[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F867SQ5BAFN84VT9PMCEYT":3,"skill-same:01M6F867SQ5BAFN84VT9PMCEYT":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M6F867SQ5BAFN84VT9PMCEYT","mistral-enterprise-rbac",null,"Configure Mistral AI enterprise access control and organization management.\nUse when implementing role-based permissions, managing team access,\nor setting up organization-level controls for Mistral AI.\nTrigger with phrases like \"mistral access control\", \"mistral RBAC\",\n\"mistral enterprise\", \"mistral roles\", \"mistral permissions\", \"mistral team\".","Dicklesworthstone\u002Fpi_agent_rust","Dicklesworthstone","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F35050222?v=4","01M6CG26AR942CSVMN1M5E3DSE","Jeff Emanuel","01M6CG26EPP71PSHW1VDS71121",1981,"MIT","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fmistral-pack\u002Fskills\u002Fmistral-enterprise-rbac\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"Enterprise","Mistral","mistral enterprise rbac","rbac","up","when","for","implementing","with","controls","trigger","io","roles","Access Control","organization","use","edit","write","read","configure","access","team","permissions","2026-11-10 10:12:30",false,"---\nname: mistral-enterprise-rbac\ndescription: |\n  Configure Mistral AI enterprise access control and organization management.\n  Use when implementing role-based permissions, managing team access,\n  or setting up organization-level controls for Mistral AI.\n  Trigger with phrases like \"mistral access control\", \"mistral RBAC\",\n  \"mistral enterprise\", \"mistral roles\", \"mistral permissions\", \"mistral team\".\nallowed-tools: Read, Write, Edit\nversion: 1.0.0\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\n---\n\n# Mistral AI Enterprise RBAC\n\n## Overview\nConfigure enterprise-grade access control for Mistral AI integrations within your organization.\n\n## Prerequisites\n- Mistral AI API access\n- Understanding of role-based access patterns\n- User management system in place\n- Audit logging infrastructure\n\n## Role Definitions\n\n| Role | Permissions | Use Case |\n|------|-------------|----------|\n| Admin | Full access, manage keys | Platform administrators |\n| Developer | All models, full features | Active development |\n| Analyst | Read-only, limited models | Data analysis, reports |\n| Service | API access, specific model | Automated systems |\n| Viewer | Read logs only | Auditors, stakeholders |\n\n## Instructions\n\n### Step 1: Define Permission Schema\n\n```typescript\n\u002F\u002F permissions.ts\nexport type MistralPermission =\n  | 'chat:complete'\n  | 'chat:stream'\n  | 'embeddings:create'\n  | 'models:list'\n  | 'models:use:small'\n  | 'models:use:large'\n  | 'keys:manage'\n  | 'usage:view'\n  | 'audit:view';\n\nexport type MistralRole = 'admin' | 'developer' | 'analyst' | 'service' | 'viewer';\n\nexport const ROLE_PERMISSIONS: Record\u003CMistralRole, MistralPermission[]> = {\n  admin: [\n    'chat:complete', 'chat:stream', 'embeddings:create',\n    'models:list', 'models:use:small', 'models:use:large',\n    'keys:manage', 'usage:view', 'audit:view',\n  ],\n  developer: [\n    'chat:complete', 'chat:stream', 'embeddings:create',\n    'models:list', 'models:use:small', 'models:use:large',\n    'usage:view',\n  ],\n  analyst: [\n    'chat:complete', 'embeddings:create',\n    'models:list', 'models:use:small',\n    'usage:view',\n  ],\n  service: [\n    'chat:complete', 'chat:stream', 'embeddings:create',\n    'models:use:small',\n  ],\n  viewer: [\n    'models:list', 'usage:view', 'audit:view',\n  ],\n};\n\nexport function hasPermission(role: MistralRole, permission: MistralPermission): boolean {\n  return