nocobase-acl-manage

Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.

Jump to install

Repository: Agents-Store/claude-plugins
Last source activity: May 11, 2026 at 16:59
Detected SKILL.md language: English
Stars: 0
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Agents-Store/claude-plugins --skill nocobase-acl-manage

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

17 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

feedback

This skill should be used when the user reports a problem with macstack-dev or the MACSTACK standard — "this skill did the wrong thing", "the schema is missing a field", "the passport for X is wrong", "send macstack feedback", "improve the schema based on my edit", "fix the macstack plugin" — and the fix must land in the right source (plugin, schema repo, or registry repo).

2026-08-09

infisical-env

This skill should be used when the user asks to "set up Infisical for this project", "create .infisical.json", "pull the env keys", "wire the env", "sync secrets", or scaffold-project reaches the env step. Creates .infisical.json, pulls .env.prod/.env.dev, ensures every key from macstack.json resources.accesses exists, and installs the mandatory secrets scripts and commands.

2026-08-09

scaffold-project

This skill should be used when the user asks to "scaffold the project from macstack.json", "create the project working files", "generate project files from the spec", "build the project from macstack.json", or after a macstack.json is validated and the working tree must be built. Creates project files strictly in the prototype → stack plugins → dev plugins order.

2026-08-09

View all from this repository

Non-Goals

Do not bypass CLI by calling direct REST endpoints.

Do not mutate ACL through ad-hoc database operations.

Do not create temporary script files to execute ACL writes.

Do not invoke other skills for env/plugin bootstrap; use direct nb commands in this skill.

Do not hide high-impact blast radius (global mode, broad snippets, broad strategy actions).

Do not claim one-click coverage for workflows that require governance review.

Canonical Task Model

A) Role Domain

Task

User Outcome

Required Inputs

Optional Inputs

role.audit-all

list all roles with comparable policy summary

none

data_source_key, output

role.create-blank

create a role with default read-only baseline (single creation mode)

role_name

role_title, description, hidden, allow_configure, allow_new_menu

role.compare

explain differences between roles

role_names[]

data_source_key, output

B) Global Role-Mode Domain

Task

Non-Goals

Do not bypass CLI by calling direct REST endpoints.

Do not mutate ACL through ad-hoc database operations.

Do not create temporary script files to execute ACL writes.

Do not invoke other skills for env/plugin bootstrap; use direct nb commands in this skill.

Do not hide high-impact blast radius (global mode, broad snippets, broad strategy actions).

Do not claim one-click coverage for workflows that require governance review.

Canonical Task Model

A) Role Domain

Task

User Outcome

Required Inputs

Optional Inputs

role.audit-all

list all roles with comparable policy summary

none

data_source_key, output

role.create-blank

create a role with default read-only baseline (single creation mode)

role_name

role_title, description, hidden, allow_configure, allow_new_menu

role.compare

explain differences between roles

role_names[]

data_source_key, output

B) Global Role-Mode Domain

Task

name	nocobase-acl-manage
description	Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.
argument-hint	[task: role.\|global.role-mode.\|permission.\|user.\|risk.*] [target?] [data_source_key?] [strict_mode?]
allowed-tools	shell, local file reads
owner	platform-tools
version	2.5.3
last-reviewed	"2026-04-23T00:00:00.000Z"
risk-level	high

name	nocobase-acl-manage
description	Task-driven ACL governance through nb CLI for role lifecycle, global role mode, permission policy, user-role membership, and risk assessment. Use when users describe business permission outcomes instead of raw command arguments.
argument-hint	[task: role.\|global.role-mode.\|permission.\|user.\|risk.*] [target?] [data_source_key?] [strict_mode?]
allowed-tools	shell, local file reads
owner	platform-tools
version	2.5.3
last-reviewed	"2026-04-23T00:00:00.000Z"
risk-level	high

`global.role-mode.get`	read current global role mode	none	`output`
`global.role-mode.set`	switch global role mode	`role_mode`	`strict_mode`

Task	User Outcome	Required Inputs	Optional Inputs
`permission.system-snippets.set`	set role-level system snippets	`role_name`, (`snippet_preset` or `snippets`)	none
`permission.route.desktop.set`	set desktop route permissions for a role	`role_name`, `route_ids[]`	`set_mode` (`set` or `add` or `remove`)
`permission.data-source.global.set`	set global strategy actions for all tables in one data source	`role_name`, `global_actions[]`	`data_source_key`
`permission.data-source.resource.set`	set independent actions for one or more collections	`role_name`, (`collection_hint` or `collection_hints[]`), `actions[]`	`data_source_key`, `fields_map`, `scope_map`, `resource_scope` (`all` by default)
`permission.scope.manage`	create/update/list reusable scopes	`scope_task`	`data_source_key`, `scope_id`, `scope_payload`

