Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Designed for Claude Code, also compatible with Codex and OpenClaw
Clerk Enterprise RBAC
Overview
Implement enterprise-grade role-based access control, organization management, and SSO with Clerk. Covers custom roles and permissions, organization lifecycle, multi-tenant access patterns, SAML/OIDC SSO, and the Backend API for programmatic role management (released Nov 2025).
Prerequisites
Clerk Pro or Enterprise plan (Organizations + SSO require paid plan)
Organizations feature enabled in Clerk Dashboard > Organizations > Settings
Next.js 14+ with App Router (examples use @clerk/nextjs)
Instructions
Step 1: Enable Organizations and Add UI Components
Upload IdP metadata XML from your provider (Okta, Azure AD, Google Workspace)
Map SAML attributes: email, firstName, lastName
// Enforce SSO for specific email domains// Clerk Dashboard > Organizations > Settings > "Verified domains"// Add your company domain (e.g., acme.com)// Users with @acme.com emails will be forced through SSO
Error Handling
Error
Cause
Solution
orgId is null
No active organization
Redirect to org selector, show <OrganizationSwitcher />
has() returns false
Role/permission not assigned
Check assignment in Dashboard > Organizations > Members
Permission denied on middleware
User lacks required role
Verify route matcher maps to correct role
SSO login fails
Misconfigured IdP metadata
Verify ACS URL and Entity ID in IdP settings
Invitation fails
Email already a member
Check membership before inviting
Custom role not visible
Created via API, not Dashboard
Roles created via API are org-scoped, not instance-wide
Enterprise Considerations
Roles and permissions are embedded in the session JWT -- no extra network requests needed for authorization checks
Custom roles created in the Dashboard are instance-wide; roles created via Backend API are organization-scoped
For multi-tenant SaaS, combine Organizations with tenant-scoped database queries (WHERE org_id = :orgId)
Session claims include org_id, org_role, and org_permissions -- available in middleware without API calls
Verified domains + SAML SSO enable "just-in-time provisioning" -- users auto-join the org on first SSO sign-in
Consider the org:sys_* system permissions (sys_memberships:manage, sys_memberships:read, sys_domains:manage) for built-in org management actions