auth-agnostic-architecture-boundary

name	auth-agnostic-architecture-boundary
description	Use this skill to enforce strict separation between core system architecture and authentication/authorization concerns.

Architectural Boundary Rule

This project is completely agnostic to authentication and authorization.

If a request reaches the system:

• The user is already authenticated
• The user is already authorized
• No permission checks are required

---

Core Principle

Authentication and authorization are external concerns.

They are handled by:

• API gateways
• Identity providers
• BFFs
• External security layers

They are never handled inside:

• Domain logic
• Application use cases
• Core services
• Business rules

---

Explicit Rules

• Do not model roles, permissions, or access levels
• Do not check user privileges in code
• Do not branch logic based on user identity or role
• Do not leak auth concepts into domain language

The system assumes trusted, pre-authorized input.

---

Mental Model for the AI Agent

Think of the system as operating in a secure internal network:

• Every request is valid
• Every action is permitted
• Focus exclusively on business correctness

If a feature requires authorization logic,
it is out of scope by design.

Violations of this rule are architectural bugs, not security improvements.