internal-azure-governance

星标1

分支0

更新时间2026年8月1日 21:32

Use when /internal-azure selects Azure authorization, workload identity, privileged access, Policy, guardrail, or exception work.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

来源

pagopa

pagopa/cloud-strategy.github

打开 GitHub 仓库查看创作者相关仓库

下载

Internal Azure Governance

Use this workflow to define auditable Azure identity, access, and guardrail decisions.

When to use

Use when /internal-azure selects an Azure governance deliverable involving RBAC, workload identity, PIM/PAM, Policy, tagging, or exceptions.

Workflow

State the governance objective: the access, prevention, detection, or privileged-elevation outcome required.
Set the control scope: management group, subscription set, subscription, or resource, with the affected principals and workloads.
Design the authorization model and distinguish grants, preventive controls, detective controls, workload identity, and privileged elevation.
Define the exception path with an owner, business reason, compensating control, expiry or review date, and audit evidence.
Stage the rollout with a safe scope, compliance or access checks, rollback triggers, and evidence collection.
Apply the completion criteria: scope is explicit, controls are classified, authorization is least-privilege, exceptions are reviewable, and rollout evidence is recorded.

Azure governance patterns

Use Azure Policy and initiatives for preventive or detective guardrails.
Use RBAC role assignments for authorization with explicit scope.
Use managed identities or federation for workload access and keep runtime identity separate from human access grants.
Use PIM or PAM for time-bound, approved, and reviewable elevation.
Use naming and tagging controls when metadata consistency is part of the governance objective.

Current facts

Use current Microsoft documentation when the recommendation depends on Azure RBAC semantics, managed identity support, Policy effects, or privileged-access behavior.

Load references/guardrail-map.md for control patterns, identity examples, and exception evidence.

Completion criteria

Return the governance objective, control scope, recommended mechanism, exception path, rollout evidence, and remaining validation risks.

同仓库更多 Skills

同仓库

anthropic-docx

pagopa/cloud-strategy.github

Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx or .dotx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.

2026-08-011

internal-agent-creator

pagopa/cloud-strategy.github

Use when creating, reviewing, or materially revising a repository-owned Copilot agent under `.github/agents/`.

2026-08-011

internal-aws-governance

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS governance lane for IAM operating models, trust policies, federation, permission boundaries, SCPs, tag policies, exception controls, or access guardrails.

2026-08-011

internal-aws-lambda

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS Lambda lane for handlers, event sources, runtimes, packaging, retries, concurrency, cold starts, or Lambda-specific configuration.

2026-08-011

internal-aws-mcp-research

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS research lane to retrieve current official AWS documentation, regional availability, service behavior, IAM state, or policy-simulation evidence.

2026-08-011

internal-aws-operations

pagopa/cloud-strategy.github

Use when /internal-aws selects the AWS operations lane for monitoring, logging, rollout validation, backup and restore proof, DR evidence, reporting, or audit evidence.

2026-08-011

Internal Azure Governance

Use this workflow to define auditable Azure identity, access, and guardrail decisions.

When to use

Use when /internal-azure selects an Azure governance deliverable involving RBAC, workload identity, PIM/PAM, Policy, tagging, or exceptions.

Workflow

State the governance objective: the access, prevention, detection, or privileged-elevation outcome required.

Set the control scope: management group, subscription set, subscription, or resource, with the affected principals and workloads.

Design the authorization model and distinguish grants, preventive controls, detective controls, workload identity, and privileged elevation.

Define the exception path with an owner, business reason, compensating control, expiry or review date, and audit evidence.

Stage the rollout with a safe scope, compliance or access checks, rollback triggers, and evidence collection.

Apply the completion criteria: scope is explicit, controls are classified, authorization is least-privilege, exceptions are reviewable, and rollout evidence is recorded.

Azure governance patterns

Use Azure Policy and initiatives for preventive or detective guardrails.

Use RBAC role assignments for authorization with explicit scope.

Use managed identities or federation for workload access and keep runtime identity separate from human access grants.

Use PIM or PAM for time-bound, approved, and reviewable elevation.

Use naming and tagging controls when metadata consistency is part of the governance objective.

Current facts

Use current Microsoft documentation when the recommendation depends on Azure RBAC semantics, managed identity support, Policy effects, or privileged-access behavior.

Load references/guardrail-map.md for control patterns, identity examples, and exception evidence.

Completion criteria

Return the governance objective, control scope, recommended mechanism, exception path, rollout evidence, and remaining validation risks.

name	internal-azure-governance
description	Use when /internal-azure selects Azure authorization, workload identity, privileged access, Policy, guardrail, or exception work.