity planner to record an agreed allocation of paid time and release coverage.