[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F69QT4G2FA66RCY5ZPV30H":3,"skill-same:01M6F69QT4G2FA66RCY5ZPV30H":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6F69QT4G2FA66RCY5ZPV30H","deepgram-enterprise-rbac",null,"Configure enterprise role-based access control for Deepgram integrations.\nUse when implementing team permissions, managing API key scopes,\nor setting up organization-level access controls.\nTrigger with phrases like \"deepgram RBAC\", \"deepgram permissions\",\n\"deepgram access control\", \"deepgram team roles\", \"deepgram enterprise\".","Dicklesworthstone\u002Fpi_agent_rust","Dicklesworthstone","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F35050222?v=4","01M6CG26AR942CSVMN1M5E3DSE","Jeff Emanuel","01M6CG26EPP71PSHW1VDS71121",1986,"MIT","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fdeepgram-pack\u002Fskills\u002Fdeepgram-enterprise-rbac\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"Enterprise","deepgram enterprise rbac","deepgram","rbac","use","when","implementing","with","controls","trigger","io","roles","control","Access Control","organization","up","edit","write","read","integrations","configure","access","Bash","team","api","kubectl","permissions","2026-11-10 10:12:30",false,"---\nname: deepgram-enterprise-rbac\ndescription: |\n  Configure enterprise role-based access control for Deepgram integrations.\n  Use when implementing team permissions, managing API key scopes,\n  or setting up organization-level access controls.\n  Trigger with phrases like \"deepgram RBAC\", \"deepgram permissions\",\n  \"deepgram access control\", \"deepgram team roles\", \"deepgram enterprise\".\nallowed-tools: Read, Write, Edit, Bash(kubectl:*), Bash(curl:*)\nversion: 1.0.0\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\n---\n\n# Deepgram Enterprise RBAC\n\n## Overview\nImplement role-based access control for enterprise Deepgram deployments with team management and scoped permissions.\n\n## Prerequisites\n- Deepgram enterprise account\n- Multiple projects configured\n- Team management system\n- Audit logging enabled\n\n## Deepgram Permission Scopes\n\n| Scope | Description | Use Case |\n|-------|-------------|----------|\n| `listen:*` | All transcription operations | Production services |\n| `manage:*` | All management operations | Admin users |\n| `usage:read` | View usage data | Billing team |\n| `usage:write` | Modify usage | Service accounts |\n| `keys:read` | View API keys | Security audits |\n| `keys:write` | Create\u002Fdelete keys | Admin users |\n\n## Role Definitions\n\n```typescript\n\u002F\u002F config\u002Froles.ts\nexport interface Role {\n  name: string;\n  description: string;\n  deepgramScopes: string[];\n  appPermissions: string[];\n}\n\nexport const roles: Record\u003Cstring, Role> = {\n  admin: {\n    name: 'Administrator',\n    description: 'Full access to all Deepgram resources',\n    deepgramScopes: ['manage:*', 'listen:*', 'usage:*', 'keys:*'],\n    appPermissions: ['*'],\n  },\n  developer: {\n    name: 'Developer',\n    description: 'Transcription and development access',\n    deepgramScopes: ['listen:*', 'usage:read'],\n    appPermissions: [\n      'transcription:create',\n      'transcription:read',\n      'projects:read',\n    ],\n  },\n  analyst: {\n    name: 'Analyst',\n    description: 'Read-only access to transcriptions and usage',\n    deepgramScopes: ['usage:read'],\n    appPermissions: [\n      'transcription:read',\n      'usage:read',\n      'reports:read',\n    ],\n  },\n  service: {\n    name: 'Service Account',\n    description: 'Automated service access',\n    deepgramScopes: ['listen:*'],\n    appPermissions: [\n      'transcription:create',\n      'transcription:read',\n    ],\n  },\n  auditor: {\n    name: 'Auditor',\n    description: 'Security and compliance access',\n    deepgramScopes: ['usage:read', 'keys:read'],\n    appPermissions: [\n      'audit:read',\n      'usage:read',\n      'keys:read',\n    ],\n  },\n};\n```\n\n## Implementation\n\n### RBAC Service\n```typescript\n\u002F\u002F services\u002Frbac.ts\nimport { createClient } from '@deepgram\u002Fsdk';\nimport { roles, Role } from '..\u002Fconfig\u002Froles';\nimport { db } from '.