j4flmao/agent-skills/rbac

RBAC and OIDC Integration

Purpose

Comprehensive Role-Based Access Control with OIDC flow integration.

Core Principles

1. Principle of least privilege
2. Secure token validation
3. Strict policy enforcement
4. Auditability of access
5. Separation of duties

Agent Protocol

Triggers: Access requests Input Context Required: User identity, requested resource, action Output Artifact: Access decision Response Formats:

{
  "allowed": true,
  "reason": "Role has permission"
}

Decision Matrix

[Request] -> [Check Token] -> [Extract Roles] -> [Evaluate Policy] -> [Decision]

Detailed Architectural Overview

Client -> API Gateway -> RBAC Service -> Policy DB
                         |
                         v
                    OIDC Provider

Workflow Steps

Phase 1: Initialization

1. Load policies
2. Connect to DB
3. Init cache

Phase 2: Token Validation

1. Parse JWT
2. Verify signature
3. Check expiry

Phase 3: Role Extraction

1. Get claims
2. Map to roles
3. Resolve hierarchy

Phase 4: Policy Evaluation

1. Find matching policies
2. Check conditions
3. Calculate final decision

Phase 5: Audit Logging

1. Format log entry
2. Add context
3. Write to stream

Phase 6: Response

1. Format response
2. Add headers
3. Send to client

Extended Troubleshooting Guide

Complete Execution Scenario

Request -> Valid Token -> Role Admin -> Allow Action

Rules and Guidelines

1. Always validate tokens first
2. Fail closed on errors
3. Log all access decisions
4. Cache policies for performance
5. Regularly review role mappings

Reference Guides

1. RBAC Fundamentals
2. RBAC Advanced
3. Role Engineering
4. RBAC Migration
5. Framework Integration
6. Enterprise Org Structure
7. Admin & Break-Glass Access
8. Temporary Delegation Workflows

Handoff

Refer to auth skill. <!-- compression footer -->

References

Shared References

Additional reference material for this skill, stored outside its own references/ folder.

• ../iam-governance/references/access-certification.md — Access Certification
• ../iam-governance/references/iam-governance-advanced.md — IAM Governance Advanced Topics
• ../iam-governance/references/iam-governance-fundamentals.md — IAM Governance Fundamentals
• ../iam-governance/references/iam-policy-as-code.md — IAM Policy as Code
• ../iam-governance/references/identity-lifecycle.md — Identity Lifecycle Management
• ../iam-governance/references/privileged-access-management.md — Privileged Access Management (PAM)
• ../iam-governance/references/privileged-access.md — Privileged Access Management (PAM)
• ../iam-governance/references/sso-federation.md — SSO and Federation