| name | idmp-user-access |
| description | IDMP user-access skill. Use it to inspect users, roles, permission groups, assignable roles, and granted roles while keeping current-user reads separate from admin paginated user lists. |
| metadata | {"author":"TaosData","version":"0.4.0","owner_team":"AI","requires":{"bins":["idmp-cli"]},"cliHelp":"idmp-cli user --help"} |
user / role / permission
Read ../idmp-shared/SKILL.md first.
What this skill covers
- Read current-user context, paginated admin user views, roles, permission groups, and safe authorization previews.
- Keep current-user inspection separate from directory-wide admin surfaces.
Recommended reference
Missing context to resolve first
- Admin visibility.
- Permission group seed.
- Whether the request is about the current user, a directory user, a role, or a permission scope.
- Whether the operator only needs a dry-run preview or a real mutation.
- Which scope, group, or role ID is already known.
Constrained live behaviors
user users list returns the current-user object.permission users assignable and permission roles list-get can return structured 403.role roles create requires a non-empty permissionGroupIds list.user users list is the current-user surface; user page list is the paginated directory view.- Role and permission reads can succeed even when grant previews are permission-bound.
- Keep
--dry-run --ack-risk on grant previews until the operator explicitly wants a real mutation.
Execution flow
- Start with
idmp-cli user users list to separate current-user context from directory-wide admin views.
- Use
idmp-cli user page list --params only when the task really needs admin directory scope.
- Pair role detail with
idmp-cli permission groups list before any grant preview or temporary role create.
- Keep authorization work on
permission policy grant-post --dry-run --ack-risk --params until the operator explicitly wants a real mutation.
- If a temporary role must be created, reread it and pair the create with a delete cleanup step in the same workflow.
Evidence of completion
- A current-user answer is only complete when it comes from
user users list, not from a guessed admin directory row.
- A permission boundary is still valid evidence when the backend returns a structured 403 for assignable or granted-role reads.
- A temporary-role workflow is only complete when both the reread and the delete cleanup succeed.
Key commands
idmp-cli user users list for the current-user shape.idmp-cli user page list --params for the admin directory view.idmp-cli user users get --params to inspect a specific user.idmp-cli role roles get --params to inspect one role deeply.idmp-cli permission groups list to enumerate reusable permission bundles.idmp-cli permission policy grant-post --dry-run --ack-risk --params to preview authorization safely.idmp-cli role roles create --ack-risk --data when a temporary custom role is really needed.idmp-cli role roles delete --ack-risk --params to remove that temporary role after verification.
Exception paths
- If paginated admin reads are forbidden, do not infer that the current-user surface is also broken.
- Stop at dry-run when the operator has not explicitly requested a real grant.
- Clean up any temporary custom role you create.
Validation scenarios
1. Current-user shape
Use idmp-cli user users list first. This should answer “who am I” questions without requiring admin directory access.
2. Admin directory view
Use idmp-cli user page list --params for scoped directory inspection. Treat permission failures here as directory-boundary evidence, not a total auth failure.
3. Role and permission-group context
Pair idmp-cli role roles get --params with idmp-cli permission groups list. The answer should explain both role detail and reusable permission groups.
4. Safe grant preview
Use idmp-cli permission policy grant-post --dry-run --ack-risk --params before any real grant. A dry-run failure is still useful boundary evidence.
5. Temporary custom-role lifecycle
If you must mutate, pair idmp-cli role roles create --ack-risk --data with idmp-cli role roles delete --ack-risk --params. Build a temporary custom role with one real permission group, reread it, then delete it.
