# Permission Report

> Create a read-only permission and sharing access review report as a self-contained HTML file saved to SharePoint. Use when the user says: - "who has access" - "permission report" - "sharing report" - "access review" - "review permissions" - "create a Permission Report"

- Skill: `pnp/permission-report` (Agent Skill)
- Install (CLI): `npx skillmds@latest add pnp/permission-report`
- Raw SKILL.md: https://api.skillmd.com/api/skills/pnp/permission-report/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: pnp (https://skillmd.com/u/pnp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/pnp/permission-report

---

# Permission Report

## When to use
Use this skill when the user wants a read-only review of who has access to SharePoint files, folders, libraries, lists, or a site, especially requests such as “who has access,” “permission report,” “sharing report,” “access review,” or “review permissions.”

## Inputs
Use the current SharePoint context by default. Determine the reporting scope from the user’s request and available context:
- Selected files or folders, if the user has selected items or says “these/this.”
- A named library or list, if the user names one.
- The whole current site, if no narrower scope is provided.

Only report content and permission details the current user can already see. Never invent access data.

## Steps
1. Stay strictly read-only on permissions.
   - Never grant, revoke, change, break, restore, or otherwise modify sharing or permissions.
   - Do not create sharing links or invite users.
   - Use only discovery, listing, permission-checking, and file-creation tools needed to produce the report.

2. Resolve the scope.
   - If items are selected, report on those selected files or folders.
   - If a list or library is named, resolve it from the current site and report on that list/library and representative or included items as supported by available permission tools.
   - If no narrower scope is clear, report across accessible user-created lists and libraries on the current site.
   - If a scope cannot be resolved, state that plainly in the report and do not guess.

3. Collect access information.
   For each scoped site/list/library/file/folder where available, read:
   - Who has access: users, groups, sharing principals, and links.
   - Permission level: normalize to Full Control, Edit, Read, or Other/Unknown.
   - Whether access is inherited or uniquely set.
   - Any sharing links, especially Anyone links.
   - External or guest users.
   If a tool fails or returns partial/empty permission data, record that limitation plainly; do not fill gaps from assumptions.

4. Flag risks.
   Mark rows and findings for:
   - Anyone links.
   - External or guest access.
   - Broad groups such as Everyone, Everyone except external users, All users, or similar tenant-wide groups.
   - Broken inheritance / unique permissions.
   - Individual users with Full Control.

5. Draft a single self-contained HTML report.
   - No scripts.
   - No external CSS, fonts, images, or resources.
   - Use inline CSS only.
   - Include a summary band with totals such as scoped objects reviewed, principals found, Full Control/Edit/Read counts, external/guest count, sharing link count, and flagged risk count.
   - Include a color-coded access table: red for Full Control/high risk, amber for Edit or caution, green for Read/low risk, gray for unknown. Highlight flagged rows.
   - Include a plain-English findings list explaining the main risks and safe observations.
   - Include a limitations section if permission details were unavailable or partial.

6. Save the report.
   - Save the HTML file in an `Access Reports` folder in an appropriate document library on the current site.
   - If the folder does not exist, create only that report folder and only if needed for saving the report.
   - Use a clear filename such as `Permission-Report-YYYY-MM-DD-HHMM.html`.

7. Respond to the user.
   - Provide the report link.
   - Give a short summary of the highest-risk findings.
   - Do not claim permissions were changed.

## Output format
After saving the report, respond:

```markdown
# Permission report created

[Open the report](<link>)

- Scope: <selected items, named list/library, or whole site>
- Reviewed: <count or brief description>
- Key findings: <1 concise sentence with highest-risk issues, or “No high-risk access was found in the data available.”>
```

## HTML report requirements
The saved file must be a complete HTML document:

```html
<!doctype html>
<html>
<head>
  <meta charset="utf-8">
  <title>Permission Report</title>
  <style>
    /* inline CSS only */
  </style>
</head>
<body>
  <h1>Permission Report</h1>
  <section><!-- summary band --></section>
  <section><!-- findings --></section>
  <section><!-- access table --></section>
  <section><!-- limitations, if any --></section>
</body>
</html>
```

## Constraints
- Strictly read-only for permissions and sharing.
- Never grant, revoke, share, unshare, create sharing links, or change inheritance.
- Never invent users, groups, permission levels, links, or inheritance status.
- If access data is unavailable, say so plainly in the report.
- HTML must be self-contained and must not include scripts or external resources.