Menu
Migrate API controller scope checks to framework-enforced authorization policies while preserving ownership checks.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Authorization Code Flow for web applications using MSAL.NET confidential client to sign in users and access APIs on their behalf
Handle MSAL distributed token cache collisions and stale entries in ASP.NET Core applications
On-Behalf-Of (OBO) Flow for web APIs to call downstream APIs while preserving user identity in MSAL.NET
{what this skill teaches agents}
Review API DTO implementations for contract/domain separation, mapping patterns, and REST compliance
This skill should be used when the user asks to "build a feature", "fix a bug", "implement something", "start a dev cycle", types "/dev", or describes a software task that requires design, implementation, testing, and shipping. Orchestrates the full software development lifecycle from interrogation through shipping, with self-learning that improves over time.
| name | api-controller-policy-attributes |
| description | Migrate API controller scope checks to framework-enforced authorization policies while preserving ownership checks. |
| domain | authorization |
| confidence | high |
| source | earned |
Use this when an ASP.NET Core API controller currently calls VerifyUserHasAnyAcceptedScope(...) inside actions and the host already has hierarchical authorization policies registered.
[Authorize] attribute so authentication still gates every action.src\JosephGuadagno.Broadcasting.Domain\Constants\AuthorizationPolicyNames.cs and consume them from policy registration, controller attributes, and reflection tests instead of repeating string literals.[Authorize(Policy = ...)] attributes.RequireViewer for list/view/get/read actionsRequireContributor for add/create/update/modify actionsRequireAdministrator for delete actionsGetOwnerOid(), IsSiteAdministrator(), per-resource owner comparisons) unchanged; policy migration should not broaden data visibility.using Microsoft.Identity.Web.Resource; and any resource-specific scope references that are no longer needed.src\JosephGuadagno.Broadcasting.Domain\Constants\AuthorizationPolicyNames.cssrc\JosephGuadagno.Broadcasting.Api\Controllers\EngagementsController.cs, SchedulesController.cs, SocialMediaPlatformsController.cs, UserPublisherSettingsController.cs, MessageTemplatesController.cssrc\JosephGuadagno.Broadcasting.Api.Tests\Controllers\ControllerAuthorizationPolicyTests.cs"RequireViewer" / "RequireContributor" / similar policy names in attributes, startup registration, or tests.[Authorize] while adding policy attributes.VerifyUserHasAnyAcceptedScope(...) calls in the same controller.