Skill: backend/authz-policy

Skill: backend/authz-policy

Purpose

Define and enforce authorization policy so protected actions are:

• explicitly allowed/denied by rule
• consistently enforced at boundaries
• tested (cannot regress silently)
• auditable when required

This skill is about authorization (authz), not authentication (authn).

Inputs

• Protected action(s) (what is being guarded)
• Actors/roles (who is allowed)
• Resources (what is being accessed or modified)
• Constraints:
  • tenant boundaries
  • ownership rules
  • admin overrides
• Repo profile (preferred): <repo>/REPO_PROFILE.json

Outputs

• Policy definition:
  • rule function(s) or policy module (repo convention)
• Enforcement:
  • middleware/guard checks applied at the correct boundary
• Error behavior:
  • consistent deny response and error mapping
• Tests:
  • allow path
  • deny path
  • at least one edge case (missing role, wrong tenant, etc.)
• Optional: audit hook notes if action is sensitive