auditing-access-control

name	auditing-access-control
description	Audit access control implementations for security vulnerabilities and misconfigurations. Use when reviewing authentication and authorization. Trigger with 'audit access control', 'check permissions', or 'validate authorization'.
version	1.24.0
allowed-tools	Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["security","authentication","audit"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Access Control Auditing

Overview

Audit access control implementations across codebases, cloud configurations, and application layers for security vulnerabilities and policy violations. This skill targets IAM policies, ACLs, RBAC configurations, file permissions, and API authorization logic to identify privilege escalation paths, overly permissive grants, and violations of the principle of least privilege.

Prerequisites

• Access to the target codebase and configuration files in ${CLAUDE_SKILL_DIR}/
• Familiarity with the authorization model in use (RBAC, ABAC, ACL, or IAM)
• grep, find, and standard shell utilities available via Bash
• For cloud audits: CLI tools such as aws iam, gcloud, or az role installed and authenticated
• Reference: ${CLAUDE_SKILL_DIR}/references/README.md for IAM best practices, ACL vulnerability patterns, and NIST/GDPR access control standards

Instructions

1. Enumerate all access control definitions by scanning for IAM policy files, RBAC configuration, ACL definitions, middleware authorization checks, and .htaccess or equivalent files using Glob and Grep.
2. Map each role or principal to its granted permissions, building a permission matrix that identifies which subjects access which resources at which privilege level.
3. Evaluate each permission grant against the principle of least privilege -- flag any wildcard permissions (*), overly broad resource scopes, or administrative access granted to non-admin roles.
4. Check for separation of duties violations where a single role combines mutually exclusive privileges (e.g., both "create user" and "approve user").
5. Identify privilege escalation paths by tracing role inheritance chains, looking for roles that can modify their own permissions or assume higher-privileged roles.
6. Inspect API route handlers and middleware for missing or inconsistent authorization checks -- compare route definitions against their corresponding auth guards.
7. Verify that default-deny is enforced: confirm that unauthenticated or unauthorized requests are rejected unless explicitly allowed.
8. Cross-reference findings against compliance requirements (NIST AC-1 through AC-25, GDPR Article 25, SOC 2 CC6.1) and flag gaps.
9. Classify each finding by severity (critical, high, medium, low) based on exploitability and blast radius.
10. Generate a remediation plan with specific configuration changes, code patches, or policy updates for each finding.

Output