# Replit Enterprise Rbac

> Configure Replit enterprise SSO, role-based access control, and organization management. Use when implementing SSO integration, configuring role-based permissions, or setting up organization-level controls for Replit. Trigger with phrases like "replit SSO", "replit RBAC", "replit enterprise", "replit roles", "replit permissions", "replit SAML".

- Skill: `micsapp/replit-enterprise-rbac` (Agent Skill)
- Install (CLI): `npx skillmds@latest add micsapp/replit-enterprise-rbac`
- Raw SKILL.md: https://api.skillmd.com/api/skills/micsapp/replit-enterprise-rbac/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: micsapp (https://skillmd.com/u/micsapp)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/micsapp/replit-enterprise-rbac

---

# Replit Enterprise RBAC

## Overview
Manage team access to Replit workspaces, deployments, and AI coding features using its Teams and Organizations model. Replit uses per-seat licensing with workspace roles: Owner, Admin, and Member.

## Prerequisites
- Replit Teams for Business or Enterprise plan (per-seat pricing)
- Organization owner or admin role
- SSO identity provider configured (Enterprise only)

## Instructions

### Step 1: Configure Organization Roles
```yaml
# replit-role-matrix.yaml
roles:
  owner:
    permissions: [manage_billing, manage_members, manage_deployments, create_repls, use_ai, admin_settings]
  admin:
    permissions: [manage_members, manage_deployments, create_repls, use_ai]
  member:
    permissions: [create_repls, use_ai, deploy_to_staging]
    restrictions: [cannot_deploy_to_prod, cannot_manage_members]
```

### Step 2: Invite and Manage Team Members
Navigate to Replit Teams > Members and invite users with assigned roles. For bulk management, use the Replit API:
```bash
set -euo pipefail
# Invite a team member
curl -X POST https://replit.com/api/v1/teams/TEAM_ID/members \
  -H "Authorization: Bearer $REPLIT_API_KEY" \
  -d '{"email": "dev@company.com", "role": "member"}'

# List current team members
curl https://replit.com/api/v1/teams/TEAM_ID/members \
  -H "Authorization: Bearer $REPLIT_API_KEY" | jq '.[] | {username, email, role}'
```

### Step 3: Control Deployment Permissions
Separate staging and production deployment access:
- Members: can deploy to development/staging URLs
- Admins: can deploy to custom domains and production
- Owner: can configure deployment infrastructure (reserved VMs, autoscaling)

Configure in Team Settings > Deployments > Permission Policy.

### Step 4: Enable SSO (Enterprise Only)
In Organization Settings > Security > SSO:
- Configure SAML 2.0 with your IdP (Okta, Azure AD, Google Workspace)
- Map IdP groups to Replit roles
- Enable "Require SSO" to block password-based login
- Set session timeout policy (recommended: 12 hours)

### Step 5: Audit Activity
```bash
set -euo pipefail
# Review recent team activity
curl "https://replit.com/api/v1/teams/TEAM_ID/audit-log?limit=50" \
  -H "Authorization: Bearer $REPLIT_API_KEY" | \
  jq '.events[] | {user, action, resource, timestamp}'
```

## Error Handling
| Issue | Cause | Solution |
|-------|-------|----------|
| Member can't deploy | Missing deployment permission | Promote to Admin or adjust deployment policy |
| SSO login redirect loop | Incorrect callback URL | Verify ACS URL in IdP matches Replit config |
| Seat limit exceeded | Too many active members | Remove inactive members or upgrade seat count |
| AI features disabled | Ghostwriter not enabled for team | Enable AI features in Team Settings |

## Examples

**Basic usage**: Apply replit enterprise rbac to a standard project setup with default configuration options.

**Advanced scenario**: Customize replit enterprise rbac for production environments with multiple constraints and team-specific requirements.

## Output

- Configuration files or code changes applied to the project
- Validation report confirming correct implementation
- Summary of changes made and their rationale

## Resources

- Official Replit Enterprise Rbac documentation
- Community best practices and patterns
- Related skills in this plugin pack