\u002Fdatabase';\n\ninterface User {\n  id: string;\n  email: string;\n  role: string;\n  teamId: string;\n  apiKeyId?: string;\n}\n\ninterface Team {\n  id: string;\n  name: string;\n  projectId: string;\n  members: string[];\n}\n\nexport class RBACService {\n  private adminClient;\n\n  constructor(adminApiKey: string) {\n    this.adminClient = createClient(adminApiKey);\n  }\n\n  async createUserApiKey(user: User): Promise\u003Cstring> {\n    const role = roles[user.role];\n    if (!role) {\n      throw new Error(`Unknown role: ${user.role}`);\n    }\n\n    const team = await db.teams.findOne({ id: user.teamId });\n    if (!team) {\n      throw new Error(`Team not found: ${user.teamId}`);\n    }\n\n    \u002F\u002F Create scoped API key\n    const { result, error } = await this.adminClient.manage.createProjectKey(\n      team.projectId,\n      {\n        comment: `User: ${user.email} | Role: ${role.name}`,\n        scopes: role.deepgramScopes,\n        expiration_date: this.getExpirationDate(role),\n      }\n    );\n\n    if (error) throw error;\n\n    \u002F\u002F Store key reference (not the key itself)\n    await db.users.updateOne(\n      { id: user.id },\n      { $set: { apiKeyId: result.key_id } }\n    );\n\n    \u002F\u002F Log key creation\n    await this.auditLog('KEY_CREATED', user.id, {\n      keyId: result.key_id,\n      role: user.role,\n      scopes: role.deepgramScopes,\n    });\n\n    return result.key;\n  }\n\n  async revokeUserApiKey(userId: string): Promise\u003Cvoid> {\n    const user = await db.users.findOne({ id: userId });\n    if (!user?.apiKeyId) return;\n\n    const team = await db.teams.findOne({ id: user.teamId });\n    if (!team) return;\n\n    await this.adminClient.manage.deleteProjectKey(\n      team.projectId,\n      user.apiKeyId\n    );\n\n    await db.users.updateOne(\n      { id: userId },\n      { $unset: { apiKeyId: '' } }\n    );\n\n    await this.auditLog('KEY_REVOKED', userId, {\n      keyId: user.apiKeyId,\n    });\n  }\n\n  async checkPermission(\n    userId: string,\n    permission: string\n  ): Promise\u003Cboolean> {\n    const user = await db.users.findOne({ id: userId });\n    if (!user) return false;\n\n    const role = roles[user.role];\n    if (!role) return false;\n\n    \u002F\u002F Check wildcard\n    if (role.appPermissions.includes('*')) return true;\n\n    \u002F\u002F Check specific permission\n    return role.appPermissions.includes(permission);\n  }\n\n  async updateUserRole(userId: string, newRole: string): Promise\u003Cvoid> {\n    const role = roles[newRole];\n    if (!role) {\n      throw new Error(`Unknown role: ${newRole}`);\n    }\n\n    const user = await db.users.findOne({ id: userId });\n    if (!user) {\n      throw new Error(`User not found: ${userId}`);\n    }\n\n    \u002F\u002F Revoke old key\n    if (user.apiKeyId) {\n      await this.revokeUserApiKey(userId);\n    }\n\n    \u002F\u002F Update role\n    await db.users.updateOne(\n      { id: userId },\n      { $set: { role: newRole } }\n    );\n\n    \u002F\u002F Create new key with new scopes\n    await this.createUserApiKey({ ...user, role: newRole });\n\n    await this.auditLog('ROLE_CHANGED', userId, {\n      oldRole: user.role,\n      newRole,\n    });\n  }\n\n  private getExpirationDate(role: Role): Date {\n    const days = role.name === 'Service Account' ? 90 : 365;\n    const date = new Date();\n    date.setDate(date.getDate() + days);\n    return date;\n  }\n\n  private async auditLog(\n    action: string,\n    userId: string,\n    details: Record\u003Cstring, unknown>\n  ): Promise\u003Cvoid> {\n    await db.auditLog.insertOne({\n      timestamp: new Date(),\n      action,\n      userId,\n      details,\n    });\n  }\n}\n```\n\n### Permission Middleware\n```typescript\n\u002F\u002F middleware\u002Fauthorization.ts\nimport { Request, Response, NextFunction } from 'express';\nimport { RBACService } from '..\u002Fservices\u002Frbac';\n\nconst rbac = new RBACService(process.env.DEEPGRAM_ADMIN_KEY!);\n\nexport function requirePermission(permission: string) {\n  return async (req: Request, res: Response, next: NextFunction) => {\n    const userId = req.user?.id;\n\n    if (!userId) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n\n    const hasPermission = await rbac.checkPermission(userId, permission);\n\n    if (!hasPermission) {\n      return res.status(403).json({\n        error: 'Forbidden',\n        message: `Missing permission: ${permission}`,\n      });\n    }\n\n    next();\n  };\n}\n\n\u002F\u002F Usage in routes\napp.post(\n  '\u002Ftranscribe',\n  requirePermission('transcription:create'),\n  transcribeHandler\n);\n\napp.get(\n  '\u002Fusage',\n  requirePermission('usage:read'),\n  usageHandler\n);\n\napp.post(\n  '\u002Fadmin\u002Fkeys',\n  requirePermission('keys:write'),\n  createKeyHandler\n);\n```\n\n### Team Management\n```typescript\n\u002F\u002F services\u002Fteams.ts\nimport { RBACService } from '.