Agent skill
access-control
Design RBAC/ABAC models, Principle of Least Privilege, Identity Management.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/security-andreibesleaga-gabbe-8
SKILL.md
access-control Skill
Identity is the new perimeter. Authorization must be strict, consistent, and auditable.
1. Models
- RBAC (Role-Based):
Admin,Editor,Viewer. Simple, coarse-grained. - ABAC (Attribute-Based):
CanEdit if user.dept == doc.dept AND time < 5pm. Flexible, complex. - ReBAC (Relationship-Based):
CanView if user is friend_of document.owner. (Graph-based, e.g., Zanzibar).
2. Best Practices
- Least Privilege: Start with
Deny All. ExplicitlyAllowspecific actions. - Decoupling: Decouple logic (
if user.isAdmin) from policy (can(user, 'delete:report')). Use libraries like CASL or Oso. - No Hardcoded IDs: Never checks
if (user.id === '123').
3. Infrastructure IAM
- Service Accounts: Separate identity for apps/machines. Rotate keys automatically.
- Short-Lived Credentials: Use OIDC/STS (AssumeRole) instead of long-lived access keys.
4. Audit
- Log Decisions: "User X tried to do Action Y on Resource Z -> Result: DENIED".
- Review: Quarterly review of
Admingroup membership.
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?