nocobase-acl-manage

name	nocobase-acl-manage
description	Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.
argument-hint	[task: role.*|global.role-mode.*|permission.*|user.*|risk.*] [target?] [data_source_key?] [strict_mode?]
allowed-tools	shell, local file reads
owner	platform-tools
version	2.5.3
last-reviewed	"2026-04-23T00:00:00.000Z"
risk-level	high

Goal

Turn ACL and permission governance into a task-driven workflow so users can ask for business outcomes while the skill handles:

• CLI command selection and argument shaping
• capability checks and safety guards
• write confirmation and readback evidence
• risk-oriented explanation for high-impact changes

Scope

• This skill is CLI-first for reads and writes.
• Tasks are grouped into five domains:
• role
• global role mode
• permission
• user
• risk assessment
• Every write task follows plan -> confirm -> apply -> readback.
• global role mode is treated as a global system policy, not a per-role field.

Non-Goals

• Do not bypass CLI by calling direct REST endpoints.
• Do not mutate ACL through ad-hoc database operations.
• Do not create temporary script files to execute ACL writes.
• Do not invoke other skills for env/plugin bootstrap; use direct nb commands in this skill.
• Do not hide high-impact blast radius (global mode, broad snippets, broad strategy actions).
• Do not claim one-click coverage for workflows that require governance review.

Canonical Task Model

A) Role Domain

Task	User Outcome	Required Inputs	Optional Inputs
role.audit-all	list all roles with comparable policy summary	none	data_source_key, output
role.create-blank	create a role with default read-only baseline (single creation mode)	role_name	role_title, description, hidden, allow_configure, allow_new_menu
role.compare	explain differences between roles	role_names[]	data_source_key, output

B) Global Role-Mode Domain

Task