\u002Frbac';\nimport { db } from '.\u002Fdatabase';\n\ninterface CreateTeamRequest {\n  name: string;\n  projectId: string;\n  adminUserId: string;\n}\n\nexport class TeamService {\n  private rbac: RBACService;\n\n  constructor(rbac: RBACService) {\n    this.rbac = rbac;\n  }\n\n  async createTeam(request: CreateTeamRequest): Promise\u003Cstring> {\n    const teamId = crypto.randomUUID();\n\n    \u002F\u002F Create team\n    await db.teams.insertOne({\n      id: teamId,\n      name: request.name,\n      projectId: request.projectId,\n      members: [request.adminUserId],\n      createdAt: new Date(),\n    });\n\n    \u002F\u002F Set admin as team admin\n    await db.users.updateOne(\n      { id: request.adminUserId },\n      { $set: { teamId, role: 'admin' } }\n    );\n\n    \u002F\u002F Create API key for admin\n    const user = await db.users.findOne({ id: request.adminUserId });\n    if (user) {\n      await this.rbac.createUserApiKey(user);\n    }\n\n    return teamId;\n  }\n\n  async addMember(\n    teamId: string,\n    userId: string,\n    role: string\n  ): Promise\u003Cvoid> {\n    \u002F\u002F Update team\n    await db.teams.updateOne(\n      { id: teamId },\n      { $addToSet: { members: userId } }\n    );\n\n    \u002F\u002F Update user\n    await db.users.updateOne(\n      { id: userId },\n      { $set: { teamId, role } }\n    );\n\n    \u002F\u002F Create API key\n    const user = await db.users.findOne({ id: userId });\n    if (user) {\n      await this.rbac.createUserApiKey(user);\n    }\n  }\n\n  async removeMember(teamId: string, userId: string): Promise\u003Cvoid> {\n    \u002F\u002F Revoke API key\n    await this.rbac.revokeUserApiKey(userId);\n\n    \u002F\u002F Remove from team\n    await db.teams.updateOne(\n      { id: teamId },\n      { $pull: { members: userId } }\n    );\n\n    \u002F\u002F Clear user team\n    await db.users.updateOne(\n      { id: userId },\n      { $unset: { teamId: '', role: '' } }\n    );\n  }\n\n  async getTeamUsage(teamId: string): Promise\u003C{\n    totalMinutes: number;\n    byMember: Array\u003C{ userId: string; minutes: number }>;\n  }> {\n    const team = await db.teams.findOne({ id: teamId });\n    if (!team) throw new Error('Team not found');\n\n    const usage = await db.usage.aggregate([\n      { $match: { userId: { $in: team.members } } },\n      {\n        $group: {\n          _id: '$userId',\n          minutes: { $sum: '$audioMinutes' },\n        },\n      },\n    ]).toArray();\n\n    return {\n      totalMinutes: usage.reduce((sum, u) => sum + u.minutes, 0),\n      byMember: usage.map(u => ({\n        userId: u._id,\n        minutes: u.minutes,\n      })),\n    };\n  }\n}\n```\n\n### API Key Rotation\n```typescript\n\u002F\u002F services\u002Fkey-rotation.ts\nimport { RBACService } from '.\u002Frbac';\nimport { db } from '.\u002Fdatabase';\n\nexport class KeyRotationService {\n  private rbac: RBACService;\n\n  constructor(rbac: RBACService) {\n    this.rbac = rbac;\n  }\n\n  async rotateExpiredKeys(): Promise\u003C{\n    rotated: number;\n    failed: number;\n  }> {\n    const stats = { rotated: 0, failed: 0 };\n\n    \u002F\u002F Find users with keys expiring soon\n    const expiringUsers = await db.users.find({\n      keyExpiration: {\n        $lt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), \u002F\u002F 7 days\n      },\n    }).toArray();\n\n    for (const user of expiringUsers) {\n      try {\n        \u002F\u002F Revoke old key\n        await this.rbac.revokeUserApiKey(user.id);\n\n        \u002F\u002F Create new key\n        await this.rbac.createUserApiKey(user);\n\n        \u002F\u002F Notify user\n        await this.notifyKeyRotation(user);\n\n        stats.rotated++;\n      } catch (error) {\n        console.error(`Failed to rotate key for ${user.id}:`, error);\n        stats.failed++;\n      }\n    }\n\n    return stats;\n  }\n\n  private async notifyKeyRotation(user: any): Promise\u003Cvoid> {\n    \u002F\u002F Send email notification\n    \u002F\u002F Implementation depends on your notification system\n  }\n}\n```\n\n### Admin Dashboard API\n```typescript\n\u002F\u002F routes\u002Fadmin.ts\nimport express from 'express';\nimport { requirePermission } from '..