Access Control Policy Design — Skill Navigator
What this skill does
Acts as a senior IAM/authorization architect. Covers all major access control paradigms,
hybrid composition patterns, policy engines, compliance mapping, implementation code, and
decision frameworks for modern apps (SaaS, multi-tenant, microservices, cloud-native).
Core Mental Model (always apply this first)
Every access control system answers one runtime question:
Should subject S perform action A on resource R right now?
Models differ in how that decision is made. They are layers, not competitors:
| Layer |
Model |
Answers |
| Structure |
RBAC |
Who are you organizationally? |
| Context |
ABAC |
What conditions apply right now? |
| Governance |
PBAC |
Who controls the rules and how? |
| Relationships |
ReBAC |
How do entities connect to resources? |
| Precision |
ACL |
What's explicitly allowed on this object? |
| Delegation |
DAC |
What has the owner chosen to share? |
Key principle: Most mature systems use 3–4 of these together, with PBAC as the
governance shell wrapping the others. Start simple (RBAC), add layers as complexity demands.
Quick Decision Matrix
| Scenario |
Recommended Model(s) |
Reference File |
| Internal tool, stable job roles |
RBAC |
01-rbac.md |
| Multi-tenant SaaS |
RBAC + ABAC |
01-rbac.md, 02-abac.md |
| Healthcare / Finance data |
ABAC + PBAC |
02-abac.md, 03-pbac-opa.md |
| Collaborative hierarchical content |
ReBAC |
04-rebac-zanzibar.md |
| Object-level sharing exceptions |
ACL on top of RBAC |
05-acl-dac.md |
| Consumer app with owner sharing |
DAC + guardrails |
05-acl-dac.md |
| Many microservices, many teams |
PBAC (OPA/Cedar) |
03-pbac-opa.md |
| Zero Trust architecture |
RBAC + ABAC + PBAC |
06-hybrid-patterns.md |
| SOC2 / HIPAA / GDPR compliance |
PBAC + audit trail |
08-compliance.md |
| Early-stage startup (<50 users) |
RBAC only |
01-rbac.md |
Reference Files (load the relevant one per task)
references/
├── 01-rbac.md — RBAC deep dive: design, role taxonomy, anti-patterns, OPA/Casbin code
├── 02-abac.md — ABAC deep dive: attribute schema, OPA Rego policies, XACML, JWT patterns
├── 03-pbac-opa.md — PBAC + OPA/Cedar/Casbin: policy-as-code, engine selection, CI/CD
├── 04-rebac-zanzibar.md — ReBAC/Zanzibar: SpiceDB, OpenFGA, schema design, dual-write patterns
├── 05-acl-dac.md — ACL + DAC: when to use, guardrails, combining with RBAC
├── 06-hybrid-patterns.md — Layered defense, multi-tenant patterns, Zero Trust, evolution arc
├── 07-policy-engines.md — Engine comparison matrix: OPA vs Cedar vs Casbin vs SpiceDB vs Permify
├── 08-compliance.md — HIPAA, GDPR, SOC2, PCI-DSS, ISO27001 — exact mapping + audit schema
└── 09-code-examples.md — Ready-to-use code: Python, Node.js, Go across all models
When to load which file:
- User asks about a specific model → load that model's reference file
- User asks about implementation / code → load
09-code-examples.md + model file
- User asks about tool/engine selection → load
07-policy-engines.md
- User asks about compliance → load
08-compliance.md
- User is designing multi-tenant or microservices → load
06-hybrid-patterns.md
- User is debugging broken access / role explosion → load
06-hybrid-patterns.md §Warning Signs
Evolution Arc (how real systems grow)
Phase 1 — Early product: RBAC (Admin / User / Viewer). Fast, auditable.
Phase 2 — Multi-tenant: RBAC + ABAC (tenant_id attribute, conditional access).
Phase 3 — Multiple services: PBAC layer (OPA/Cedar policy engine, decoupled from code).
Phase 4 — Collaborative: ReBAC (hierarchical resource ownership + sharing graph).
Phase 5 — Enterprise/regulated: Full hybrid — RBAC+ABAC+PBAC+ReBAC, audit logging,
access certification, anomaly detection.
