micsapp Speak Enterprise RBAC
Overview
Configure enterprise-grade access control for Speak language learning integrations in schools, businesses, and organizations.
Prerequisites
- Speak Enterprise tier subscription
- Identity Provider (IdP) with SAML/OIDC support
- Understanding of role-based access patterns
- Audit logging infrastructure
Instructions
- Role Definitions for Language Learning
- Role Implementation
- SSO Integration
- Organization Management
- Team and Class Management
- Access Control Middleware
- Audit Trail
For full implementation details, load: Read(${CLAUDE_SKILL_DIR}/references/implementation-guide.md)
Output
- Role definitions for education/enterprise
- SSO integration (SAML/OIDC)
- Team and class management
- Permission middleware
- Audit trail enabled
Error Handling
| Issue | Cause | Solution |
|---|---|---|
| SSO login fails | Wrong callback URL | Verify IdP config |
| Permission denied | Missing role mapping | Update group mappings |
| Token expired | Short TTL | Refresh token logic |
| Team access denied | Not a member | Check team membership |
Examples
Quick Permission Check
if (!checkPermission(user.role, 'viewLearnerProgress')) {
throw new ForbiddenError('Cannot view learner progress');
}
Instructor Dashboard Access
app.get('/instructor/dashboard',
requireSpeakPermission('viewLearnerProgress'),
async (req, res) => {
const teams = await teamManager.getInstructorTeams(req.user.id);
const progress = await Promise.all(
teams.map(t => teamManager.getTeamProgress(t.id))
);
res.json({ teams, progress });
}
);
Resources
Next Steps
For major migrations, see speak-migration-deep-dive.