\u002Fmiddleware\u002Fauthorization';\nimport { RBACService } from '..\u002Fservices\u002Frbac';\nimport { TeamService } from '..\u002Fservices\u002Fteams';\n\nconst router = express.Router();\nconst rbac = new RBACService(process.env.DEEPGRAM_ADMIN_KEY!);\nconst teams = new TeamService(rbac);\n\n\u002F\u002F List all users\nrouter.get(\n  '\u002Fusers',\n  requirePermission('admin:users:read'),\n  async (req, res) => {\n    const users = await db.users.find({}).toArray();\n    res.json({ users });\n  }\n);\n\n\u002F\u002F Update user role\nrouter.patch(\n  '\u002Fusers\u002F:id\u002Frole',\n  requirePermission('admin:users:write'),\n  async (req, res) => {\n    const { role } = req.body;\n    await rbac.updateUserRole(req.params.id, role);\n    res.json({ success: true });\n  }\n);\n\n\u002F\u002F Create team\nrouter.post(\n  '\u002Fteams',\n  requirePermission('admin:teams:write'),\n  async (req, res) => {\n    const teamId = await teams.createTeam(req.body);\n    res.json({ teamId });\n  }\n);\n\n\u002F\u002F Get team usage\nrouter.get(\n  '\u002Fteams\u002F:id\u002Fusage',\n  requirePermission('admin:usage:read'),\n  async (req, res) => {\n    const usage = await teams.getTeamUsage(req.params.id);\n    res.json(usage);\n  }\n);\n\n\u002F\u002F Rotate API key\nrouter.post(\n  '\u002Fusers\u002F:id\u002Frotate-key',\n  requirePermission('admin:keys:write'),\n  async (req, res) => {\n    await rbac.revokeUserApiKey(req.params.id);\n    const user = await db.users.findOne({ id: req.params.id });\n    if (user) {\n      const newKey = await rbac.createUserApiKey(user);\n      res.json({ success: true, keyCreated: true });\n    } else {\n      res.status(404).json({ error: 'User not found' });\n    }\n  }\n);\n\nexport default router;\n```\n\n## Resources\n- [Deepgram API Key Management](https:\u002F\u002Fdevelopers.deepgram.com\u002Fdocs\u002Fapi-key-management)\n- [Project Management](https:\u002F\u002Fdevelopers.deepgram.com\u002Fdocs\u002Fprojects)\n- [Enterprise Features](https:\u002F\u002Fdeepgram.com\u002Fenterprise)\n\n## Next Steps\nProceed to `deepgram-migration-deep-dive` for complex migration scenarios.\n","# Deepgram Enterprise RBAC\n\n## Overview\nImplement role-based access control for enterprise Deepgram deployments with team management and scoped permissions.\n\n## Prerequisites\n- Deepgram enterprise account\n- Multiple projects configured\n- Team management system\n- Audit logging enabled\n\n## Deepgram Permission Scopes\n\n| Scope | Description | Use Case |\n|-------|-------------|----------|\n| `listen:*` | All transcription operations | Production services |\n| `manage:*` | All management operations | Admin users |\n| `usage:read` | View usage data | Billing team |\n| `usage:write` | Modify usage | Service accounts |\n| `keys:read` | View API keys | Security audits |\n| `keys:write` | Create\u002Fdelete keys | Admin users |\n\n## Role Definitions\n\n```typescript\n\u002F\u002F config\u002Froles.ts\nexport interface Role {\n  name: string;\n  description: string;\n  deepgramScopes: string[];\n  appPermissions: string[];\n}\n\nexport const roles: Record\u003Cstring, Role> = {\n  admin: {\n    name: 'Administrator',\n    description: 'Full access to all Deepgram resources',\n    deepgramScopes: ['manage:*', 'listen:*', 'usage:*', 'keys:*'],\n    appPermissions: ['*'],\n  },\n  developer: {\n    name: 'Developer',\n    description: 'Transcription and development access',\n    deepgramScopes: ['listen:*', 'usage:read'],\n    appPermissions: [\n      'transcription:create',\n      'transcription:read',\n      'projects:read',\n    ],\n  },\n  analyst: {\n    name: 'Analyst',\n    description: 'Read-only access to transcriptions and usage',\n    deepgramScopes: ['usage:read'],\n    appPermissions: [\n      'transcription:read',\n      'usage:read',\n      'reports:read',\n    ],\n  },\n  service: {\n    name: 'Service Account',\n    description: 'Automated service access',\n    deepgramScopes: ['listen:*'],\n    appPermissions: [\n      'transcription:create',\n      'transcription:read',\n    ],\n  },\n  auditor: {\n    name: 'Auditor',\n    description: 'Security and compliance access',\n    deepgramScopes: ['usage:read', 'keys:read'],\n    appPermissions: [\n      'audit:read',\n      'usage:read',\n      'keys:read',\n    ],\n  },\n};\n```\n\n## Implementation\n\n### RBAC Service\n```typescript\n\u002F\u002F services\u002Frbac.ts\nimport { createClient } from '@deepgram\u002Fsdk';\nimport { roles, Role } from '..