access-control Skill

Goal

Identity is the new perimeter. Authorization must be strict, consistent, and auditable.

Steps

1. Models

• RBAC (Role-Based): Admin, Editor, Viewer. Simple, coarse-grained.
• ABAC (Attribute-Based): CanEdit if user.dept == doc.dept AND time < 5pm. Flexible, complex.
• ReBAC (Relationship-Based): CanView if user is friend_of document.owner. (Graph-based, e.g., Zanzibar).

2. Best Practices

• Least Privilege: Start with Deny All. Explicitly Allow specific actions.
• Decoupling: Decouple logic (if user.isAdmin) from policy (can(user, 'delete:report')). Use libraries like CASL or Oso.
• No Hardcoded IDs: Never checks if (user.id === '123').

3. Infrastructure IAM

• Service Accounts: Separate identity for apps/machines. Rotate keys automatically.
• Short-Lived Credentials: Use OIDC/STS (AssumeRole) instead of long-lived access keys.