rbac-permissions-architect

RBAC permission design for multi-tenant systems requires defining workspace-level architectures, mapping features to granular resources and actions in `resource.action` format, and establishing independent permission matrices per workspace. This Skill guides you through feature-resource-permission mapping, workspace isolation principles, and integration with reference materials to ensure consistent access control without manual oversight.

Structure permissions by clarifying how Owner and Super Admin roles bypass normal checks while respecting system-level constraints. Define their unique behaviors separately from standard user permissions, document special-case interactions, and ensure they align with immutable architectural principles. This Skill walks through special role integration within the broader permission matrix design.

Create a permission matrix by defining granular permissions for each feature's resources, then generate a CASL integration blueprint that translates those permissions into rule definitions. This Skill produces complete permission metadata—slug, category, resource, action, and permission strings—and delivers a CASL-ready output that bridges PRD design to implementation.

Design schemas with `workspace_id` foreign keys on all data tables and Row-Level Security policies that enforce workspace boundaries. This Skill facilitates RLS-ready schema planning and outlines the policies required to ensure secure, isolated data access across workspaces in a multi-tenant environment.

Yes. RBAC design directly informs UI visibility by mapping permissions to feature-specific resources and actions, then determining which UI elements or workflows users can access based on their assigned permissions. This Skill covers the complete path from permission definition through UI layer planning and cross-workspace verification.

Yes. This Skill enforces independence between organizational and project workspaces, requiring separate workspace designs with no feature or permission inheritance across levels. Each workspace type gets its own permission matrix, resource definitions, and role-based access rules to maintain isolation and modularity.