What problem does it solve? Creating a Weegloo DeliveryAccessToken (CDA token) requires binding it to a SpaceRole, and agents frequently bind the wrong one—typically the Administrator role from the first list entry—producing over-privileged tokens that are unsafe to expose in browsers. This Skill enforces a least-privilege workflow so public, browser-exposed tokens are always read-only. ## Core Features & Use Cases - Least-privilege role binding: Creates a read-only SpaceRole first, then binds the token to that role's sys.id, never Administrator or the first list item. - Error handling for WGL422001: Handles permission-ownership errors without falling back to Administrator, directing the user to the console or an authorized CMA principal instead. - allowedReferrers guidance: Covers the optional origin restriction, including the requirement to resend the existing list on any token update so restrictions are not silently cleared. - Use Case: A developer needs a NEXT_PUBLIC_ delivery token for a frontend app. The Skill creates a read-only SpaceRole for the published ContentTypes, captures its sys.id, and issues the DeliveryAccessToken bound only to that role. ## Quick Start Ask the agent to create a read-only Weegloo CDA delivery token for your published content types using a dedicated least-privilege SpaceRole.
