How do I install the User Scoped Data Filtering skill?

Run npx skillmds@latest add majiayu000/user-scoped-data-filtering in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is User Scoped Data Filtering safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with User Scoped Data Filtering?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is User Scoped Data Filtering free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published User Scoped Data Filtering?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

User Scoped Data Filtering by majiayu000

Name: User Scoped Data Filtering
Rating: 4.2 (5 reviews)
Author: majiayu000

User Scoped Data Filtering

Provides patterns and guidance for implementing user-scoped data filtering and multi-tenancy in web applications. Use this skill when you need to: (1) Restrict data access based on user identity, (2) Implement ownership checks for database operations, (3) Build multi-tenant applications with organization-level data scoping, (4) Implement admin bypass for viewing all data, (5) Create audit trails for data access. This skill focuses on Python, FastAPI, and SQLAlchemy.

majiayu000 Updated Sep 9, 2026 567 repo stars

File contents

User-Scoped Data Filtering

This skill provides patterns and best practices for implementing robust user-scoped data filtering and multi-tenancy in your application. The focus is on a Python-based stack using FastAPI for the web framework and SQLAlchemy for the ORM.

Overview

Implementing proper data scoping is critical for security and privacy in multi-user applications. This skill breaks down the process into several key areas, each with its own reference guide.

Core Concepts & Workflow

User Context Extraction: The first step is to reliably identify the current user. This is typically done by extracting user information from an authentication token (e.g., JWT).
- For implementation details, see references/user-context.md.
Scoped Database Queries: Once you have the user's identity, you must filter all database queries to only return data they are authorized to see.
- For service layer patterns and SQLAlchemy examples, see references/scoped-queries.md.
Ownership Verification: For write operations (updates and deletes), you must verify that the user owns the resource they are trying to modify. This is often implemented using decorators or dependencies.
- For decorator patterns, see references/ownership-verification.md.
Multi-Tenancy: In many applications, data is scoped not just by user, but by a higher-level entity like an organization or a team.
- For examples of organization-level scoping, see references/multi-tenancy.md.
Admin Bypass: Administrative users often need to bypass these scoping rules to view and manage data across all users and organizations.
- For patterns to implement this safely, see references/admin-bypass.md.
Audit Trail: It's important to log who is accessing and modifying data, especially when admin bypass is used.
- For guidance on creating audit trails, see references/audit-trail.md.

Getting Started

Start by reviewing references/user-context.md to set up your user identification dependency. Then, move on to references/scoped-queries.md to apply filtering to your data access layer. Implement the other patterns as needed for your application's requirements.

---name: user-scoped-data-filteringdescription: Provides patterns and guidance for implementing user-scoped data filtering and multi-tenancy in web applications. Use this skill when you need to: (1) Restrict data access based on user identity, (2) Implement ownership checks for database operations, (3) Build multi-tenant applications with organization-level data scoping, (4) Implement admin bypass for viewing all data, (5) Create audit trails for data access. This skill focuses on Python, FastAPI, and SQLAlchemy.--- # User-Scoped Data Filtering This skill provides patterns and best practices for implementing robust user-scoped data filtering and multi-tenancy in your application. The focus is on a Python-based stack using FastAPI for the web framework and SQLAlchemy for the ORM. ## Overview Implementing proper data scoping is critical for security and privacy in multi-user applications. This skill breaks down the process into several key areas, each with its own reference guide. ## Core Concepts & Workflow 1. **User Context Extraction**: The first step is to reliably identify the current user. This is typically done by extracting user information from an authentication token (e.g., JWT). * For implementation details, see `references/user-context.md`. 2. **Scoped Database Queries**: Once you have the user's identity, you must filter all database queries to only return data they are authorized to see. * For service layer patterns and SQLAlchemy examples, see `references/scoped-queries.md`. 3. **Ownership Verification**: For write operations (updates and deletes), you must verify that the user owns the resource they are trying to modify. This is often implemented using decorators or dependencies. * For decorator patterns, see `references/ownership-verification.md`. 4. **Multi-Tenancy**: In many applications, data is scoped not just by user, but by a higher-level entity like an organization or a team. * For examples of organization-level scoping, see `references/multi-tenancy.md`. 5. **Admin Bypass**: Administrative users often need to bypass these scoping rules to view and manage data across all users and organizations. * For patterns to implement this safely, see `references/admin-bypass.md`. 6. **Audit Trail**: It's important to log who is accessing and modifying data, especially when admin bypass is used. * For guidance on creating audit trails, see `references/audit-trail.md`. ## Getting Started Start by reviewing `references/user-context.md` to set up your user identification dependency. Then, move on to `references/scoped-queries.md` to apply filtering to your data access layer. Implement the other patterns as needed for your application's requirements.

Frequently asked questions