\u002Fconfig\u002Froles';\nimport { db } from '.\u002Fdatabase';\n\ninterface User {\n  id: string;\n  email: string;\n  role: string;\n  teamId: string;\n  apiKeyId?: string;\n}\n\ninterface Team {\n  id: string;\n  name: string;\n  projectId: string;\n  members: string[];\n}\n\nexport class RBACService {\n  private adminClient;\n\n  constructor(adminApiKey: string) {\n    this.adminClient = createClient(adminApiKey);\n  }\n\n  async createUserApiKey(user: User): Promise\u003Cstring> {\n    const role = roles[user.role];\n    if (!role) {\n      throw new Error(`Unknown role: ${user.role}`);\n    }\n\n    const team = await db.teams.findOne({ id: user.teamId });\n    if (!team) {\n      throw new Error(`Team not found: ${user.teamId}`);\n    }\n\n    \u002F\u002F Create scoped API key\n    const { result, error } = await this.adminClient.manage.createProjectKey(\n      team.projectId,\n      {\n        comment: `User: ${user.email} | Role: ${role.name}`,\n        scopes: role.deepgramScopes,\n        expiration_date: this.getExpirationDate(role),\n      }\n    );\n\n    if (error) throw error;\n\n    \u002F\u002F Store key reference (not the key itself)\n    await db.users.updateOne(\n      { id: user.id },\n      { $set: { apiKeyId: result.key_id } }\n    );\n\n    \u002F\u002F Log key creation\n    await this.auditLog('KEY_CREATED', user.id, {\n      keyId: result.key_id,\n      role: user.role,\n      scopes: role.deepgramScopes,\n    });\n\n    return result.key;\n  }\n\n  async revokeUserApiKey(userId: string): Promise\u003Cvoid> {\n    const user = await db.users.findOne({ id: userId });\n    if (!user?.apiKeyId) return;\n\n    const team = await db.teams.findOne({ id: user.teamId });\n    if (!team) return;\n\n    await this.adminClient.manage.deleteProjectKey(\n      team.projectId,\n      user.apiKeyId\n    );\n\n    await db.users.updateOne(\n      { id: userId },\n      { $unset: { apiKeyId: '' } }\n    );\n\n    await this.auditLog('KEY_REVOKED', userId, {\n      keyId: user.apiKeyId,\n    });\n  }\n\n  async checkPermission(\n    userId: string,\n    permission: string\n  ): Promise\u003Cboolean> {\n    const user = await db.users.findOne({ id: userId });\n    if (!user) return false;\n\n    const role = roles[user.role];\n    if (!role) return false;\n\n    \u002F\u002F Check wildcard\n    if (role.appPermissions.includes('*')) return true;\n\n    \u002F\u002F Check specific permission\n    return role.appPermissions.includes(permission);\n  }\n\n  async updateUserRole(userId: string, newRole: string): Promise\u003Cvoid> {\n    const role = roles[newRole];\n    if (!role) {\n      throw new Error(`Unknown role: ${newRole}`);\n    }\n\n    const user = await db.users.findOne({ id: userId });\n    if (!user) {\n      throw new Error(`User not found: ${userId}`);\n    }\n\n    \u002F\u002F Revoke old key\n    if (user.apiKeyId) {\n      await this.revokeUserApiKey(userId);\n    }\n\n    \u002F\u002F Update role\n    await db.users.updateOne(\n      { id: userId },\n      { $set: { role: newRole } }\n    );\n\n    \u002F\u002F Create new key with new scopes\n    await this.createUserApiKey({ ...user, role: newRole });\n\n    await this.auditLog('ROLE_CHANGED', userId, {\n      oldRole: user.role,\n      newRole,\n    });\n  }\n\n  private getExpirationDate(role: Role): Date {\n    const days = role.name === 'Service Account' ? 90 : 365;\n    const date = new Date();\n    date.setDate(date.getDate() + days);\n    return date;\n  }\n\n  private async auditLog(\n    action: string,\n    userId: string,\n    details: Record\u003Cstring, unknown>\n  ): Promise\u003Cvoid> {\n    await db.auditLog.insertOne({\n      timestamp: new Date(),\n      action,\n      userId,\n      details,\n    });\n  }\n}\n```\n\n### Permission Middleware\n```typescript\n\u002F\u002F middleware\u002Fauthorization.ts\nimport { Request, Response, NextFunction } from 'express';\nimport { RBACService } from '..