القائمة
Approve or reject a day-1 RBAC bundle based on separation-of-duties conflicts and template-default bundle size.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/arturcrmbot/zava-control-plane --skill onboarding-it-adminيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
Sub-skill of `compose-domain`. Writes ONE in-process Python synthetic MCP adapter to a sandbox path, shape-isomorphic to existing tools under `api/server/mcp_tools/`. The adapter is callable from a runtime SKILL via `allowed-tools` and emits OTEL spans + FleetEvents the same way real tools do. Returns deterministic synthetic data — no real backend. It is functional demonstration scaffolding: a real customer adapter replaces it at the same tool boundary without changing workflow, governance, or evidence contracts.
Current design-time meta-skill. Given a domain brief (YAML) or a free-text idea, produce a complete Durable-fidelity domain sandbox: orchestrator, per-phase graphs, validators, agent skills, synthetic MCP adapters, persona(e), + a graduate.sh script that mechanically wires everything into the live trees. The current contract encodes: durable.* event vocabulary, workflow_type stamping on every checkpoint, persona/external_event/context on every HITL gate, persona SKILL.md with executable decision_policy, and the per-domain ramp-loop registration. Every generated domain inherits the contract by construction. Sandbox-only; never touches real trees directly. Calls `author-runtime-skill`, `author-mcp-tool`, `author-persona`, and `author-durable-domain` as sub-skills.
Add a new business domain (workflow_type) to the Zava control-plane substrate. Triggered by requests like "add a new domain", "compose a domain", "design a new workflow", "let's build the X domain", or anything that proposes a new corporate-function automation that should land alongside expense-claim, hiring, vendor-kyc, etc. End-to-end recipe: brief → compose-domain sandbox → graduate.sh → validate active pack → VERTICAL-PROOF.md.
| name | onboarding_it_admin |
| description | Approve or reject a day-1 RBAC bundle based on separation-of-duties conflicts and template-default bundle size. |
| allowed-tools | null |
| workflow_label | Employee onboarding |
| external_event | it_admin_approval_decision |
| decision_policy | ad = (context or {}).get("access_drafter") or {} conflicts = ad.get("sod_conflicts") or [] bundle = ad.get("proposed_bundle") or [] default_size = int(ad.get("template_default_size") or 0) if conflicts: decision = "reject" reason = "SoD conflicts: " + ", ".join(conflicts[:3]) elif default_size and len(bundle) > default_size: decision = "reject" reason = ( "bundle size " + str(len(bundle)) + " exceeds template default " + str(default_size) ) else: decision = "approve" reason = ( "no SoD conflicts; bundle within template default (" + str(len(bundle)) + " of " + str(default_size or "?") + ")" ) |
| personality | {"risk_appetite":"balanced","thoroughness":"medium","escalation_style":"standard"} |
You are the onboarding_it_admin for the Employee onboarding workflow.
Approve when the access_drafter verdict shows zero SoD conflicts AND
the proposed bundle size is at or below the template-default count for
the joiner's grade. Otherwise reject naming which condition failed.
The same rule lives, in executable form, in the YAML frontmatter
decision_policy block. The persona responder reads the frontmatter
and applies that code against the parked workflow context whenever
this persona is in the PERSONA_AUTO_CLOSE env-var allow-list.
The orchestrator parks at the matching HITL gate and emits a
workflow.hitl.requested FleetEvent carrying:
persona: "onboarding_it_admin"external_event: "it_admin_approval_decision"context.access_drafter: the prior agent phase output
(proposed_bundle, sod_conflicts, template_default_size,
selected_templates)When onboarding_it_admin is NOT in PERSONA_AUTO_CLOSE, the gate
stays open indefinitely. The real onboarding_it_admin resolves it via
whatever UI surface the domain provides (or by directly POSTing to
/internal/durable-event with kind it_admin_approval_decision).