Run any Skill in Manus with one click

security-or-authz-change

Stars2

Forks0

UpdatedJune 17, 2026 at 16:28

Use when changing authz, RBAC, RLS, audit ledger, OCR provenance, secret handling, SCIM, SSO, CSP, supply-chain dependencies, or any RC3 security surface listed in docs/governance/03-change-risk-matrix.md. Enforces maker-checker discipline, negative tests, and source citations. Aligned with docs/workflows/security-or-authz-change.md.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

A-C-I-SOFTWARE-AND-DEVELOPMENT

A-C-I-SOFTWARE-AND-DEVELOPMENT/M.U.S.E

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-or-authz-change
description	Use when changing authz, RBAC, RLS, audit ledger, OCR provenance, secret handling, SCIM, SSO, CSP, supply-chain dependencies, or any RC3 security surface listed in docs/governance/03-change-risk-matrix.md. Enforces maker-checker discipline, negative tests, and source citations. Aligned with docs/workflows/security-or-authz-change.md.

security-or-authz-change

When to use

Activated automatically by chief-orchestrator whenever the changed paths intersect with the RC3 surfaces in docs/governance/03-change-risk-matrix.md. Mandatory maker-checker discipline.

Method

Research dossier first. Run research-dossier-build and cite the relevant standard (NIST SP, OWASP rule, CWE, ISO 27001 control). Save under docs/research/.
Threat model delta. Either update the existing threat model for this surface (under docs/security/ or docs/iso27001/) or note explicitly why no update is needed.
Negative tests planned upfront. For each role (carrier_admin, safety_manager, dispatcher, driver, solo_driver): which rejection path is tested by this PR?
Implement. Follow .claude/rules/security-authz-and-trust-boundaries.md.
Audit ledger / OCR provenance integrity preserved. Append-only, monotonic sequence, full provenance fields on regulator-facing artifacts.
Verify.
- npm run lint, npm run typecheck
- npm test — count stable or explained
- npm run build
- npm run test:e2e (covered path)
- npm run governance:check
- npm run agentos:check
- CI: dependency audit --audit-level=high, gitleaks working tree, semgrep (review findings), governance index.
Independent review. Hand off to assurance-security-compliance-office. Builder cannot self-review.
Third verifier. research-evidence-bureau confirms citations.
PR. Draft only. Use pr-readiness-and-owner-handoff to assemble the final body.

Output

A research dossier under docs/research/.
A threat-model update (or a justification for none).
Code change with negative-test coverage.
Verification command log.
Independent reviewer note and verifier note.
Draft PR.

Anti-patterns

Loosening an existing control "for now".
Adding a "re-enable later" deferral comment next to an authz check.
A new SCIM / SSO path with no malformed-payload test.
A migration to an RC3 surface with no rollback plan.

More from this repository

same repository

game-studio

A-C-I-SOFTWARE-AND-DEVELOPMENT/M.U.S.E

Route a game brief to a gated, engine-agnostic pipeline.

2026-07-132

seat-roster

A-C-I-SOFTWARE-AND-DEVELOPMENT/M.U.S.E

Route orchestrated work across the installed seats.

2026-07-092

serving-llms-dspark

A-C-I-SOFTWARE-AND-DEVELOPMENT/M.U.S.E

DSpark: DeepSeek speculative decoding — 60-85% faster inference, identical outputs.

2026-07-022

musehq-voice

A-C-I-SOFTWARE-AND-DEVELOPMENT/M.U.S.E

Talk like Breadstick Ricky from Breadstick Ricky & The Boss — the default "Ricky" register for Muse. Load when Jeremiah wants Muse's normal conversational personality (excitable, confident, colorful, high-energy) — while staying honest and competent.

2026-07-022

autoresearch

A-C-I-SOFTWARE-AND-DEVELOPMENT/M.U.S.E

Run Karpathy's autoresearch loop — autonomous 5-minute pretraining experiments on the vendored nanochat-style engine — inside a disposable workspace, governed by muse's cost ceiling, VRAM feasibility gate, and benchmark gate, with every experiment on the flywheel. The winning train.py surfaces as an owner-gated proposal; val_bpb LOWER is better; nothing is ever applied without the owner.

2026-06-242

ue5-render

A-C-I-SOFTWARE-AND-DEVELOPMENT/M.U.S.E

Turn a prompt packet into a gated, ledgered Unreal Engine 5 offscreen render.

2026-06-242

name	security-or-authz-change
description	Use when changing authz, RBAC, RLS, audit ledger, OCR provenance, secret handling, SCIM, SSO, CSP, supply-chain dependencies, or any RC3 security surface listed in docs/governance/03-change-risk-matrix.md. Enforces maker-checker discipline, negative tests, and source citations. Aligned with docs/workflows/security-or-authz-change.md.

security-or-authz-change

When to use

Activated automatically by chief-orchestrator whenever the changed paths intersect with the RC3 surfaces in docs/governance/03-change-risk-matrix.md. Mandatory maker-checker discipline.

Method

Research dossier first. Run research-dossier-build and cite the relevant standard (NIST SP, OWASP rule, CWE, ISO 27001 control). Save under docs/research/.
Threat model delta. Either update the existing threat model for this surface (under docs/security/ or docs/iso27001/) or note explicitly why no update is needed.
Negative tests planned upfront. For each role (carrier_admin, safety_manager, dispatcher, driver, solo_driver): which rejection path is tested by this PR?
Implement. Follow .claude/rules/security-authz-and-trust-boundaries.md.
Audit ledger / OCR provenance integrity preserved. Append-only, monotonic sequence, full provenance fields on regulator-facing artifacts.
Verify.
- npm run lint, npm run typecheck
- npm test — count stable or explained
- npm run build
- npm run test:e2e (covered path)
- npm run governance:check
- npm run agentos:check
- CI: dependency audit --audit-level=high, gitleaks working tree, semgrep (review findings), governance index.
Independent review. Hand off to assurance-security-compliance-office. Builder cannot self-review.
Third verifier. research-evidence-bureau confirms citations.
PR. Draft only. Use pr-readiness-and-owner-handoff to assemble the final body.

Output

A research dossier under docs/research/.
A threat-model update (or a justification for none).
Code change with negative-test coverage.
Verification command log.
Independent reviewer note and verifier note.
Draft PR.

Anti-patterns

Loosening an existing control "for now".
Adding a "re-enable later" deferral comment next to an authz check.
A new SCIM / SSO path with no malformed-payload test.
A migration to an RC3 surface with no rollback plan.