Menu
Run Zed permission checks against SpiceDB in Kessel stage. Use when checking RBAC permissions in SpiceDB, verifying group membership, workspace access for users, or running zed permission check/lookup-resources against stage.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Call RBAC internal API endpoints in stage or prod via Turnpike (same routing as the relationship skill). Use when invoking /_private/api/ utils, tenant, relations, inventory, disaster recovery, or integration endpoints.
Diagnose RBAC data and Kessel/SpiceDB replication issues in OpenShift ephemeral namespaces (platform role child relationships, principals, permissions). Use when debugging ephemeral envs, crc-eph, missing SpiceDB tuples, empty principals, or Postgres vs Kessel mismatches.
Run SQL queries against RBAC database in stage or prod using gabi
How to run unit tests, linting, and type checking for local development
Query relationships in SpiceDB/Kessel via the RBAC relations API
| name | zed-spicedb-check |
| description | Run Zed permission checks against SpiceDB in Kessel stage. Use when checking RBAC permissions in SpiceDB, verifying group membership, workspace access for users, or running zed permission check/lookup-resources against stage. |
Use this skill to run Zed permission checks against SpiceDB in the Kessel stage environment.
Check for config.env: Verify .cursor/skills/config.env exists with ZED_SPICEDB_VAULT_URL (optional, for vault link).
Get SpiceDB PSK token: The token is in Vault. Read ZED_SPICEDB_VAULT_URL from .cursor/skills/config.env for the vault link, or use: Vault - Kessel Stage SpiceDB PSK
Export the token (do not store in config.env): export ZED_SPICEDB_PSK="<token_from_vault>"
oc CLI: Logged into the stage OpenShift cluster
oc whoami
If this fails with "Unauthorized" or "You must be logged in to the server", you need to log in first. The stage cluster login link is in .cursor/skills/config.env as OPENSHIFT_STAGE_CONSOLE. Open that URL in your browser, click your username (top right) → Copy login command, then run the copied command in your terminal.
# Login to stage cluster (if Step 0 showed you are not logged in)
# Get the login command from OPENSHIFT_STAGE_CONSOLE in config.env (browser → Copy login command)
oc project kessel-stage
oc port-forward svc/kessel-relations-spicedb 50051:50051
Keep the port-forward running in a separate terminal.
Export the PSK and set the Zed context:
# Export the token (get from Vault - do not commit)
export ZED_SPICEDB_PSK="<token_from_vault>"
zed context set kessel-stage2 localhost:50051 "$ZED_SPICEDB_PSK" --insecure
zed context use kessel-stage2
zed permission check rbac/group:a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d member rbac/principal:redhat/12345678
zed permission lookup-resources rbac/group member rbac/principal:redhat/87654321
zed permission check rbac/group:<group_uuid> member rbac/principal:redhat/<user_id>
zed permission lookup-resources rbac/group member rbac/principal:redhat/<user_id>
zed permission check rbac/workspace:<workspace_uuid> view rbac/principal:redhat/<user_id>
Example:
zed permission check rbac/workspace:f7e8d9c0-b1a2-4e3d-8c7b-6a5f4e3d2c1b view rbac/principal:redhat/11223344
rbac/group:<uuid> (e.g. rbac/group:a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d)rbac/workspace:<uuid> (e.g. rbac/workspace:f7e8d9c0-b1a2-4e3d-8c7b-6a5f4e3d2c1b)rbac/principal:redhat/<user_id> (e.g. rbac/principal:redhat/12345678)Variables in .cursor/skills/config.env:
| Variable | Description |
|---|---|
OPENSHIFT_STAGE_CONSOLE | Stage cluster web console URL — use to get "Copy login command" for oc login |
ZED_SPICEDB_VAULT_URL | Vault URL to obtain the SpiceDB PSK token |
ZED_SPICEDB_PSK | The PSK token — use export, do not store in config.env |