← Back to Bevy · project planning pack
See how it helps
Review authorization and tenant boundaries
Reviews who may read or change player, guild and game-workspace data. Follows permissions through nested identifiers, downloads and live events instead of trusting hidden interface controls.
authorization-tenant-boundary-review
Agents using this skill
When is it useful?
Use when reviewing an API, job or export that accesses customer data.
What does it help you do?
- Checks nested identifiers as well as the resource named in the URL.
- Reviews lists, caches and live channels for cross-workspace exposure.
- Finds writable privileged fields and unauthorized sensitive response fields.
Try asking this
Review a guild-inventory transfer endpoint. Try a valid guild member, a former member and a request that substitutes an item ID from another guild. Trace database queries and emitted events; rejected transfers must leave both inventories unchanged and reveal no private guild contents.
Detailed documentation
Read the skill’s original instructions, examples and checks in their authored language.
Show less
Authorization & Tenant Boundary Review
Use this skill during specification and code review to verify that every read, write, list, export, and background operation enforces identity, workspace membership, and action permissions on the server.
Workflow
- Check the three-part access control invariant on every entry point:
- Verify that every new or modified route, RPC handler, or job checks:
- Authentication: Who is the caller?
- Tenant / Workspace scope: Does the caller belong to the active workspace, and does the target resource belong to that exact same workspace (
WHERE id = ? AND workspace_id = ?)? - Action & resource permission: Does the caller's role, ownership, or approval state permit this specific operation on this specific resource state?
- Verify that every new or modified route, RPC handler, or job checks:
- Spot Indirect Object Reference (IDOR) and cross-tenant leaks:
- Check nested IDs in request bodies (
projectId,assigneeId,parentId,attachmentId,templateId): never verify only the top-level URL parameter while allowing the body to link or copy a record belonging to another tenant! - Check list, search, aggregation, and export queries to ensure every query is scoped by
tenant_id/workspace_id. - Check cache keys, pub/sub channels, and SSE/WebSocket streams to ensure events for Tenant A are never broadcast to connections held by Tenant B.
- Check nested IDs in request bodies (
- Verify field-level and state-dependent restrictions:
- Confirm that read-only or restricted fields (e.g.,
role,status,approvedBy,internalNotes,priceOverride) cannot be mass-assigned by standard users on create/update endpoints, and sensitive fields are stripped from unauthorized responses. - Route deep policy-engine or cryptographic security questions to the authorization and security specialists.
- Confirm that read-only or restricted fields (e.g.,
Included files 1
SKILL.md