What problem does it solve? Authorization bugs in multi-tenant platforms are costly: a route gate placed on a per-resource endpoint silently refuses users holding explicit grants, and listings can leak or hide shared rows. This Skill encodes the project's three-layer permission model so new routes, roles, and grants are wired correctly the first time. ## Core Features & Use Cases - Correct gate placement: Enforces the rule that require(...) dependencies belong on collection routes while per-resource routes delegate to resolve_access in the service layer. - Permission and role authoring: Guides adding entries to the Perm catalog, assigning scopes (none, own, shared, all) across the owner/admin/builder/operator/member/viewer matrix, and testing refusals cross-tenant. - Grant and listing semantics: Explains visible_resource_ids (None vs empty list), grant widening without promotion, and contexts with no subject such as API keys and embed sessions. - Use Case: When adding a new org-scoped endpoint like POST /agents/{id}/publish, use this Skill to decide there must be no route gate, implement the resolve_access check in the service, and write a test proving a Viewer with an edit grant succeeds while another tenant is refused. ## Quick Start Use the permissions-rbac skill to add a new agents:publish permission, wire it into the role matrix, and gate the correct routes.
