Security Authorization

Overview

Use this skill to build authorization systems that enforce least privilege across APIs, UI actions, and background jobs.

Scope Boundaries

• Role/permission models are being introduced or revised.
• Resource-scoped access control must be consistent across services.
• Privileged workflows require explicit separation-of-duty controls.

Templates And Assets

• Authorization policy matrix:
  • assets/authorization-policy-matrix-template.md

Inputs To Gather

• Actor categories, resources, and sensitive actions.
• Data classification and tenant or domain boundaries.
• Existing policy model and enforcement points (API gateway, service layer, DB layer).
• Abuse scenarios (horizontal/vertical privilege escalation, confused deputy, missing object-level checks).