ROLE_PERMISSIONS[role].includes(permission);\n}\n```\n\n### Step 2: User and Organization Management\n\n```typescript\ninterface MistralUser {\n  id: string;\n  email: string;\n  role: MistralRole;\n  organizationId: string;\n  apiKeyId?: string;\n  createdAt: Date;\n  lastActiveAt?: Date;\n}\n\ninterface MistralOrganization {\n  id: string;\n  name: string;\n  plan: 'free' | 'pro' | 'enterprise';\n  settings: {\n    allowedModels: string[];\n    maxRequestsPerDay: number;\n    requireApproval: boolean;\n  };\n  createdAt: Date;\n}\n\nclass OrganizationManager {\n  async createOrganization(name: string, plan: MistralOrganization['plan']): Promise\u003CMistralOrganization> {\n    const org: MistralOrganization = {\n      id: crypto.randomUUID(),\n      name,\n      plan,\n      settings: this.getDefaultSettings(plan),\n      createdAt: new Date(),\n    };\n\n    await db.organizations.insert(org);\n    return org;\n  }\n\n  private getDefaultSettings(plan: MistralOrganization['plan']) {\n    const settings = {\n      free: {\n        allowedModels: ['mistral-small-latest'],\n        maxRequestsPerDay: 100,\n        requireApproval: false,\n      },\n      pro: {\n        allowedModels: ['mistral-small-latest', 'mistral-large-latest'],\n        maxRequestsPerDay: 10000,\n        requireApproval: false,\n      },\n      enterprise: {\n        allowedModels: ['mistral-small-latest', 'mistral-large-latest', 'mistral-embed'],\n        maxRequestsPerDay: 1000000,\n        requireApproval: true,\n      },\n    };\n    return settings[plan];\n  }\n\n  async addUser(orgId: string, email: string, role: MistralRole): Promise\u003CMistralUser> {\n    const user: MistralUser = {\n      id: crypto.randomUUID(),\n      email,\n      role,\n      organizationId: orgId,\n      createdAt: new Date(),\n    };\n\n    await db.users.insert(user);\n    return user;\n  }\n\n  async updateUserRole(userId: string, newRole: MistralRole): Promise\u003Cvoid> {\n    await db.users.update({ id: userId }, { $set: { role: newRole } });\n\n    \u002F\u002F Audit log\n    await auditLogger.log({\n      action: 'user.role.updated',\n      userId,\n      newRole,\n      performedBy: getCurrentUser().id,\n    });\n  }\n}\n```\n\n### Step 3: Permission Middleware\n\n```typescript\nimport { Request, Response, NextFunction } from 'express';\n\ninterface AuthenticatedRequest extends Request {\n  user?: MistralUser;\n  organization?: MistralOrganization;\n}\n\nfunction requirePermission(permission: MistralPermission) {\n  return async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {\n    const user = req.user;\n\n    if (!user) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n\n    if (!hasPermission(user.role, permission)) {\n      \u002F\u002F Audit failed access attempt\n      await auditLogger.log({\n        action: 'permission.denied',\n        userId: user.id,\n        permission,\n        resource: req.path,\n      });\n\n      return res.status(403).json({\n        error: 'Forbidden',\n        message: `Missing permission: ${permission}`,\n      });\n    }\n\n    next();\n  };\n}\n\n\u002F\u002F Usage\napp.post('\u002Fapi\u002Fchat',\n  requirePermission('chat:complete'),\n  async (req: AuthenticatedRequest, res) => {\n    \u002F\u002F Handle chat request\n  }\n);\n\napp.post('\u002Fapi\u002Fchat\u002Fstream',\n  requirePermission('chat:stream'),\n  async (req: AuthenticatedRequest, res) => {\n    \u002F\u002F Handle streaming\n  }\n);\n```\n\n### Step 4: Model Access Control\n\n```typescript\nfunction requireModelAccess(model: string) {\n  return async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {\n    const user = req.user!;\n    const org = req.organization!;\n\n    \u002F\u002F Check organization allows this model\n    if (!org.settings.allowedModels.includes(model)) {\n      return res.status(403).json({\n        error: 'Model not allowed',\n        message: `Your organization does not have access to ${model}`,\n      });\n    }\n\n    \u002F\u002F Check user role allows this model\n    const modelPermission = model.includes('large')\n      ? 