security-rbac-auth

Implement JWT, API keys, OAuth, RBAC, and data protection for AgentStack.

2|Updated Dec 14, 2025

Search Tags:#authorization #security #authentication #oauth #jwt #rbac #policies

Ready to run

npx skills add https://github.com/raphaelmansuy/k8s-agent-stack --skill security-rbac-auth

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-rbac-auth
Source: https://github.com/raphaelmansuy/k8s-agent-stack/tree/main/archive/skills/security-rbac-auth
Command: npx skills add https://github.com/raphaelmansuy/k8s-agent-stack --skill security-rbac-auth

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Implement authentication, authorization, and security controls across AgentStack, including JWT, API keys, OAuth, RBAC, and data protection measures.

Core Features & Use Cases

JWT Authentication: Issue and validate RS256-signed tokens with scoped claims.
API Keys & OAuth: Manage API keys and OAuth/OIDC flows for third-party integrations.
RBAC & Policies: Enforce role-based access control and resource-level permissions.
Use Case: Protect multi-tenant deployments by enforcing org/project boundaries and least privilege.

Quick Start

Enable JWT authentication and RBAC for a sample API and verify access with a test token.

Frequently Asked Questions about security-rbac-auth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement JWT authentication and RBAC for API access control?▼

JWT authentication with RS256 signing and RBAC enables role-based access control by issuing scoped tokens and enforcing resource-level permissions. Define roles, assign policies to resources, validate token signatures, and check permissions at service and data-store boundaries to restrict access by user role.

What's the difference between OAuth, API keys, and JWT for securing APIs?▼

OAuth handles third-party integrations and delegated access flows; API keys provide simple service-to-service authentication; JWT tokens carry claims and roles for stateless authentication. Choose OAuth for user delegation, API keys for internal services, and JWT for scalable, policy-driven access within your stack.

How do I protect multi-tenant deployments with authentication and authorization?▼

Enforce org and project boundaries using RBAC policies tied to JWT claims, implement least-privilege roles, isolate data at the service and storage layer, and validate tenant context on every request. Add encryption at rest, secret management, and audit logging to track access across tenants.

What security controls should I deploy alongside authentication?▼

Deploy TLS 1.3 for encryption in transit, WAF and rate limiting at the perimeter, CORS policies for cross-origin requests, PII masking in logs, data encryption at rest, and secret management for credentials. Enable audit logging to track all authentication and authorization events.

Can I use JWT and API keys together in the same system?▼

Yes. Use API keys for service-to-service or development access, JWT tokens for user and delegated access, and OAuth for third-party integrations. Validate each credential type at appropriate layers—API keys at the gateway, JWT at service entry points—and enforce RBAC policies uniformly.

What happens if I don't implement role-based policies in my authorization layer?▼

Without RBAC policies, all authenticated users gain the same access level, violating least-privilege principles and creating security risks in multi-tenant or complex permission scenarios. Policy-driven access ensures users access only resources their role permits, reducing blast radius if credentials are compromised.