Individual skill
review-access-control
Review and design access control for web applications and APIs, and teach the identity and access management (IAM) concepts behind them. Use when asked to inspect authentication or authorization code, or to find broken access control, insecure direct object reference (IDOR) or broken object level authorization (BOLA), broken function-level authorization, horizontal or vertical privilege escalation, tenant isolation failures (also called organization or workspace isolation), unsafe roles or permissions, stale access, or unsafe access by non-human identities, service accounts, and AI agents. Also use to create permission maps, authorization threat models, verification plans, and regression tests, to design RBAC, ABAC, or ReBAC, and for role analysis, role design, role mining, and lifecycle controls. Also use for practical IAM and identity governance and administration (IGA) study for labs and certification topics, including authentication, single sign-on (SSO), federation, provisioning, and access reviews.
skills/production/review-access-control/SKILL.md
Source commit e1c4495671c5c7cf39d3321882d51e8edf1118d1
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 11, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 14
- Repository last updated
- Oct 27, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- career-development Repository topic
- cybersecurity Repository topic
- iam Repository topic
- identity-access-management Repository topic
- security Derived category
- design Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 10,770 bytesSKILL.mdcore · 10,770 bytesagents/openai.yamlasset · 289 bytesguides/authentication-and-federation.mddoc · 8,206 bytesguides/clear-technical-english.mddoc · 1,175 bytesguides/finding-severity.mddoc · 7,223 bytesguides/glossary.mddoc · 9,129 bytesguides/iam-foundations.mddoc · 6,113 bytesguides/identity-context.mddoc · 5,498 bytesguides/lifecycle-and-governance.mddoc · 6,984 bytesguides/non-human-identities-and-agents.mddoc · 8,992 bytesguides/permission-modeling.mddoc · 10,868 bytesguides/public-sources.mddoc · 10,986 bytesguides/review-playbook.mddoc · 15,630 bytesguides/role-design-and-mining.mddoc · 6,846 bytestemplates/authorization-threat-model.mddoc · 2,323 bytestemplates/permission-map.mddoc · 2,730 bytestemplates/review-report.mddoc · 3,407 bytestemplates/verification-plan.mddoc · 4,272 bytes
Read excerpt
# Review Access Control
Turn business access rules into evidence, permission decisions, and tests. Give a practical identity and access management (IAM) result instead of generic security advice.
## Set the boundary
- Work only on systems and artifacts that the user is authorized to inspect.
- Use source review, local tests, and user-approved test environments.
- Do not attempt to bypass controls on a live service.
- Do not expose credentials, tokens, secrets, or unnecessary personal data.
- Treat this as focused access-control work, not a complete security or compliance assessment.
- Do not claim that an application is secure because the review found no weakness.
- Keep authentication, session, authorization, and general application-security observations separate.
- If the user requests only a review, do not modify code.