What problem does it solve?
This Skill solves the problem of inconsistent, ad hoc authorization logic by turning access control into an explicit roles, permissions, and resource matrix with clear deny-by-default rules. It helps teams prevent cross-tenant leaks, IDOR issues, and privilege creep before implementation.
Core Features & Use Cases
- Role and permission design: Define who can do what across tenant roles, platform roles, service accounts, and brokered support access.
- Object-level authorization rules: Specify membership, ownership, and grant-based checks for every tenant-owned resource.
- Enforcement-point mapping: Document where authorization is enforced across UI, API, services, background jobs, integrations, and admin consoles.
- Negative-test planning: Create denial tests for escalation, revocation, cross-tenant access, and expired impersonation.
- Migration safety: Plan additive role changes with shadow dual-checks and rollback paths.
- Use case: A SaaS team is adding billing admin access and support impersonation, and uses this Skill to define the exact permissions, scope limits, audit expectations, and forbidden actions.
Quick Start
Use the authorization matrix designer skill to define a deny-by-default access model for my multi-tenant app, including roles, permissions, object-level rules, enforcement points, brokered support access, and negative tests.
