kinde-authorization
Kinde Authorization
Consumes a tenant contract from kinde-b2b. Produces an authorization contract: the permission catalog, role matrix, assignment matrix, and enforcement matrix for that tenant. Application and API decisions target permission keys, not role names.
Stance
Treat the run as design-only until the user authorizes implementation. Catalog writes are business-wide; plan them before mutating a shared business. Actively invoke the loaded framework adapter for framework syntax; absent adapter blocks implementation. Dated sources and official conflicts live in REFERENCES.md.
Generic JWT, tenant-binding, missing-organization, machine-credential, and plane-setup rules stay in kinde-b2b. This skill owns catalog, assignment, defaults, claim freshness, and permission-key enforcement.
Guardrails
- Permission keys. Server decisions use verified permission keys for the active organization. Roles are a management grouping.
- Shared catalog. Role and permission definitions are business-level. A write in a non-production environment is the same catalog in production.
- Membership first. Roles and permissions assign only to a user who already belongs to that organization.
- MCP writes stop at create. Management MCP may create roles and permissions and read selected relationships. It does not attach permissions to roles or assign roles or permissions to users. Broader writes use dashboard or Management API. Details: PLANES.md.
- Separate mechanisms. User permission keys, machine scopes, feature flags, and billing entitlements are different. Invoke the owning skill for flags or billing; an unavailable owner blocks that decision branch. Details: ENFORCEMENT.md.