Results for “permission-boundaries”

Reviews authorization, tenant isolation, roles, ownership, row access, admin boundaries, sharing, and privilege escalation.

Creates, assigns, and checks custom permissions to gate feature access across Salesforce contexts including validation rules, Apex, Flow, Visualforce, and Connected Apps.

Use this when the team needs to define permissions, roles, membership rules, resource ownership, or action-level authorization separate from authentication choice. Trigger on requests about access models, RBAC, ABAC, tenancy, or protected operations.

acl-permission-system

Use this when the team needs to decide how responsibilities should be split across services, modules, workers, APIs, or runtimes. Trigger on requests about service boundaries, ownership, modularity, monolith versus separation, or where logic should live.

Use when symbolic mathematics must cross into NumPy vector evaluation or SciPy numerical algorithms: lambdify contracts, domains, dtypes, parameters, residuals, tolerances, and symbolic-versus-numeric verification. Do not use for work confined entirely to one of those libraries.

Design and deploy Salesforce restriction rules to subtract record access from users, covering eligibility, criteria syntax, metadata shape, and documented enforcement gaps.

Clear the freeze boundary set by /freeze, allowing edits to all directories again. (gstack)

Clear the freeze boundary set by /freeze, allowing edits to all directories again. Use when you want to widen edit scope without ending the session. Use when asked to "unfreeze", "unlock edits", "remove freeze", or "allow all edits". (gstack)

Use when FastAPI request, dependency, response, or OpenAPI behavior interacts with Pydantic v2 models, validation, aliases, serialization, generics, or error contracts. Do not use for standalone FastAPI routing or standalone Pydantic models with no ASGI boundary.

Decide whether Git submodules are the right boundary for external dependencies, then execute the appropriate workflow: add and pin, bootstrap recursively, sync to a recorded commit, advance a tracked branch, edit inside a submodule without detached-HEAD surprises, remove cleanly, or configure CI checkout constraints.

Feishu permission management for documents and files. Activate when user mentions sharing, permissions, collaborators.

Simulator.Company access-control specialist — who can view/modify/remove/sign/execute an object (actor, form, account, template, tree layer). Use when the user wants to share or unshare an object, grant or revoke permissions, list who has access, or bulk-share. Activate when the user says "share this with", "give access to", "grant permission", "revoke access", "who can see/edit this", "set permissions", "make read-only", "поділись з", "надай доступ", "забери доступ", "хто має доступ", "права доступу", "дай доступ", "открой доступ", "отзови доступ", "кто имеет доступ", "права доступа". Also activate when a tool fails because the caller has NO access to an object — "request access", "I can't see this actor", "access denied", "403", "no permission", "запроси доступ", "немає доступу", "немає прав", "відмовлено в доступі", "запроси доступ", "нет доступа", "доступ запрещён". For the object's own data use the domain skill (`simulator-actors` / `simulator-forms` / `simulator-finance`).

---

WordPress capabilities and roles — add_role, remove_role, add_cap, remove_cap, current_user_can, user_can, WP_Roles, custom capabilities, administrator editor author contributor subscriber, capability mapping, meta capabilities, map_meta_cap, register_post_type capabilities, custom post type capabilities, WP_User roles and caps, ACF field group visibility by role. Invoke for: custom roles, multi-role sites, restrict content by capability, map_meta_cap, "hide ACF field from role", "register capability for CPT".

Opinionated, evolving constraints to guide agents when building interfaces

Design, create, and manage Salesforce sharing rules to grant record access beyond the role hierarchy, covering owner-based, criteria-based, and guest user rules.

Procedurally design an AAA-style open-world FPS map blockout (roads, POIs, fields, forests/treelines, railway/bridges) from a landscape, validate it through gated checks, and materialize it into engine geometry. Use when the user asks to block out or lay out an open-world/FPS map, place roads/POIs/forests/railways procedurally, or turn a blockout plan into splines, paint layers, foliage, and actors.

Use this when the system needs clear analysis of trusted versus untrusted execution contexts, external inputs, client/server boundaries, provider callbacks, or admin-level code paths. Trigger on requests about trust boundaries, attack surfaces, or where verification must happen.

Decide which work is safe to delegate to worker agents. Use before delegating tasks that may require user interaction, approval, authentication, external writes, or shared-state mutation.