Universal Rules (apply regardless of model chosen)
- Deny by default — explicit ALLOW, implicit DENY everywhere
- Enforce server-side — UI hints only; never trust client-side permission checks
- Log every decision — allow AND deny, with subject/action/resource/reason/timestamp
- Least privilege — grant minimum access required; time-bound temporary elevations
- Version policies — treat authorization rules as code: review, test, deploy, roll back
- Quarterly access reviews — permissions rot without active curation
- Test both allow and deny — missing a deny test is a security gap
Warning Signs (diagnose broken access control fast)
| Symptom |
Root Cause |
Fix |
| Role count doubles every quarter |
RBAC role explosion |
Introduce ABAC attributes |
| "We have a role for that" for every edge case |
RBAC over-stretch |
ABAC conditions |
| Different services enforce the same rule differently |
Authorization scatter |
PBAC engine |
| Can't answer "who has access to X?" |
ACL sprawl |
Centralize with PBAC |
| Audit takes days to compile |
No central access log |
Structured decision logging |
| Access doesn't revoke when user changes teams |
Role creep |
Access certification process |
| Sharing causes accidental data exposure |
Unbounded DAC |
DAC guardrails / boundaries |
| One engineer understands all the auth rules |
ABAC policy sprawl |
PBAC + documentation |
Two-Question Clarity Test
Q1: What will be harder in 6 months — explaining access decisions, or changing them safely?
- Hard to explain → ABAC/PBAC + visibility tooling
- Hard to change safely → PBAC governance layer before system becomes brittle
Q2: Does "same action" need different decisions based on context?
- YES → ABAC is mandatory
- NO → Pure RBAC may be sufficient for now
Online Sources
1---2name: access-control-policy-design3description: USE THIS SKILL whenever any topic related to access control, authorization, permissions, or security policy arises in any form. Triggers include — but are not limited to: RBAC, ABAC, PBAC, ACL, DAC, ReBAC, Zanzibar, OPA, Cedar, Casbin, SpiceDB, OpenFGA, Permify, Oso, Cerbos, Permit.io; any mention of "who can do what", "role", "permission", "policy", "authorization", "multi-tenant access", "least privilege", "Zero Trust", "IAM design", "SaaS permission modeling", "access audit", "compliance access control" (HIPAA, GDPR, SOC2, PCI-DSS, ISO27001); also trigger when designing any new feature that controls what users can see or do, or when reviewing, refactoring, or debugging any auth/authz system. When in doubt — trigger this skill. Access control is architectural and getting it wrong is expensive.4---56# Access Control Policy Design — Skill Navigator78## What this skill does910Acts as a senior IAM/authorization architect. Covers all major access control paradigms,11hybrid composition patterns, policy engines, compliance mapping, implementation code, and12decision frameworks for modern apps (SaaS, multi-tenant, microservices, cloud-native).1314---1516## Core Mental Model (always apply this first)1718Every access control system answers one runtime question:19> **Should subject S perform action A on resource R right now?**2021Models differ in *how* that decision is made. They are **layers, not competitors**:2223| Layer | Model | Answers |24|-------|-------|---------|25| Structure | RBAC | Who are you organizationally? |26| Context | ABAC | What conditions apply right now? |27| Governance | PBAC | Who controls the rules and how? |28| Relationships | ReBAC | How do entities connect to resources? |29| Precision | ACL | What's explicitly allowed on this object? |30| Delegation | DAC | What has the owner chosen to share? |3132**Key principle:** Most mature systems use 3–4 of these together, with PBAC as the33governance shell wrapping the others. Start simple (RBAC), add layers as complexity demands.3435---3637## Quick Decision Matrix3839| Scenario | Recommended Model(s) | Reference File |40|----------|----------------------|----------------|41| Internal tool, stable job roles | RBAC | `01-rbac.md` |42| Multi-tenant SaaS | RBAC + ABAC | `01-rbac.md`, `02-abac.md` |43| Healthcare / Finance data | ABAC + PBAC | `02-abac.md`, `03-pbac-opa.md` |44| Collaborative hierarchical content | ReBAC | `04-rebac-zanzibar.md` |45| Object-level sharing exceptions | ACL on top of RBAC | `05-acl-dac.md` |46| Consumer app with owner sharing | DAC + guardrails | `05-acl-dac.md` |47| Many microservices, many teams | PBAC (OPA/Cedar) | `03-pbac-opa.md` |48| Zero Trust architecture | RBAC + ABAC + PBAC | `06-hybrid-patterns.md` |49| SOC2 / HIPAA / GDPR compliance | PBAC + audit trail | `08-compliance.md` |50| Early-stage startup (<50 users) | RBAC only | `01-rbac.md` |5152---5354## Reference Files (load the relevant one per task)5556```57references/58├── 01-rbac.md — RBAC deep dive: design, role taxonomy, anti-patterns, OPA/Casbin code59├── 02-abac.md — ABAC deep dive: attribute schema, OPA Rego policies, XACML, JWT patterns60├── 03-pbac-opa.md — PBAC + OPA/Cedar/Casbin: policy-as-code, engine selection, CI/CD61├── 04-rebac-zanzibar.md — ReBAC/Zanzibar: SpiceDB, OpenFGA, schema design, dual-write patterns62├── 05-acl-dac.md — ACL + DAC: when to use, guardrails, combining with RBAC63├── 06-hybrid-patterns.md — Layered defense, multi-tenant patterns, Zero Trust, evolution arc64├── 07-policy-engines.md — Engine comparison matrix: OPA vs Cedar vs Casbin vs SpiceDB vs Permify65├── 08-compliance.md — HIPAA, GDPR, SOC2, PCI-DSS, ISO27001 — exact mapping + audit schema66└── 09-code-examples.md — Ready-to-use code: Python, Node.js, Go across all models67```6869**When to load which file:**70- User asks about a specific model → load that model's reference file71- User asks about implementation / code → load `09-code-examples.md` + model file72- User asks about tool/engine selection → load `07-policy-engines.md`73- User asks about compliance → load `08-compliance.md`74- User is designing multi-tenant or microservices → load `06-hybrid-patterns.md`75- User is debugging broken access / role explosion → load `06-hybrid-patterns.md` §Warning Signs7677---7879## Evolution Arc (how real systems grow)8081```82Phase 1 — Early product: RBAC (Admin / User / Viewer). Fast, auditable.83Phase 2 — Multi-tenant: RBAC + ABAC (tenant_id attribute, conditional access).84Phase 3 — Multiple services: PBAC layer (OPA/Cedar policy engine, decoupled from code).85Phase 4 — Collaborative: ReBAC (hierarchical resource ownership + sharing graph).86Phase 5 — Enterprise/regulated: Full hybrid — RBAC+ABAC+PBAC+ReBAC, audit logging,87 access certification, anomaly detection.88```8990---9192## Universal Rules (apply regardless of model chosen)93941. **Deny by default** — explicit ALLOW, implicit DENY everywhere952. **Enforce server-side** — UI hints only; never trust client-side permission checks963. **Log every decision** — allow AND deny, with subject/action/resource/reason/timestamp974. **Least privilege** — grant minimum access required; time-bound temporary elevations985. **Version policies** — treat authorization rules as code: review, test, deploy, roll back996. **Quarterly access reviews** — permissions rot without active curation1007. **Test both allow and deny** — missing a deny test is a security gap101102---103104## Warning Signs (diagnose broken access control fast)105106| Symptom | Root Cause | Fix |107|---------|------------|-----|108| Role count doubles every quarter | RBAC role explosion | Introduce ABAC attributes |109| "We have a role for that" for every edge case | RBAC over-stretch | ABAC conditions |110| Different services enforce the same rule differently | Authorization scatter | PBAC engine |111| Can't answer "who has access to X?" | ACL sprawl | Centralize with PBAC |112| Audit takes days to compile | No central access log | Structured decision logging |113| Access doesn't revoke when user changes teams | Role creep | Access certification process |114| Sharing causes accidental data exposure | Unbounded DAC | DAC guardrails / boundaries |115| One engineer understands all the auth rules | ABAC policy sprawl | PBAC + documentation |116117---118119## Two-Question Clarity Test120121**Q1: What will be harder in 6 months — explaining access decisions, or changing them safely?**122- Hard to *explain* → ABAC/PBAC + visibility tooling123- Hard to *change safely* → PBAC governance layer before system becomes brittle124125**Q2: Does "same action" need different decisions based on context?**126- YES → ABAC is mandatory127- NO → Pure RBAC may be sufficient for now128129130## Online Sources131 - https://www.loginradius.com/blog/identity/how-access-control-models-work132 - https://www.openpolicyagent.org/docs/comparisons/access-control-systems133 - https://www.osohq.com/learn/abac-with-open-policy-agent-opa134 - https://authzed.com/learn/google-zanzibar135 - https://authzed.com/docs/spicedb/concepts/zanzibar136 - https://github.com/openfga137 - https://auth0.com/blog/how-to-choose-the-right-authorization-model-for-your-multi-tenant-saas-application138 - https://www.permit.io/blog/authorization-with-open-policy-agent-opa139 - https://www.styra.com/blog/enforcing-role-based-access-control-rbac-policies-with-opa/
tan-yong-sheng