duck-iam

Define type-safe RBAC and ABAC access control with a declarative builder pattern.

8|1|Updated Mar 5, 2026
One-click install
npx skills add https://github.com/gentleeduck/duck-iam --skill duck-iam
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: duck-iam
Source: https://github.com/gentleeduck/duck-iam/tree/main/skills/duck-iam
Command: npx skills add https://github.com/gentleeduck/duck-iam --skill duck-iam

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a robust and type-safe way to manage access control in applications, ensuring that users only have the permissions they are explicitly granted, based on roles and attributes.

Core Features & Use Cases

  • RBAC & ABAC: Supports Role-Based Access Control and Attribute-Based Access Control for flexible permission management.
  • Framework Integrations: Offers middleware and helpers for popular frameworks like Express, Hono, Next.js, and NestJS.
  • Client-side Components: Provides React hooks and components for managing permissions on the frontend.
  • Use Case: Securely manage user access to different resources (e.g., posts, users) within a web application, ensuring editors can update posts but only if they are the owner.

Quick Start

Use the duck-iam skill to define a role named 'editor' that can update posts.

Frequently Asked Questions about duck-iam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement type-safe RBAC and ABAC access control in my application?

You can implement type-safe RBAC and ABAC access control using a declarative builder pattern to define roles, policies, and rules, ensuring users only have explicitly granted permissions based on roles and resource attributes.

Can I use this access control skill with Next.js and Express frameworks?

Yes, this access control skill provides framework integrations including middleware and helpers for Next.js, Express, Hono, and NestJS to securely manage user access to resources.

What is the difference between RBAC and ABAC for managing application permissions?

RBAC manages application permissions based on user roles, while ABAC evaluates granular permissions dynamically using resource attributes, and this skill supports both access control models type-safely.

How do I manage client-side permissions using React hooks?

You can manage client-side permissions using provided React hooks and components to evaluate access control rules directly on the frontend, ensuring secure authorization across your web application.

How do I restrict editors to only update posts they own?

To restrict editors to updating only posts they own, define an ABAC policy using the declarative builder pattern that checks resource attributes, verifying the user is the owner before granting update permissions.