obsidian-enterprise-rbac

Implement team vault access patterns and role-based controls. Use when managing shared vaults, implementing access controls, or building team collaboration features for Obsidian. Trigger with phrases like "obsidian team", "obsidian access control", "obsidian enterprise", "shared vault permissions".

Jump to install

Repository: jeremylongshore/claude-code-plugins-plus-skills
Last source activity: July 17, 2026 at 22:18
Detected SKILL.md language: English
Stars: 2,604
Forks: 378

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill obsidian-enterprise-rbac

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

2 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

name	obsidian-enterprise-rbac
description	Implement team vault access patterns and role-based controls. Use when managing shared vaults, implementing access controls, or building team collaboration features for Obsidian. Trigger with phrases like "obsidian team", "obsidian access control", "obsidian enterprise", "shared vault permissions".
allowed-tools	Read, Write, Edit
version	1.13.0
license	MIT
author	Jeremy Longshore <jeremy@intentsolutions.io>
tags	["saas","obsidian","obsidian-enterprise"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Obsidian Enterprise RBAC

Overview

Vault-level access control patterns for Obsidian in team environments. Covers folder-based permissions via .obsidian-permissions files, read-only enforcement for shared vaults, plugin allowlisting, and configuration lockdown through restricted mode.

Prerequisites

Obsidian desktop app with a shared/synced vault
Understanding of Obsidian's .obsidian/ configuration directory
A sync mechanism in place (Git, Obsidian Sync, or shared filesystem)
Node.js 18+ for scripted permission enforcement

Instructions

Step 1: Define a Permission Model

Create .obsidian-permissions at the vault root. This JSON file maps roles to folder access:

{
  "version": 1,
  "roles": {
    "admin": {
      "folders": ["*"],
      "permissions": ["read", "write", "delete", "manage"]
    },
    "editor": {
      "folders": ["projects/*", "shared/*",

import { Plugin, TFile, Notice } from 'obsidian'; interface PermissionConfig { version: number; roles: Record<string, { folders: string[]; permissions: string[] }>; users: Record<string, string>; } export default class RBACPlugin extends Plugin { private config: PermissionConfig | null = null; private currentUser: string = ''; async onload() { await this.loadPermissions(); // Intercept file modifications this.registerEvent( this.app.vault.on('modify', (file) => { if (!this.canWrite(file.path)) { new Notice(`Permission denied: ${file.path} is read-only for your role`); } }) ); // Intercept file creation this.registerEvent( this.app.vault.on('create', (file) => { if (file instanceof TFile && !this.canWrite(file.parent?.path ?? '/')) { new Notice(`Permission denied: cannot create files in ${file.parent?.path}`); // Move to user's writable area or delete this.app.vault.delete(file); } }) ); } private async loadPermissions() { const permFile = this.app.vault.getAbstractFileByPath('.obsidian-permissions'); if (permFile instanceof TFile) { const content = await this.app.vault.read(permFile); this.config = JSON.parse(content); } // Identify current user from plugin settings or environment const data = await this.loadData(); this.currentUser = data?.userEmail ?? ''; } private canWrite(path: string): boolean { if (!this.config || !this.currentUser) return true; // Fail open if no config const role = this.config.users[this.currentUser]; if (!role) return false; const roleDef = this.config.roles[role]; if (!roleDef) return false; if (!roleDef.permissions.includes('write')) return false; return roleDef.folders.some(pattern => { if (pattern === '*') return true; const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$'); return regex.test(path); }); } }

Issue	Cause	Solution
Permission denied on all files	User email not set in plugin settings	Open RBAC plugin settings, enter your email
Allowlist keeps resetting	Non-admin edited `community-plugins.json`	Only admins can modify; check audit log
Config hash mismatch on every load	Config changed legitimately	Admin runs `lockdownConfigs()` to update hashes
Plugin not intercepting writes	Event handler registration failed	Check console for plugin load errors
Sync conflicts on `.obsidian-permissions`	Multiple admins editing simultaneously	Use Git with merge strategy or Obsidian Sync

obsidian-enterprise-rbac

Install options

Review the source files

Obsidian Enterprise RBAC

Overview

Prerequisites

Instructions

Step 1: Define a Permission Model

Obsidian Enterprise RBAC

Overview

Prerequisites

Instructions

Step 1: Define a Permission Model

Step 2: Build the Permission Checker Plugin

Step 3: Enforce Read-Only Mode on Shared Vaults

Step 4: Plugin Allowlisting

Step 5: Configuration Lockdown via Restricted Mode

Output

Error Handling

Examples

Resources

Next Steps

obsidian-enterprise-rbac

Source facts

Install options

Review the source files

More from this repository

Obsidian Enterprise RBAC

Overview

Prerequisites

Instructions

Step 1: Define a Permission Model

More from this repository

Obsidian Enterprise RBAC

Overview

Prerequisites

Instructions

Step 1: Define a Permission Model

Step 2: Build the Permission Checker Plugin

Step 3: Enforce Read-Only Mode on Shared Vaults

Step 4: Plugin Allowlisting

Step 5: Configuration Lockdown via Restricted Mode

Output

Error Handling

Examples

Resources

Next Steps