\u002Fservices\u002Frbac';\n\nconst rbac = new RBACService(process.env.DEEPGRAM_ADMIN_KEY!);\n\nexport function requirePermission(permission: string) {\n  return async (req: Request, res: Response, next: NextFunction) => {\n    const userId = req.user?.id;\n\n    if (!userId) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n\n    const hasPermission = await rbac.checkPermission(userId, permission);\n\n    if (!hasPermission) {\n      return res.status(403).json({\n        error: 'Forbidden',\n        message: `Missing permission: ${permission}`,\n      });\n    }\n\n    next();\n  };\n}\n\n\u002F\u002F Usage in routes\napp.post(\n  '\u002Ftranscribe',\n  requirePermission('transcription:create'),\n  transcribeHandler\n);\n\napp.get(\n  '\u002Fusage',\n  requirePermission('usage:read'),\n  usageHandler\n);\n\napp.post(\n  '\u002Fadmin\u002Fkeys',\n  requirePermission('keys:write'),\n  createKeyHandler\n);\n```\n\n### Team Management\n```typescript\n\u002F\u002F services\u002Fteams.ts\nimport { RBACService } from '.\u002Frbac';\nimport { db } from '.\u002Fdatabase';\n\ninterface CreateTeamRequest {\n  name: string;\n  projectId: string;\n  adminUserId: string;\n}\n\nexport class TeamService {\n  private rbac: RBACService;\n\n  constructor(rbac: RBACService) {\n    this.rbac = rbac;\n  }\n\n  async createTeam(request: CreateTeamRequest): Promise\u003Cstring> {\n    const teamId = crypto.randomUUID();\n\n    \u002F\u002F Create team\n    await db.teams.insertOne({\n      id: teamId,\n      name: request.name,\n      projectId: request.projectId,\n      members: [request.adminUserId],\n      createdAt: new Date(),\n    });\n\n    \u002F\u002F Set admin as team admin\n    await db.users.updateOne(\n      { id: request.adminUserId },\n      { $set: { teamId, role: 'admin' } }\n    );\n\n    \u002F\u002F Create API key for admin\n    const user = await db.users.findOne({ id: request.adminUserId });\n    if (user) {\n      await this.rbac.createUserApiKey(user);\n    }\n\n    return teamId;\n  }\n\n  async addMember(\n    teamId: string,\n    userId: string,\n    role: string\n  ): Promise\u003Cvoid> {\n    \u002F\u002F Update team\n    await db.teams.updateOne(\n      { id: teamId },\n      { $addToSet: { members: userId } }\n    );\n\n    \u002F\u002F Update user\n    await db.users.updateOne(\n      { id: userId },\n      { $set: { teamId, role } }\n    );\n\n    \u002F\u002F Create API key\n    const user = await db.users.findOne({ id: userId });\n    if (user) {\n      await this.rbac.createUserApiKey(user);\n    }\n  }\n\n  async removeMember(teamId: string, userId: string): Promise\u003Cvoid> {\n    \u002F\u002F Revoke API key\n    await this.rbac.revokeUserApiKey(userId);\n\n    \u002F\u002F Remove from team\n    await db.teams.updateOne(\n      { id: teamId },\n      { $pull: { members: userId } }\n    );\n\n    \u002F\u002F Clear user team\n    await db.users.updateOne(\n      { id: userId },\n      { $unset: { teamId: '', role: '' } }\n    );\n  }\n\n  async getTeamUsage(teamId: string): Promise\u003C{\n    totalMinutes: number;\n    byMember: Array\u003C{ userId: string; minutes: number }>;\n  }> {\n    const team = await db.teams.findOne({ id: teamId });\n    if (!team) throw new Error('Team not found');\n\n    const usage = await db.usage.aggregate([\n      { $match: { userId: { $in: team.members } } },\n      {\n        $group: {\n          _id: '$userId',\n          minutes: { $sum: '$audioMinutes' },\n        },\n      },\n    ]).toArray();\n\n    return {\n      totalMinutes: usage.reduce((sum, u) => sum + u.minutes, 0),\n      byMember: usage.map(u => ({\n        userId: u._id,\n        minutes: u.minutes,\n      })),\n    };\n  }\n}\n```\n\n### API Key Rotation\n```typescript\n\u002F\u002F services\u002Fkey-rotation.ts\nimport { RBACService } from '.\u002Frbac';\nimport { db } from '.