access-control-designer
Installation
SKILL.md
Access Control Designer
Decide who can do what in the product being built — once, as data — then enforce it on the server and reflect it in every UI. The matrix is the artifact. Pundit, CASL, and the per-role UX pass are three readers of it, and none of them keeps a second copy.
| This skill is | This skill is not |
|---|---|
| Application authorization: roles, a permission matrix, Pundit policies, CASL gates, role-gated sidebars, menus, and actions | Claude Code's own permission settings, its deny rules, or the SessionStart sentinel |
| Multi-tenant access: memberships, scopes, plan entitlements | Which skills or agents Claude may use |
| The "As a , what should I see?" UX pass | Authentication: sign-in, tokens, JWT revocation (std-security, @skills/std-rails-conventions/references/authorization.md) |
Load-bearing rules (hold even if you read nothing else):