OCI Security Control Plane Router
Use this thin router to decide which OCI security control owns a problem. Keep detailed procedures in the specialist skills and load only the one needed for the user's control area.
When to Use
Load this skill for: the user asks to "choose OCI security control", "route OCI security issue", "compare Cloud Guard vs Security Zones", "decide ZPR vs NSG", "use Bastion vs public SSH", or "harden an OCI environment".
Use it before narrow skills when the control owner is unclear or the user lists several security controls together.
Do NOT load this skill when
Do not load this skill for a direct, already-known specialist task such as "write ZPL policy", "create Managed SSH", "store OCI secrets", "debug OCI 403", or "choose NSG vs security list". Load the owning skill directly.
NEVER Do This
NEVER duplicate specialist procedures in this router.
Route to the owner skill and keep high-drift facts there.
NEVER enable broad responders, guardrails, or production ZPR attributes without a lower-environment test.
Security controls can block traffic, API calls, deployments, or emergency access.
NEVER pick a control before identifying the failure plane.
Decide whether the problem is API authorization, network reachability, packet authorization, secret handling, operator access, posture detection, preventive guardrails, audit evidence, or Terraform automation.
NEVER use public SSH as the default private-instance access answer.
Route private operator access to oci/managed-bastion-access, VPN/FastConnect, or another approved private path.
Control Routing
| Problem or hot word |
Load |
| Zero Trust Packet Routing, ZPR, security attributes, ZPL policy, protected resources |
oci/zpr-security |
| OCI Bastion, Managed SSH, port forwarding, dynamic SOCKS5, client CIDR allowlist |
oci/managed-bastion-access |
| IAM policy, identity domains, IDCS, dynamic groups, 403/404, principal type |
oci/iam-identity-management |
| Vault, KMS, secret rotation, replication, secret retrieval 403 |
oci/secrets-management |
| Cloud Guard, detector/responder recipes, Security Zones, landing-zone guardrails |
oci/landing-zones |
| NSGs, security lists, route tables, DRG, Service Gateway, DNS, private endpoints |
oci/networking-management |
| Audit, Logging, Service Connector, alarms, evidence collection |
oci/monitoring-operations |
| Terraform security automation, Resource Manager, state, imports, drift |
oci/infrastructure-as-code |
| Compute access posture, public IPs, instance principals, plugin state |
oci/compute-management |
Decision Rules
- API denied or ambiguous 404: start with
oci/iam-identity-management.
- Packet path blocked without ZPR: start with
oci/networking-management.
- Packet path blocked after security attributes or ZPL change: start with
oci/zpr-security.
- Human/operator access to private targets: start with
oci/managed-bastion-access.
- Secret lifecycle or retrieval: start with
oci/secrets-management.
- Preventive tenancy guardrails: start with
oci/landing-zones.
- Detection, response, audit, and evidence: start with
oci/monitoring-operations.
- Any of the above encoded in Terraform: also load
oci/infrastructure-as-code.
Reference Files
This router intentionally has no deep reference file. Load the owning specialist skill and its focused references instead.
Arguments
$ARGUMENTS: Optional user-provided control, symptom, resource, compartment, network path, principal, Terraform path, or risk objective. When empty, classify the failure plane first, then load the owner skill.
1---2name: oci-security-control-plane3description: Use when the user asks to "choose OCI security control", "route OCI security issue", "compare Cloud Guard vs Security Zones", "decide ZPR vs NSG", or "use Bastion vs public SSH".4---5# OCI Security Control Plane Router67Use this thin router to decide which OCI security control owns a problem. Keep detailed procedures in the specialist skills and load only the one needed for the user's control area.89## When to Use1011Load this skill for: the user asks to "choose OCI security control", "route OCI security issue", "compare Cloud Guard vs Security Zones", "decide ZPR vs NSG", "use Bastion vs public SSH", or "harden an OCI environment".1213Use it before narrow skills when the control owner is unclear or the user lists several security controls together.1415## Do NOT load this skill when1617Do not load this skill for a direct, already-known specialist task such as "write ZPL policy", "create Managed SSH", "store OCI secrets", "debug OCI 403", or "choose NSG vs security list". Load the owning skill directly.1819## NEVER Do This2021**NEVER duplicate specialist procedures in this router.**22Route to the owner skill and keep high-drift facts there.2324**NEVER enable broad responders, guardrails, or production ZPR attributes without a lower-environment test.**25Security controls can block traffic, API calls, deployments, or emergency access.2627**NEVER pick a control before identifying the failure plane.**28Decide whether the problem is API authorization, network reachability, packet authorization, secret handling, operator access, posture detection, preventive guardrails, audit evidence, or Terraform automation.2930**NEVER use public SSH as the default private-instance access answer.**31Route private operator access to `oci/managed-bastion-access`, VPN/FastConnect, or another approved private path.3233## Control Routing3435| Problem or hot word | Load |36| --- | --- |37| Zero Trust Packet Routing, ZPR, security attributes, ZPL policy, protected resources | `oci/zpr-security` |38| OCI Bastion, Managed SSH, port forwarding, dynamic SOCKS5, client CIDR allowlist | `oci/managed-bastion-access` |39| IAM policy, identity domains, IDCS, dynamic groups, 403/404, principal type | `oci/iam-identity-management` |40| Vault, KMS, secret rotation, replication, secret retrieval 403 | `oci/secrets-management` |41| Cloud Guard, detector/responder recipes, Security Zones, landing-zone guardrails | `oci/landing-zones` |42| NSGs, security lists, route tables, DRG, Service Gateway, DNS, private endpoints | `oci/networking-management` |43| Audit, Logging, Service Connector, alarms, evidence collection | `oci/monitoring-operations` |44| Terraform security automation, Resource Manager, state, imports, drift | `oci/infrastructure-as-code` |45| Compute access posture, public IPs, instance principals, plugin state | `oci/compute-management` |4647## Decision Rules48491. API denied or ambiguous 404: start with `oci/iam-identity-management`.502. Packet path blocked without ZPR: start with `oci/networking-management`.513. Packet path blocked after security attributes or ZPL change: start with `oci/zpr-security`.524. Human/operator access to private targets: start with `oci/managed-bastion-access`.535. Secret lifecycle or retrieval: start with `oci/secrets-management`.546. Preventive tenancy guardrails: start with `oci/landing-zones`.557. Detection, response, audit, and evidence: start with `oci/monitoring-operations`.568. Any of the above encoded in Terraform: also load `oci/infrastructure-as-code`.5758## Reference Files5960This router intentionally has no deep reference file. Load the owning specialist skill and its focused references instead.6162## Arguments6364$ARGUMENTS: Optional user-provided control, symptom, resource, compartment, network path, principal, Terraform path, or risk objective. When empty, classify the failure plane first, then load the owner skill.
acedergren