Results for “privileged-access-management”

Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL, covering session proxy configuration, credential vaulting, query auditing, dynamic credential generation, and least-privilege database roles.

Configure privileged session monitoring and recording using CyberArk PSM or open-source alternatives like Teleport, with keystroke logging, real-time alerts, and compliance audit trails.

Discover and inventory privileged accounts across enterprise infrastructure, including domain admins, local admins, service accounts, database admins, cloud IAM roles, and application admin accounts, with automated scanning, risk classification, and PAM onboarding.

Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.

Configure Azure API Management as an AI Gateway to govern AI models, MCP tools, and agents with policies for caching, rate limiting, content safety, and cost control.

Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, privileged access workstations, and credential theft mitigation.

Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control.

Use this when the team needs to define permissions, roles, membership rules, resource ownership, or action-level authorization separate from authentication choice. Trigger on requests about access models, RBAC, ABAC, tenancy, or protected operations.

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

Detect and investigate Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

Documents MariaDB-specific GRANT behavior, including privilege scope levels, implicit account creation, MariaDB-only privileges, roles, proxy grants, resource limits, and TLS options, to help write accurate GRANT statements.

Persistent cross-session memory management. Enables agents to remember user preferences, project conventions, and past decisions across different sessions using a structured MEMORY.md index and topic files.

Use when managing AWS IAM.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

Elevate from a low-privilege user account to root access on a compromised Linux system by exploiting misconfigurations, vulnerable services, kernel exploits, and weak permissions.

Audit Kubernetes RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous bindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

Feishu permission management for documents and files. Activate when user mentions sharing, permissions, collaborators.

Hardens Google Workspace environments by configuring super admin accounts, phishing-resistant MFA, email authentication (SPF/DKIM/DMARC), DLP policies, OAuth app controls, and external sharing restrictions.

Manage AWS Identity and Access Management for users, roles, policies, and permissions. Create IAM policies, configure cross-account access, set up service roles, troubleshoot permission errors, and enforce least-privilege security.

Audit and harden AWS Lambda execution roles by implementing least-privilege IAM policies, permission boundaries, and SCP enforcement.

Identify and test IAM misconfigurations that allow privilege escalation in AWS environments using Pacu, CloudFox, Principal Mapper, and manual analysis.

Manages the full Salesforce user lifecycle: create, deactivate, freeze, assign licenses, configure profiles and roles, set login restrictions, and set up delegated administration.

Design and apply Azure role-based access control with least privilege at the right scope. Use this skill when users ask about permissions, role assignments, access errors, or governance. Covers built-in roles, custom roles, managed identities, PIM, and access reviews per Well-Architected principles.

Claims-based authorization for agents and operations. Grant, revoke, and verify permissions for secure multi-agent coordination. Use when: permission management, access control, secure operations, authorization checks. Skip when: open access, no security requirements, single-agent local work.

AL permission set design for Business Central. Use when creating PermissionSets, implementing least-privilege access, or designing security models for extensions.

Agent skill for pr-manager - invoke with $agent-pr-manager

Reviews authorization, tenant isolation, roles, ownership, row access, admin boundaries, sharing, and privilege escalation.

Security controls for RAG. Indirect prompt-injection via retrieved documents, PII detection/redaction (Microsoft Presidio, AWS Comprehend), multi-tenant isolation, ACL-aware retrieval with row-level/metadata filtering, data-leakage prevention, jailbreak hardening on retrieved context, GDPR right-to-be-forgotten in vector DBs. USE WHEN: user mentions "prompt injection RAG", "indirect prompt injection", "PII redaction", "Presidio", "ACL RAG", "row-level security", "multi-tenant RAG isolation", "GDPR vector DB", "right to be forgotten", "jailbreak", "data leakage RAG" DO NOT USE FOR: hallucination detection - use `rag-guardrails`; tenancy scaling patterns - use `rag-production`; audit tracing schema - use `rag-observability`

Agent skill for raft-manager - invoke with $agent-raft-manager

Deploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using just-in-time access with time, entitlement, and approval controls.

Simulator.Company access-control specialist — who can view/modify/remove/sign/execute an object (actor, form, account, template, tree layer). Use when the user wants to share or unshare an object, grant or revoke permissions, list who has access, or bulk-share. Activate when the user says "share this with", "give access to", "grant permission", "revoke access", "who can see/edit this", "set permissions", "make read-only", "поділись з", "надай доступ", "забери доступ", "хто має доступ", "права доступу", "дай доступ", "открой доступ", "отзови доступ", "кто имеет доступ", "права доступа". Also activate when a tool fails because the caller has NO access to an object — "request access", "I can't see this actor", "access denied", "403", "no permission", "запроси доступ", "немає доступу", "немає прав", "відмовлено в доступі", "запроси доступ", "нет доступа", "доступ запрещён". For the object's own data use the domain skill (`simulator-actors` / `simulator-forms` / `simulator-finance`).