annatchijova·annatchijova/SKILLS/authorization-surface-mapping/SKILL.md

authorization-surface-mapping

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Build the actor × resource × action matrix a system implicitly claims to enforce, then test the cells it never wrote a test for — because authorization bugs are absences, and you cannot grep for an absence. Use whenever a system has more than one kind of user, more than one tenant, or any object with an owner — multi-tenant SaaS, admin panels, org/team/workspace models, RBAC or ABAC policy, sharing and invitation flows, API keys with scopes, service accounts, feature flags that gate privilege. Trigger on "IDOR", "BOLA", "broken access control", "can user A see user B's data", "tenant isolation", "row-level security", "privilege escalation", "who can access this endpoint", "check permissions", "admin bypass", "scoped token", "impersonation", "we added a role", or a new endpoint that takes an object id. Sibling of invariant-hunting, which follows one property across a transition; this skill enumerates the whole grid so no cell is untested. It maps and tests authorization; it does not design the policy engine.