Individual skill

sg-manage-roles

Guided flow for creating, changing and deleting StackGuardian custom roles with the create_role / update_role / delete_role tools — turning "let team X read/run workflows in group Y" into the right permission names and scopes. Use when the user wants a new role, wants to widen or narrow what a role can do, asks why a role grants nothing, or wants to retire a role.

skills/sg-manage-roles/SKILL.md

Read pinned source

Source commit 66070a05d05c95c06fe936ac0ad2c9bb68bf7623

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Instructions only
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 12
Repository last updated: Nov 2, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
claude-code Repository topic
cloud-governance Repository topic
codex Repository topic
cursor Repository topic
devops Repository topic
drift-detection Repository topic
gemini-cli Repository topic
github-copilot Repository topic
engineering Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 8,883 bytes

Read excerpt


# Manage Roles — Guided Flow

A StackGuardian **role** is a named bundle of **permissions**. Each permission
is one platform capability (`GetWorkflow`, `CreateWorkflowRun`, ...) plus a
**scope**: for every placeholder the permission carries, a list of full-match
regex **patterns** over resource IDS. Five **predefined roles** (ADMIN, DEV,
SEC, OPS, READ_ONLY) are code and cannot be changed; everything else is a
**custom role**. Roles are allow-only and additive — a user with several
roles gets the union. Only ADMIN can manage roles. Follow the steps IN ORDER.
Never surface parameter names like `resourceName` or `<wfGrp>` to the user;
say "the role's name", "workflow group".

**What these tools can't do — say so up front, before building anything:**
they can't list users, look up a person, assign a role to anyone, or show a