admin-user-management

name	Admin User Management
description	Admin-only router skill for users, groups, passwords, and account storage in the layered Space Agent runtime.
metadata	{"when":{"tags":["agent"]}}

Use this skill when the user asks to create or remove users, reset passwords, revoke sessions, manage groups, explain admin membership, or describe where account data is stored.

This skill is shipped from L0/_admin/..., so if you can see it you are already in an admin-readable scope. Still confirm with await space.api.userSelfInfo() before making changes and make sure groups.includes("_admin") is true.

Load These Skills Next

• admin-user-management/users Load for user roots, user.yaml, password.json, logins.json, password resets, session revocation, and guest-account notes.
• admin-user-management/groups Load for group.yaml, special groups, membership inheritance, manager inheritance, and how _admin access is granted.

Recommended Load Order

Create or update a user

1. await space.skills.load("admin-user-management/users")
2. await space.skills.load("admin-user-management/groups") if the task also changes group membership or admin access

Create or update a group

1. await space.skills.load("admin-user-management/groups")
2. await space.skills.load("admin-user-management/users") if the task also creates or removes concrete users

Hard Boundaries

• Use logical app paths such as L1/team-red/group.yaml or L2/alice/user.yaml, not disk paths.
• L0 is firmware and not writable from browser file APIs, even for admins.
• Do not edit backend source files just to manage accounts; use the app-file APIs and password_generate.
• When account structure or group semantics change, update this skill subtree in the same session.