Add-on: Auth Access Control

Use this skill when a project needs a reusable identity boundary, route protection, and explicit access policy instead of ad hoc auth checks.

Compatibility

• Works with architect-python-uv-fastapi-sqlalchemy, architect-nextjs-bun-app, and architect-next-prisma-bun-vector.
• Can be combined with architect-nostr-intent-router when Nostr identity or signer-based access is part of the product.
• Usually not needed for offline-only architect-python-uv-batch jobs unless they expose operator APIs.

Inputs

Collect:

• AUTH_MODE: session-cookie | jwt-bearer | api-key | mixed.
• IDENTITY_SOURCE: first-party | oauth | nostr-signer.
• ACCESS_MODEL: rbac | roles+scopes.
• REQUIRE_MFA_FOR_ADMIN: yes | no (default yes).
• SESSION_TTL_MINUTES: default 60.