\u002Fdatabase';\n\nexport class KeyRotationService {\n  private rbac: RBACService;\n\n  constructor(rbac: RBACService) {\n    this.rbac = rbac;\n  }\n\n  async rotateExpiredKeys(): Promise\u003C{\n    rotated: number;\n    failed: number;\n  }> {\n    const stats = { rotated: 0, failed: 0 };\n\n    \u002F\u002F Find users with keys expiring soon\n    const expiringUsers = await db.users.find({\n      keyExpiration: {\n        $lt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), \u002F\u002F 7 days\n      },\n    }).toArray();\n\n    for (const user of expiringUsers) {\n      try {\n        \u002F\u002F Revoke old key\n        await this.rbac.revokeUserApiKey(user.id);\n\n        \u002F\u002F Create new key\n        await this.rbac.createUserApiKey(user);\n\n        \u002F\u002F Notify user\n        await this.notifyKeyRotation(user);\n\n        stats.rotated++;\n      } catch (error) {\n        console.error(`Failed to rotate key for ${user.id}:`, error);\n        stats.failed++;\n      }\n    }\n\n    return stats;\n  }\n\n  private async notifyKeyRotation(user: any): Promise\u003Cvoid> {\n    \u002F\u002F Send email notification\n    \u002F\u002F Implementation depends on your notification system\n  }\n}\n```\n\n### Admin Dashboard API\n```typescript\n\u002F\u002F routes\u002Fadmin.ts\nimport express from 'express';\nimport { requirePermission } from '..\u002Fmiddleware\u002Fauthorization';\nimport { RBACService } from '..\u002Fservices\u002Frbac';\nimport { TeamService } from '..\u002Fservices\u002Fteams';\n\nconst router = express.Router();\nconst rbac = new RBACService(process.env.DEEPGRAM_ADMIN_KEY!);\nconst teams = new TeamService(rbac);\n\n\u002F\u002F List all users\nrouter.get(\n  '\u002Fusers',\n  requirePermission('admin:users:read'),\n  async (req, res) => {\n    const users = await db.users.find({}).toArray();\n    res.json({ users });\n  }\n);\n\n\u002F\u002F Update user role\nrouter.patch(\n  '\u002Fusers\u002F:id\u002Frole',\n  requirePermission('admin:users:write'),\n  async (req, res) => {\n    const { role } = req.body;\n    await rbac.updateUserRole(req.params.id, role);\n    res.json({ success: true });\n  }\n);\n\n\u002F\u002F Create team\nrouter.post(\n  '\u002Fteams',\n  requirePermission('admin:teams:write'),\n  async (req, res) => {\n    const teamId = await teams.createTeam(req.body);\n    res.json({ teamId });\n  }\n);\n\n\u002F\u002F Get team usage\nrouter.get(\n  '\u002Fteams\u002F:id\u002Fusage',\n  requirePermission('admin:usage:read'),\n  async (req, res) => {\n    const usage = await teams.getTeamUsage(req.params.id);\n    res.json(usage);\n  }\n);\n\n\u002F\u002F Rotate API key\nrouter.post(\n  '\u002Fusers\u002F:id\u002Frotate-key',\n  requirePermission('admin:keys:write'),\n  async (req, res) => {\n    await rbac.revokeUserApiKey(req.params.id);\n    const user = await db.users.findOne({ id: req.params.id });\n    if (user) {\n      const newKey = await rbac.createUserApiKey(user);\n      res.json({ success: true, keyCreated: true });\n    } else {\n      res.status(404).json({ error: 'User not found' });\n    }\n  }\n);\n\nexport default router;\n```\n\n## Resources\n- [Deepgram API Key Management](https:\u002F\u002Fdevelopers.deepgram.com\u002Fdocs\u002Fapi-key-management)\n- [Project Management](https:\u002F\u002Fdevelopers.deepgram.com\u002Fdocs\u002Fprojects)\n- [Enterprise Features](https:\u002F\u002Fdeepgram.com\u002Fenterprise)\n\n## Next Steps\nProceed to `deepgram-migration-deep-dive` for complex migration scenarios.\n",{"name":5,"author":56,"license":15,"version":57,"description":58,"allowed-tools":59},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Configure enterprise role-based access control for Deepgram integrations.\nUse when implementing team permissions, managing API key scopes,\nor setting up organization-level access controls.\nTrigger with phrases like \"deepgram RBAC\", \"deepgram permissions\",\n\"deepgram access control\", \"deepgram team roles\", \"deepgram enterprise\".\n","Read, Write, Edit, Bash(kubectl:*), Bash(curl:*)","main","90b50ed0778745a80fd5bfb13b1843d45b9e82f7","tests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fdeepgram-pack\u002Fskills\u002Fdeepgram-enterprise-rbac",233,"https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust","https:\u002F\u002Fgithub.com\u002FDicklesworthstone","https:\u002F\u002Fwww.jeffreyemanuel.com\u002F","Building in NY","2026-11-13 03:33:43",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add Dicklesworthstone\u002Fpi_agent_rust --skill deepgram-enterprise-rbac",{"tool":75,"command":76},"bunx","bunx skills add Dicklesworthstone\u002Fpi_agent_rust --skill deepgram-enterprise-rbac",{"tool":78,"command":79},"pnpm","pnpm dlx skills add Dicklesworthstone\u002Fpi_agent_rust --skill