Task	User Outcome	Required Inputs	Optional Inputs
`user.assign-role`	assign one role to one or many users	`role_name`, (`user_ids[]` or `user_filter`)	`allow_generic_association_write`
`user.unassign-role`	remove one role from one or many users	`role_name`, (`user_ids[]` or `user_filter`)	`allow_generic_association_write`
`user.audit-role-membership`	inspect users bound to roles	(`role_name` or `user_id`)	`output`

nocobase-acl-manage

Install options

Review the source files

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

C) Permission Domain

D) User Domain

E) Risk Domain

Input Contract

Mandatory Clarification Gate

Workflow

Tooling Policy

Safety Gate

Capability Boundary Messaging

Verification Checklist

Minimal Test Scenarios

Reference Loading Map

References

Task	User Outcome	Required Inputs	Optional Inputs
`risk.assess-role`	risk score and rationale for one role	`role_name`	`data_source_key`, `output`
`risk.assess-user`	risk score based on user-role-permission relationship	`user_id`	`data_source_key`, `output`
`risk.assess-system`	system-level ACL governance risk summary	none	`data_source_key`, `output`

Input	Required	Default	Validation	Clarification Question
`task`	yes	none	one of canonical tasks or alias	"Which ACL governance task should run?"
`role_name`	conditional	none	role exists for update/audit tasks; write tasks normalize to `r_*` uid	"Which role should be targeted?"
`role_mode`	conditional	none	one of `default/allow-use-union/only-use-union`	"Which global role mode should be set?"
`collection_hint` / `collection_hints[]`	conditional	none	required for `permission.data-source.resource.set`; business name/keyword input is allowed	"Which business table(s) should be configured?"
`resolved_collection_names[]`	conditional	runtime resolved	required before write for `permission.data-source.resource.set`; each collection must exist in selected data source	"I found these matching collections. Which should be used?"
`actions[]`	conditional	none	required for `permission.data-source.resource.set`	"Which actions should be granted on these collections?"
`resource_scope`	no	`all`	one of `all` / `own` / `custom(scope_id or scope_filter)`	"Which data scope should be used? Default is all; choose own/custom only when needed."
`data_source_key`	no	`main`	must exist at runtime	"Which data source key should be used? (default: main)"
`strict_mode`	no	`safe`	`safe` or `fast`	"Use safe mode with full readback?"
`allow_generic_association_write`	no	`false`	boolean	"Allow guarded generic association writes for user-role assignment?"
`output`	no	`text+matrix`	`text`, `text+matrix`, `text+evidence`	"How detailed should the result be?"

Reference	Use When	Notes
references/intent-presets-v1.md	intent normalization and defaults	includes global role-mode wording
references/intent-to-tool-map-v1.md	runtime command resolution	maps logical tasks to CLI command patterns
references/execution-guard-template.md	every ACL write task	fixed preflight command template for base-dir lock and fail-closed checks
references/result-format-v1.md	output rendering	includes risk cards and capability path
references/configuration.md	ACL policy details	detailed data-source and scope guidance
references/independent-permissions.md	resource-level permission writes	`usingActionsConfig + actions + fields + scope` complete-write policy
tests/capability-test-plan.md	capability matrix	aligned with v2 domains
tests/test-playbook.md	acceptance regression	prompt-first TC01, TC02, TC04-TC20 with runtime evidence commands
references/refactor-plan-v2.md	capability gaps and rollout plan	includes CLI migration notes
tests/README.md	runtime verification	playbook execution flow and reporting notes

nocobase-acl-manage

Source facts

Install options

Review the source files

More from this repository

More from this repository

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

Goal

Scope

Non-Goals

Canonical Task Model

A) Role Domain

B) Global Role-Mode Domain

C) Permission Domain

D) User Domain

E) Risk Domain

Input Contract

Mandatory Clarification Gate

Workflow

Tooling Policy

Safety Gate

Capability Boundary Messaging

Verification Checklist

Minimal Test Scenarios

Reference Loading Map

References