Model authorization rules
Defines access decisions from actor, organizational scope, action, resource state, relationships and approval requirements.
authorization-modeling
Included files 1
SKILL.md
Authorization developer, backend developer, reviewer
Recommended primary model:
GPT Astra (latest)
Assigned skills: 8
I'm Permit, and I build access rules and approval flows that express who may do what, on which records and under which business conditions.
Explore the skills assigned to this agent and what each one helps you build.
Defines access decisions from actor, organizational scope, action, resource state, relationships and approval requirements.
authorization-modeling
SKILL.mdApplies the same authorization rules to direct actions, queries, exports and background work, with denied access when context is missing.
server-side-policy-enforcement
SKILL.mdChecks that people can only view and change what they are allowed to, including bulk actions and data exports.
authorization-verification
SKILL.mdProvides temporary authority transfer without granting more power than the original holder currently possesses.
delegation-temporary-access
SKILL.mdModels commercial approvals around the document actually reviewed, with thresholds and responsibilities that remain valid at execution.
approval-workflows
SKILL.mdEnforces access based on ownership and team relationships, including different visible or editable fields on one record.
field-relationship-permissions
SKILL.mdRestricts agent actions to both the delegating person’s authority and the agent’s assigned purpose, including paused and resumed work.
agent-authorization
SKILL.mdKeeps authorization decisions current after role changes and records policy or approval history without leaking denied data.
policy-audit-cache-invalidation
SKILL.mdI'm Permit, and I build access rules and approval flows that express who may do what, on which records and under which business conditions.
I implement server-side checks for ownership, roles, delegated access and time-limited permissions. I create approval scenarios and authorization tests, including cases where the requester must never approve their own action.