How do I install the Anth Enterprise Rbac skill?

Run npx skillmds@latest add jeremylongshore/anth-enterprise-rbac in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Anth Enterprise Rbac safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Anth Enterprise Rbac?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Anth Enterprise Rbac free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Anth Enterprise Rbac?

jeremylongshore (@jeremylongshore) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Anth Enterprise Rbac by jeremylongshore

Name: Anth Enterprise Rbac
Rating: 4.5 (4 reviews)
Author: jeremylongshore

Anth Enterprise Rbac

Configure Anthropic enterprise organization management, Workspaces, and role-based access control for teams. Trigger with phrases like "anthropic enterprise", "claude rbac", "anthropic workspaces", "claude team access", "anthropic organization".

File contents

Anthropic Enterprise RBAC

Overview

Anthropic provides organization-level access control through Workspaces, API key scoping, and member roles via the Console at console.anthropic.com.

Organization Structure

Organization (billing entity)
├── Workspace: Production
│   ├── API Key: sk-ant-api03-prod-main-...
│   ├── API Key: sk-ant-api03-prod-batch-...
│   └── Rate limits: Tier 4
├── Workspace: Staging
│   ├── API Key: sk-ant-api03-stg-...
│   └── Rate limits: Tier 2
└── Workspace: Development
    ├── API Key: sk-ant-api03-dev-...
    └── Rate limits: Tier 1

Console Roles

Role	Capabilities
Owner	Full access, billing, member management
Admin	Manage workspaces, API keys, view usage
Developer	Create/revoke own API keys, view own usage
Billing	View invoices and usage reports only

Application-Level RBAC

# Implement your own RBAC on top of Anthropic Workspaces
from enum import Enum
import anthropic

class UserRole(Enum):
    VIEWER = "viewer"       # Can read Claude responses (no direct API)
    USER = "user"           # Can send prompts (rate limited)
    POWER_USER = "power"    # Can use Opus, higher limits
    ADMIN = "admin"         # Can access all models, no limits

ROLE_CONFIG = {
    UserRole.VIEWER: {"allowed": False},
    UserRole.USER: {
        "allowed": True,
        "models": ["claude-haiku-4-20250514"],
        "max_tokens": 512,
        "rpm_limit": 10,
    },
    UserRole.POWER_USER: {
        "allowed": True,
        "models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"],
        "max_tokens": 4096,
        "rpm_limit": 60,
    },
    UserRole.ADMIN: {
        "allowed": True,
        "models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"],
        "max_tokens": 8192,
        "rpm_limit": 200,
    },
}

def create_message(user_role: UserRole, model: str, **kwargs):
    config = ROLE_CONFIG[user_role]
    if not config["allowed"]:
        raise PermissionError("Role does not allow API access")
    if model not in config["models"]:
        raise PermissionError(f"Role cannot access model: {model}")
    kwargs["max_tokens"] = min(kwargs.get("max_tokens", 1024), config["max_tokens"])

    client = anthropic.Anthropic()
    return client.messages.create(model=model, **kwargs)

Key Management Best Practices

Practice	Implementation
One key per service	`prod-auth-service`, `prod-search-service`
Rotate quarterly	Calendar reminder + automated rotation
Least privilege	Dev workspace for dev keys only
Audit trail	Log which key made each request
Revoke immediately	On employee departure or compromise

Error Handling

Issue	Cause	Fix
Key works in dev, fails in prod	Wrong workspace key	Verify key belongs to prod workspace
New team member can't access	Not added to workspace	Invite via Console > Members
Usage not visible	Viewing wrong workspace	Switch workspace in Console

Resources

Next Steps

For major migration strategies, see anth-migration-deep-dive.

---name: anth-enterprise-rbacdescription: Configure Anthropic enterprise organization management, Workspaces, and role-based access control for teams. Trigger with phrases like "anthropic enterprise", "claude rbac", "anthropic workspaces", "claude team access", "anthropic organization".license: MIT---# Anthropic Enterprise RBAC## OverviewAnthropic provides organization-level access control through Workspaces, API key scoping, and member roles via the Console at [console.anthropic.com](https://console.anthropic.com).## Organization Structure```Organization (billing entity)├── Workspace: Production│ ├── API Key: sk-ant-api03-prod-main-...│ ├── API Key: sk-ant-api03-prod-batch-...│ └── Rate limits: Tier 4├── Workspace: Staging│ ├── API Key: sk-ant-api03-stg-...│ └── Rate limits: Tier 2└── Workspace: Development ├── API Key: sk-ant-api03-dev-... └── Rate limits: Tier 1```## Console Roles| Role | Capabilities ||------|-------------|| Owner | Full access, billing, member management || Admin | Manage workspaces, API keys, view usage || Developer | Create/revoke own API keys, view own usage || Billing | View invoices and usage reports only |## Application-Level RBAC```python# Implement your own RBAC on top of Anthropic Workspacesfrom enum import Enumimport anthropicclass UserRole(Enum): VIEWER = "viewer" # Can read Claude responses (no direct API) USER = "user" # Can send prompts (rate limited) POWER_USER = "power" # Can use Opus, higher limits ADMIN = "admin" # Can access all models, no limitsROLE_CONFIG = { UserRole.VIEWER: {"allowed": False}, UserRole.USER: { "allowed": True, "models": ["claude-haiku-4-20250514"], "max_tokens": 512, "rpm_limit": 10, }, UserRole.POWER_USER: { "allowed": True, "models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"], "max_tokens": 4096, "rpm_limit": 60, }, UserRole.ADMIN: { "allowed": True, "models": ["claude-haiku-4-20250514", "claude-sonnet-4-20250514", "claude-opus-4-20250514"], "max_tokens": 8192, "rpm_limit": 200, },}def create_message(user_role: UserRole, model: str, **kwargs): config = ROLE_CONFIG[user_role] if not config["allowed"]: raise PermissionError("Role does not allow API access") if model not in config["models"]: raise PermissionError(f"Role cannot access model: {model}") kwargs["max_tokens"] = min(kwargs.get("max_tokens", 1024), config["max_tokens"]) client = anthropic.Anthropic() return client.messages.create(model=model, **kwargs)```## Key Management Best Practices| Practice | Implementation ||----------|---------------|| One key per service | `prod-auth-service`, `prod-search-service` || Rotate quarterly | Calendar reminder + automated rotation || Least privilege | Dev workspace for dev keys only || Audit trail | Log which key made each request || Revoke immediately | On employee departure or compromise |## Error Handling| Issue | Cause | Fix ||-------|-------|-----|| Key works in dev, fails in prod | Wrong workspace key | Verify key belongs to prod workspace || New team member can't access | Not added to workspace | Invite via Console > Members || Usage not visible | Viewing wrong workspace | Switch workspace in Console |## Resources- [Console](https://console.anthropic.com)- [Workspaces](https://docs.anthropic.com/en/docs/administration/workspaces)## Next StepsFor major migration strategies, see `anth-migration-deep-dive`.

Frequently asked questions