The /review-access-control skill

The skill helps an authorized reviewer map actors, resources, actions, policy inputs, enforcement points, and lifecycle events before reporting access-control weaknesses with evidence.

Maps people, services, agents, resources, actions, and security boundaries.

Checks object, function, field, organization, ownership, sharing, and administrative access.

Separates verified weaknesses from design concerns and unanswered policy questions.

Explains Role-Based, Attribute-Based, and Relationship-Based Access Control in context.

1. 01You are authorized to review a web application or API.
2. 02You need a permission map or authorization threat model.
3. 03You want to investigate IDOR, BOLA, privilege escalation, or organization-isolation risks.
4. 04You want to connect an IAM lab or implementation to vendor-neutral IAM concepts.

An evidence-based access-control review.

A permission map across actors, actions, resources, and conditions.

Clear policy questions when expected behavior is missing.

Durable correction guidance and denied-path regression tests.

A verification plan for important authorization boundaries.

Every conclusion identifies the actor, action, resource, and evidence.

The review distinguishes authentication from authorization.

Unknown business rules remain policy questions instead of invented vulnerabilities.

The result includes allowed and denied verification cases.

The complete instructions are public. Read the skill before you install it, adapt it for your agent if needed, and report issues in the repository.