stefanofusai

Scaffold a new authenticated, owner-scoped API resource (model, schemas, ninja-extra controller, admin, migration, factory, tests) following this project's AGENTS.md conventions. Use when adding a new REST resource / endpoint / CRUD app. Trigger: "new resource", "add an endpoint", "new model API".

Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".