| name | authorization-boundary-skill |
| description | Implement or review backend authentication, authorization, tenancy, secret, and untrusted-input boundaries without trusting caller-supplied identity or scope. |
| allowed-tools | ["read_file","list_dir","grep_search","glob_files","write_file","edit_file","apply_patch","lsp","run_command","artifact_write"] |
Authorization and trust boundaries
Overview
Derive identity and scope from a trusted server context, then authorize the
specific action against the specific resource. Authentication proves a caller;
authorization decides whether that caller may perform this operation here.
When to Use
Use for login, sessions, tokens, API keys, RBAC, permissions, organization or
tenant scope, ownership checks, secret handling, webhooks, uploads, and any
boundary that accepts untrusted data.
Workflow
- Map trust boundaries from ingress to side effect. Mark which identity,
tenant, role, resource, and policy values are server-derived versus
caller-controlled.
- Authenticate once at the boundary using the established mechanism. Reject
ambiguous, expired, malformed, replayed, or wrong-audience credentials
without exposing secret material.
- Authorize the exact action and resource after loading server-trusted scope.
Apply deny-first behavior and prevent confused-deputy or cross-tenant paths.
- Validate and cap untrusted text, paths, URLs, filenames, identifiers, and
structured payloads before parsing, lookup, logging, or persistence.
- Keep secrets write-only and redact them from errors, logs, traces, caches,
prompts, analytics, and returned configuration.
- Test allowed, denied, missing, malformed, stale, replayed, and cross-scope
cases at the real boundary.
Verification
Red Flags
- Trusting
userId, orgId, role, or ownership supplied in a request body.
- Checking authentication but not resource authorization.
- Logging full headers, tokens, connection strings, or raw untrusted payloads.
- A fallback path that bypasses the normal policy chokepoint.
