skills.rest
fred07diamond
fred07diamondCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security

Implements user and org data scoping with access helpers and A2A authentication.

Updated May 13, 2026
Search Tags:#security#multi-tenant#drizzle#better-auth#access control#a2a#data scoping
One-click install
npx skills add https://github.com/fred07diamond/Call-Copilot --skill security-fred07diamond
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/fred07diamond/Call-Copilot/tree/main/apps/design/.agents/skills/security
Command: npx skills add https://github.com/fred07diamond/Call-Copilot --skill security-fred07diamond

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Multi-user apps risk leaking data between users and organizations when queries lack proper scoping. This Skill defines the canonical patterns for making resources ownable, enforcing access control in every query, and securing cross-app A2A calls. ## Core Features & Use Cases - Ownable Resource Pattern: Add owner_email, org_id, and visibility columns to any table with ownableColumns() and createSharesTable(). - Access Enforcement: Use accessFilter for list queries, resolveAccess for reads, and assertAccess for writes so every query respects user and org boundaries. - Auto-Scoped Agent SQL: Raw db-query / db-exec commands run against temporary views scoped to the current user and org automatically. - A2A Security: Sign cross-app calls with a shared A2A_SECRET so inbound requests inherit verified user identity. - Use Case: When adding a new notes table to an app, follow this Skill to make it ownable, wrap all queries in the access helpers, and pass the CI guard that rejects unscoped queries. ## Quick Start Ask the agent to add a new ownable table with proper access scoping following the security skill's rules.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I make a database table ownable by users?▼

Add `ownableColumns()` to your table definition, which provides `owner_email`, `org_id`, and `visibility` columns, and create a shares table with `createSharesTable()`. This is the canonical shape the share dialog, list filtering, and CI guard all recognize.

How do I scope queries to the current user and org?▼

Use `accessFilter` for list queries, `resolveAccess` for read-by-id, and `assertAccess` for writes and deletes. Hand-written `/api/*` routes must wrap work in `runWithRequestContext({ userEmail, orgId }, fn)` after reading the session with `getSession(event)`.

Does raw SQL from the agent get scoped automatically?▼

Yes. When the agent runs `pnpm action db-query`, the framework creates temporary views that shadow real tables with `WHERE owner_email` and `org_id` filters. INSERTs auto-fill ownership columns and UPDATE/DELETE statements are scoped the same way.

How do I secure A2A calls between apps?▼

Set the same `A2A_SECRET` on every app that needs mutual trust. Outbound calls are signed JWTs with the caller's email as `sub`; inbound calls verify the signature and set `AGENT_USER_EMAIL` so access helpers keep the call scoped to that user.

Why does the CI build fail with unscoped query errors?▼

The `guard-no-unscoped-queries` guard fails the build when code queries an ownable table without `accessFilter`, `resolveAccess`, or `assertAccess`. Fix it by routing the query through the helpers; the `// guard:allow-unscoped` marker is a last-resort opt-out only.

Related Skills

Explore More Software Engineering Skills→
mrtntknsonmrtntknson

organization-best-practices

Configure multi-tenant organizations with RBAC and membership management via Better Auth.

Community
Advanced
cellarwoodcellarwood

recipe-share-folder-with-team

Share a Google Drive folder with collaborators using editor and viewer permissions.

Official
Intermediate
BuilderIOBuilderIO
3

security

Enforce secure coding practices for agent-native apps with Zod schemas.

Official
Advanced
mindfortaimindfortai
16

access-review

Review authorization, access control, role boundaries, and tenant isolation.

Official
Advanced