deepgram-enterprise-rbac","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fdeepgram-pack\u002Fskills\u002Fdeepgram-enterprise-rbac\u002FSKILL.md",true,[],[84,124,148,174,200,222],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":88,"licenseFileUrl":89,"sourceHtmlUrl":90,"categories":91,"keywords":97,"publishedAt":51},"01M6FEGPPK0ZTKCCM0R3E3KS33","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[92],{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,28,116,117,118,119,120,121,122,123],"web artifacts builder","web","artifacts","artifacts builder","builder","frontend","css","components","react","component","routing","state management","state","shadcn","file","ui","Tools","Tailwind","html","single-file","simple","ui components","multi","for","jsx","suite",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":88,"licenseFileUrl":128,"sourceHtmlUrl":129,"categories":130,"keywords":135,"publishedAt":51},"01M6FEE9VTK1W4GY21AKREJXRG","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[131,134],{"categoryNo":132,"categoryName":133,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},[136,137,138,103,139,140,99,141,142,143,113,144,145,146,147,31,121],"testing","webapp testing","webapp","screenshots","playwright","debugging","toolkit","browser","logs","applications","behavior","local",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":152,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":51},"01M6FE20F7ZTQBFWKF4MPJ2SBX","neuropixels-analysis","Neuropixels neural recording analysis. Load SpikeGLX\u002FOpenEphys data, preprocess, motion correction, Kilosort4 spike sorting, quality metrics, Allen\u002FIBL curation, AI-assisted visual analysis, for Neuropixels 1.0\u002F2.0 extracellular electrophysiology. Use when working with neural recordings, spike sorting, extracellular electrophysiology, or when the user mentions Neuropixels, SpikeGLX, Open Ephys, Kilosort, quality metrics, or unit curation.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fneuropixels-analysis\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fneuropixels-analysis\u002FSKILL.md",[],[156,157,158,159,160,161,162,163,28,164,165,166,167,168,169,170,31,171,172,173,121,29],"analysis","neuropixels analysis","spike","metrics","data","open","quality","user","recordings","Neural","motion","visual","quality metrics","unit","sorting","curation","recording","load",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":88,"licenseFileUrl":178,"sourceHtmlUrl":179,"categories":180,"keywords":184,"publishedAt":51},"01M6FDP0PDK6F1GGX395C7625Z","skill-creator","Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FSKILL.md",[181],{"categoryNo":182,"categoryName":183,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000023","Skill与智能体开发",[185,186,187,188,189,190,191,192,43,193,194,195,196,197,31,121,198,29,199],"skill creator","creator","workflows","create","update","capabilities","knowledge","tool","specialized","guide","new skill","existing skill","users","Existing","new",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":204,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":51},"01M6FDM8Y7VK7NYG9SM7QPA3PW","notebooklm","Use this skill to query your Google NotebookLM notebooks directly from Claude Code for source-grounded, citation-backed answers from Gemini. Browser automation, library management, persistent auth. Drastically reduced hallucinations through document-only responses.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnotebooklm\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnotebooklm\u002FSKILL.md",[207],{"categoryNo":182,"categoryName":183,"taxonomyType":95,"taxonomyTypeDesc":96},[202,209,210,211,212,213,214,143,215,216,28,217,218,219,220,121,221],"google","browser automation","gemini","automation","auth","code","library","management","only","document","query","Citation","source",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":88,"licenseFileUrl":226,"sourceHtmlUrl":227,"categories":228,"keywords":235,"publishedAt":51},"01M6FDHPXE10J3XGTCH5HBHS1M","slack-gif-creator","Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like \"make me a GIF of X doing Y for Slack.\"","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FSKILL.md",[229,232],{"categoryNo":230,"categoryName":231,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":233,"categoryName":234,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000016","图像与多媒体",[236,237,238,186,239,114,240,241,191,28,242,197,243,244,245,121,246,29],"slack gif creator","slack","gif","validation","constraints","Animation","me","make","Utilities","concepts","request"]