iam-consent-governance

name	iam-consent-governance
description	Use when changing IAM, consent scopes, actor model, verification policy, or marketplace access contracts inside the security-audit owner family.

Hussh IAM Consent Governance Skill

Purpose and Trigger

• Primary scope: iam-consent-governance
• Trigger on IAM, consent scopes, actor model, verification policy, or marketplace access contract changes.
• Avoid overlap with vault-pkm-governance and quality-contracts.

Coverage and Ownership

• Role: spoke
• Owner family: security-audit

Owned repo surfaces:

1. docs/reference/iam
2. consent-protocol/api/routes/iam.py
3. consent-protocol/api/routes/consent.py
4. hushh-webapp/lib/consent
5. hushh-webapp/components/consent

Non-owned surfaces:

1. security-audit
2. backend
3. docs-governance

Do Use

1. Consent-scope, actor-model, and verification-gate changes.
2. IAM runtime surface and marketplace access contract work.
3. IAM docs and code alignment across frontend and backend.

Do Not Use

1. Broad security intake where the correct spoke is still unclear.
2. Vault and PKM storage or encryption-boundary work.
3. Generic backend runtime or deploy work.

Read First

1. docs/reference/iam/README.md
2. docs/reference/iam/architecture.md
3. docs/reference/iam/consent-scope-catalog.md
4. docs/reference/iam/agent-delegation-boundary.md
5. docs/reference/iam/validation-checklist.md
6. .codex/skills/iam-consent-governance/references/anti-rationalization.md

Workflow

1. Confirm whether the change is about actor model, scope catalog, verification gate, or runtime surface.
2. Keep IAM docs, code, and validation checklists aligned in the same change.
3. Treat vault and PKM boundary questions as vault-pkm-governance work when they become primary.

Handoff Rules

1. If the request is still broad or ambiguous, route it back to security-audit.
2. If the task becomes vault or PKM storage-boundary work, use vault-pkm-governance.
3. If the task becomes general backend runtime work, route it to backend.

Required Checks

cd consent-protocol && python3 -m pytest tests/test_granular_scopes.py -q
cd consent-protocol && python3 -m pytest tests/test_ria_iam_routes.py -q