skills.rest
SSiertsema
SSiertsemaCOMMUNITY
Explore all skills by this author →
GitHub

authorization-modeling

Design authorization models with RBAC, ABAC, ReBAC, or PBAC.

1|Updated Nov 29, 2025
Search Tags:#authorization#rbac#policy#abac#access-control#rebac#pbac
One-click install
npx skills add https://github.com/SSiertsema/claude-code-plugins --skill authorization-modeling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authorization-modeling
Source: https://github.com/SSiertsema/claude-code-plugins/tree/main/authorization-modeling/skills/authorization-modeling
Command: npx skills add https://github.com/SSiertsema/claude-code-plugins --skill authorization-modeling

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Design authorization models that determine who can do what to which resource. Across RBAC, ABAC, ReBAC, and PBAC, enabling least-privilege access and auditable decisions.

Core Features & Use Cases

  • Model catalog for selecting RBAC / ABAC / ReBAC / PBAC based on domain complexity.
  • Per-resource design guidance detailing actions, subjects, and conditions for common resources.
  • PDP / PEP architecture guidance to separate decision and enforcement with audit trails.

Quick Start

Describe the authorization need for a resource, select a model (RBAC / ABAC / ReBAC / PBAC), and draft a simple policy example.

Frequently Asked Questions about authorization-modeling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose between RBAC, ABAC, ReBAC, and PBAC for access control?▼

Access control model selection depends on domain complexity. A catalog helps you choose between RBAC, ABAC, ReBAC, and PBAC by evaluating role hierarchies, attribute policies, and relationship graphs to support auditable decisions.

What is the best way to design per-resource authorization policies?▼

Per-resource authorization design details specific actions, subjects, and conditions for each resource type. This guidance ensures least-privilege access by mapping exactly who can perform which actions on which resources.

How does a PDP and PEP architecture support auditable authorization decisions?▼

PDP and PEP architecture separates authorization decisions from enforcement. This separation ensures clear policy decision points and policy enforcement points while maintaining comprehensive audit trails for every access decision.

When should I use ReBAC instead of RBAC for relationship-based access control?▼

ReBAC is ideal when access depends on complex relationship graphs between resources and subjects. Use it instead of RBAC when simple role hierarchies cannot capture the nuanced, interconnected permissions your domain requires.

How do I implement least-privilege access with attribute-based policies?▼

Least-privilege access is implemented by defining strict attribute policies within your ABAC model. You draft specific conditions that evaluate subject and resource attributes to restrict actions precisely to what is necessary.

What are the limitations of using RBAC for complex authorization models?▼

RBAC limitations emerge when domain complexity requires attribute policies or relationship graphs. Simple role hierarchies struggle to enforce fine-grained, least-privilege access across dynamic resource conditions without becoming unmanageable.

Related Skills

Explore More Software Engineering Skills→
easycheneasychen
16.6k

opc-resource-audit

Identify and inventory founder resources across eight specified categories into opc-doc/.

Community
Intermediate
awsaws
2.3k

securing-s3-buckets

Secure S3 buckets with access control, encryption, logging, and monitoring.

Official
Advanced
CenredJunCenredJun

oauth-oidc-implementer

Implement OAuth 2.0 and OpenID Connect authentication flows with PKCE and JWT validation.

Community
Advanced
aviskaaraviskaar
6

iam-specialist

Design IAM architectures with RBAC, ABAC, PAM, and lifecycle management.

Official
Advanced