What problem does it solve?
This Skill prevents VTEX IO apps from failing authorization at runtime by guiding you to declare the exact permissions and access boundaries needed for integrations, protected routes, and external calls.
Core Features & Use Cases
- Permission mapping for integrations: Ensures every external host, capability, and VTEX resource the app consumes is covered by the correct manifest policy type.
- Least-privilege outbound access: Helps scope outbound-access rules narrowly by host and path to reduce risk and review complexity.
- Server-side route enforcement alignment: Clarifies how route/resource-based policies define authorization boundaries so consumers do not mistakenly assume behavior is client-validated.
- Decision rules for policy types: Guides when to use License Manager policies, app policies, outbound-access, and resource-based route policies using the right principal/VRN patterns.
Quick Start
Apply this Skill when reviewing or creating a VTEX IO manifest permissions change, so you can verify the policy type, scope, and server-side enforcement are consistent with the behavior being enabled.
