internal-azure-governance

Stars1

Forks0

UpdatedAugust 1, 2026 at 21:32

Use when /internal-azure selects Azure authorization, workload identity, privileged access, Policy, guardrail, or exception work.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

pagopa

pagopa/cloud-strategy.github

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

3 files

SKILL.md

readonly

name	internal-azure-governance
description	Use when /internal-azure selects Azure authorization, workload identity, privileged access, Policy, guardrail, or exception work.

Internal Azure Governance

Use this workflow to define auditable Azure identity, access, and guardrail decisions.

When to use

Use when /internal-azure selects an Azure governance deliverable involving RBAC, workload identity, PIM/PAM, Policy, tagging, or exceptions.

Workflow

State the governance objective: the access, prevention, detection, or privileged-elevation outcome required.
Set the control scope: management group, subscription set, subscription, or resource, with the affected principals and workloads.
Design the authorization model and distinguish grants, preventive controls, detective controls, workload identity, and privileged elevation.
Define the exception path with an owner, business reason, compensating control, expiry or review date, and audit evidence.
Stage the rollout with a safe scope, compliance or access checks, rollback triggers, and evidence collection.
Apply the completion criteria: scope is explicit, controls are classified, authorization is least-privilege, exceptions are reviewable, and rollout evidence is recorded.

Azure governance patterns

Use Azure Policy and initiatives for preventive or detective guardrails.
Use RBAC role assignments for authorization with explicit scope.
Use managed identities or federation for workload access and keep runtime identity separate from human access grants.
Use PIM or PAM for time-bound, approved, and reviewable elevation.
Use naming and tagging controls when metadata consistency is part of the governance objective.

Current facts

Use current Microsoft documentation when the recommendation depends on Azure RBAC semantics, managed identity support, Policy effects, or privileged-access behavior.

Load references/guardrail-map.md for control patterns, identity examples, and exception evidence.

Completion criteria

Return the governance objective, control scope, recommended mechanism, exception path, rollout evidence, and remaining validation risks.

More from this repository

same repository

anthropic-docx

pagopa/cloud-strategy.github

Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx or .dotx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.

2026-08-011

internal-agent-creator

pagopa/cloud-strategy.github

Use when creating, reviewing, or materially revising a repository-owned Copilot agent under `.github/agents/`.

2026-08-011

internal-aws-governance

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS governance lane for IAM operating models, trust policies, federation, permission boundaries, SCPs, tag policies, exception controls, or access guardrails.

2026-08-011

internal-aws-lambda

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS Lambda lane for handlers, event sources, runtimes, packaging, retries, concurrency, cold starts, or Lambda-specific configuration.

2026-08-011

internal-aws-mcp-research

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS research lane to retrieve current official AWS documentation, regional availability, service behavior, IAM state, or policy-simulation evidence.

2026-08-011

internal-aws-operations

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS operations lane for monitoring, logging, rollout validation, backup and restore proof, DR evidence, reporting, or audit evidence.

2026-08-011

Internal Azure Governance

Use this workflow to define auditable Azure identity, access, and guardrail decisions.

When to use

Use when /internal-azure selects an Azure governance deliverable involving RBAC, workload identity, PIM/PAM, Policy, tagging, or exceptions.

Workflow

State the governance objective: the access, prevention, detection, or privileged-elevation outcome required.

Set the control scope: management group, subscription set, subscription, or resource, with the affected principals and workloads.

Design the authorization model and distinguish grants, preventive controls, detective controls, workload identity, and privileged elevation.

Define the exception path with an owner, business reason, compensating control, expiry or review date, and audit evidence.

Stage the rollout with a safe scope, compliance or access checks, rollback triggers, and evidence collection.

Apply the completion criteria: scope is explicit, controls are classified, authorization is least-privilege, exceptions are reviewable, and rollout evidence is recorded.

Azure governance patterns

Use Azure Policy and initiatives for preventive or detective guardrails.

Use RBAC role assignments for authorization with explicit scope.

Use managed identities or federation for workload access and keep runtime identity separate from human access grants.

Use PIM or PAM for time-bound, approved, and reviewable elevation.

Use naming and tagging controls when metadata consistency is part of the governance objective.

Current facts

Use current Microsoft documentation when the recommendation depends on Azure RBAC semantics, managed identity support, Policy effects, or privileged-access behavior.

Load references/guardrail-map.md for control patterns, identity examples, and exception evidence.

Completion criteria

Return the governance objective, control scope, recommended mechanism, exception path, rollout evidence, and remaining validation risks.