skills.rest
agent0ai
agent0aiOFFICIAL
Explore all skills by this author →
Website𝕏@Agent0aiGitHub

Admin Groups

Edit L1 group.yaml files to manage membership and admin access.

1.4k|316|Updated Mar 27, 2026
Search Tags:#authorization#group management#admin access#workspace governance#yaml config#permission inheritance#identity rules
One-click install
npx skills add https://github.com/agent0ai/space-agent --skill admin-groups-agent0ai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Admin Groups
Source: https://github.com/agent0ai/space-agent/tree/main/app/L0/_admin/mod/_core/overlay_agent/ext/skills/admin-user-management/groups
Command: npx skills add https://github.com/agent0ai/space-agent --skill admin-groups-agent0ai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps admins understand and correctly manage user and group membership—especially admin access—without accidentally breaking permissions or writing membership rules to the wrong files.

Core Features & Use Cases

  • Canonical group.yaml management: Creates and updates L1/<group>/group.yaml as the single source of truth for included users, included groups, managing users, and managing groups.
  • Admin access via _admin group: Grants or removes elevated permissions by editing L1/_admin/group.yaml with included users and included groups.
  • Correct mental model for inheritance: Clearly separates membership inheritance (included_*) from manager inheritance (managing_*) and explains the special behavior of _all and _admin.

Quick Start

Use the skill to explain how _all and _admin work and then update L1/<group>/group.yaml to add user alice and allow her to manage that group’s tree.

Frequently Asked Questions about Admin Groups

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage admin access and group membership using group.yaml files?▼

You can manage group membership by editing the canonical `L1/<group>/group.yaml` file, updating the `included_users`, `included_groups`, `managing_users`, and `managing_groups` fields to safely control access and inheritance without breaking permissions.

What is the difference between included_users and managing_users in YAML group config?▼

In `group.yaml` config, `included_users` and `included_groups` control membership inheritance, granting access to the group's tree. `managing_users` and `managing_groups` provide manager inheritance, allowing users to manage the group tree without granting underlying membership access.

How do I grant or remove workspace admin permissions safely?▼

To grant or remove workspace admin permissions, you must edit the `L1/_admin/group.yaml` file. Add or remove users and groups from the `included_users` and `included_groups` fields to safely manage elevated admin access.

Why should I avoid writing identity rules and membership to arbitrary files?▼

You must avoid writing membership rules to arbitrary files to prevent breaking permissions. The canonical `L1/<group>/group.yaml` file is the single source of truth for identity rules, ensuring correct permission inheritance and safe workspace governance.

How does the _all group inheritance behavior work in workspace governance?▼

The `_all` and `_admin` groups have special inheritance behaviors defined in `group.yaml`. The skill explains these semantics, ensuring that `included_*` fields for membership and `managing_*` fields for manager roles apply correctly across the workspace tree.

Can I change runtime groups under L1 by updating group.yaml fields?▼

Yes, you can create and update runtime groups under L1 by editing the `L1/<group>/group.yaml` fields. This allows you to change included users and groups while maintaining separate inheritance semantics for managers and members.

Related Skills

Explore More Legal & Compliance Skills→
houfuhoufu
1

Tag Registry Skill

Suggest canonical blog tags and enforce registry governance rules.

Community
Intermediate
binary16labsbinary16labs
5

Admin Groups

Manage group membership and admin permissions in L1 group.yaml files.

Community
Basic
4e696b6f4e696b6f

clawsec-perm

Scan filesystem permissions for agent identity files and session directories.

Community
Intermediate
unblockedunblocked
11

unblocked-context-get-urls

Retrieve full content from provided URLs using the context_get_urls command.

Official
Basic