Results for “permission-boundaries”

Reviews authorization, tenant isolation, roles, ownership, row access, admin boundaries, sharing, and privilege escalation.

Trigger: web security, XSS mitigation, secure cookies, CSRF, CSP headers, CORS policies. Scope: Frontend and browser-level security boundaries. Boundary: Excludes operating system file storage permissions.

Creates, assigns, and checks custom permissions to gate feature access across Salesforce contexts including validation rules, Apex, Flow, Visualforce, and Connected Apps.

Use this when the team needs to define permissions, roles, membership rules, resource ownership, or action-level authorization separate from authentication choice. Trigger on requests about access models, RBAC, ABAC, tenancy, or protected operations.

acl-permission-system

Audits OAuth 2.0 permissions across identity providers to identify over-privileged third-party integrations, excessive API scopes, and unused token grants, enforcing least-privilege access.

Use this when the team needs to decide how responsibilities should be split across services, modules, workers, APIs, or runtimes. Trigger on requests about service boundaries, ownership, modularity, monolith versus separation, or where logic should live.

Use when symbolic mathematics must cross into NumPy vector evaluation or SciPy numerical algorithms: lambdify contracts, domains, dtypes, parameters, residuals, tolerances, and symbolic-versus-numeric verification. Do not use for work confined entirely to one of those libraries.

Design and deploy Salesforce restriction rules to subtract record access from users, covering eligibility, criteria syntax, metadata shape, and documented enforcement gaps.

Use to find where support agents cross from information into regulated advice or a personal recommendation, and to design the boundary so they can still be helpful. Trigger for "are agents giving advice", "where's the line between information and advice", "should agents recommend a product", guidance versus advice boundary, agents answering "what would you do", or a complaint that an agent recommended something.

Clear the freeze boundary set by /freeze, allowing edits to all directories again. (gstack)

AL permission set design for Business Central. Use when creating PermissionSets, implementing least-privilege access, or designing security models for extensions.

Design and apply Azure role-based access control with least privilege at the right scope. Use this skill when users ask about permissions, role assignments, access errors, or governance. Covers built-in roles, custom roles, managed identities, PIM, and access reviews per Well-Architected principles.

Clear the freeze boundary set by /freeze, allowing edits to all directories again. Use when you want to widen edit scope without ending the session. Use when asked to "unfreeze", "unlock edits", "remove freeze", or "allow all edits". (gstack)

Manages Agent Platform serving endpoints: create, list, describe, update, delete, and troubleshoot permission, quota, and resource busy errors.

Use when designing a course, assessment, or student-feedback workflow and deciding where AI assistance is acceptable, when grading or feedback must stay within academic-integrity and FERPA/KVKK boundaries, or when AI-use rules for students need stating.

Map which elements of an assignment benefit from AI assistance vs. which AI use undermines. Use when redesigning tasks for AI-age classrooms or setting defensible AI use policies for specific assignments.

Use when FastAPI request, dependency, response, or OpenAPI behavior interacts with Pydantic v2 models, validation, aliases, serialization, generics, or error contracts. Do not use for standalone FastAPI routing or standalone Pydantic models with no ASGI boundary.

Manage AWS Identity and Access Management for users, roles, policies, and permissions. Create IAM policies, configure cross-account access, set up service roles, troubleshoot permission errors, and enforce least-privilege security.

Audits Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

Audit Kubernetes RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous bindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

Manages the full Salesforce user lifecycle: create, deactivate, freeze, assign licenses, configure profiles and roles, set login restrictions, and set up delegated administration.

Enforce Kubernetes Pod Security Standards at the namespace level using the built-in admission controller, with support for baseline and restricted profiles.

Frames tasks with explicit goals, success evidence, stop conditions, and boundaries before execution, then routes work to the appropriate workflow.

Security engineer skill for backend ACL structure, menu visibility control, and administrative access safety.

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

Permit.io API skill. Use when working with Permit.io for members, api-key, orgs. Covers 258 endpoints.

Decide whether Git submodules are the right boundary for external dependencies, then execute the appropriate workflow: add and pin, bootstrap recursively, sync to a recorded commit, advance a tracked branch, edit inside a submodule without detached-HEAD surprises, remove cleanly, or configure CI checkout constraints.

Least privilege is easy to state and hard to hold: grant each identity only the

Feishu permission management for documents and files. Activate when user mentions sharing, permissions, collaborators.

Simulator.Company access-control specialist — who can view/modify/remove/sign/execute an object (actor, form, account, template, tree layer). Use when the user wants to share or unshare an object, grant or revoke permissions, list who has access, or bulk-share. Activate when the user says "share this with", "give access to", "grant permission", "revoke access", "who can see/edit this", "set permissions", "make read-only", "поділись з", "надай доступ", "забери доступ", "хто має доступ", "права доступу", "дай доступ", "открой доступ", "отзови доступ", "кто имеет доступ", "права доступа". Also activate when a tool fails because the caller has NO access to an object — "request access", "I can't see this actor", "access denied", "403", "no permission", "запроси доступ", "немає доступу", "немає прав", "відмовлено в доступі", "запроси доступ", "нет доступа", "доступ запрещён". For the object's own data use the domain skill (`simulator-actors` / `simulator-forms` / `simulator-finance`).

Use when setting up a new personal project, or when deciding which root file a piece of documentation, configuration, environment variable, or agent instruction belongs in. Covers the standard root files and what each one owns. Does not cover source code layout.

---