skills.rest
Sir-chawakorn
Sir-chawakornCOMMUNITY
Explore all skills by this author →
GitHub

design-authorization-model

Design centralized authorization layers for RBAC, ABAC, and ReBAC models.

9|3|Updated Jun 13, 2026
Search Tags:#authorization#security#rbac#multi-tenancy#policy-as-code#opa
One-click install
npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill design-authorization-model
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: design-authorization-model
Source: https://github.com/Sir-chawakorn/sanook-cli/tree/main/skills/design-authorization-model
Command: npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill design-authorization-model

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the issue of fragmented, insecure, and hard-to-maintain authorization logic by providing a centralized, testable, and policy-as-code approach to access control.

Core Features & Use Cases

  • Policy-as-Code: Implement RBAC, ABAC, or ReBAC using industry-standard engines like OPA, Cedar, or OpenFGA.
  • Multi-tenant Isolation: Enforce strict data boundaries at both the application and database (RLS) layers.
  • Use Case: Use this skill to refactor scattered if-else permission checks into a single, robust authorize function that prevents IDOR vulnerabilities and cross-tenant data leaks.

Quick Start

Analyze my current codebase to identify scattered authorization checks and propose a centralized policy-as-code structure using OPA.

Frequently Asked Questions about design-authorization-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is policy-as-code for centralized authorization?▼

Policy-as-code for centralized authorization replaces scattered if-else permission checks with a single, testable authorize function using engines like OPA, Cedar, or OpenFGA to enforce access control models.

How do I refactor scattered authorization checks into a centralized policy structure?▼

To centralize authorization, you refactor scattered permission checks into a single robust authorize function that implements policy-as-code, preventing IDOR vulnerabilities and cross-tenant data leaks.

How do I enforce multi-tenant isolation with row-level security?▼

Multi-tenant isolation is enforced by applying strict data boundaries at both the application layer and the database level using row-level security (RLS) to prevent cross-tenant data leaks.

Does this authorization approach support RBAC, ABAC, and ReBAC models?▼

Yes, this centralized authorization layer supports RBAC, ABAC, and ReBAC access control models, allowing flexible policy-driven permission enforcement tailored to your application's needs.

What is the best way to prevent IDOR vulnerabilities in a multi-tenant application?▼

The best way to prevent IDOR vulnerabilities is implementing a centralized, deny-by-default authorization layer that enforces strict multi-tenant data boundaries at both application and database layers.

When do I need to separate authentication from authorization logic?▼

You need explicit separation of authentication from authorization when requiring a secure, testable, and policy-driven permission enforcement layer that applies deny-by-default security across multi-tenant architectures.

Related Skills

Explore More Software Engineering Skills→
SaidabbosSaidabbos

permission-system

Automate role-based access control in Laravel with Spatie Laravel Permission.

Community
Intermediate
ValyntValynt

rls-policy

Automate creation, auditing, and enforcement of PostgreSQL row-level security policies.

Official
Advanced
hammadurrehman2006hammadurrehman2006

fastapi-security-expert

Validate JWT bearer tokens and enforce tenant isolation in FastAPI routes.

Community
Advanced
williamzujkowskiwilliamzujkowski
17

authorization-security

Implement RBAC and ABAC authorization with policy enforcement and audit trails.

Community
Advanced