'models:use:large'\n      : 'models:use:small';\n\n    if (!hasPermission(user.role, modelPermission as MistralPermission)) {\n      return res.status(403).json({\n        error: 'Model access denied',\n        message: `Your role does not allow access to ${model}`,\n      });\n    }\n\n    next();\n  };\n}\n```\n\n### Step 5: API Key Scoping\n\n```typescript\ninterface ScopedApiKey {\n  id: string;\n  key: string; \u002F\u002F Hashed\n  userId: string;\n  organizationId: string;\n  name: string;\n  permissions: MistralPermission[];\n  allowedModels: string[];\n  rateLimit: {\n    requestsPerMinute: number;\n    tokensPerDay: number;\n  };\n  expiresAt?: Date;\n  createdAt: Date;\n}\n\nclass ApiKeyManager {\n  async createScopedKey(\n    userId: string,\n    name: string,\n    permissions: MistralPermission[],\n    options?: {\n      allowedModels?: string[];\n      rateLimit?: Partial\u003CScopedApiKey['rateLimit']>;\n      expiresInDays?: number;\n    }\n  ): Promise\u003C{ id: string; key: string }> {\n    const user = await db.users.findOne({ id: userId });\n    if (!user) throw new Error('User not found');\n\n    \u002F\u002F Validate permissions don't exceed user's role\n    for (const perm of permissions) {\n      if (!hasPermission(user.role, perm)) {\n        throw new Error(`Cannot grant permission ${perm} - exceeds user role`);\n      }\n    }\n\n    const rawKey = `msk_${crypto.randomBytes(32).toString('hex')}`;\n    const hashedKey = crypto.createHash('sha256').update(rawKey).digest('hex');\n\n    const scopedKey: ScopedApiKey = {\n      id: crypto.randomUUID(),\n      key: hashedKey,\n      userId,\n      organizationId: user.organizationId,\n      name,\n      permissions,\n      allowedModels: options?.allowedModels || ['mistral-small-latest'],\n      rateLimit: {\n        requestsPerMinute: options?.rateLimit?.requestsPerMinute || 60,\n        tokensPerDay: options?.rateLimit?.tokensPerDay || 100000,\n      },\n      expiresAt: options?.expiresInDays\n        ? new Date(Date.now() + options.expiresInDays * 24 * 60 * 60 * 1000)\n        : undefined,\n      createdAt: new Date(),\n    };\n\n    await db.apiKeys.insert(scopedKey);\n\n    return { id: scopedKey.id, key: rawKey };\n  }\n\n  async validateKey(rawKey: string): Promise\u003CScopedApiKey | null> {\n    const hashedKey = crypto.createHash('sha256').update(rawKey).digest('hex');\n    const key = await db.apiKeys.findOne({ key: hashedKey });\n\n    if (!key) return null;\n    if (key.expiresAt && key.expiresAt \u003C new Date()) return null;\n\n    return key;\n  }\n}\n```\n\n### Step 6: Usage Quotas\n\n```typescript\nclass UsageQuotaManager {\n  async checkQuota(userId: string, orgId: string): Promise\u003C{\n    allowed: boolean;\n    remaining: { requests: number; tokens: number };\n    resetAt: Date;\n  }> {\n    const org = await db.organizations.findOne({ id: orgId });\n    const today = new Date().toISOString().split('T')[0];\n\n    const usage = await db.usage.findOne({\n      organizationId: orgId,\n      date: today,\n    }) || { requests: 0, tokens: 0 };\n\n    const maxRequests = org!.settings.maxRequestsPerDay;\n    const remaining = {\n      requests: Math.max(0, maxRequests - usage.requests),\n      tokens: Math.max(0, 1000000 - usage.tokens), \u002F\u002F Example limit\n    };\n\n    return {\n      allowed: remaining.requests > 0 && remaining.tokens > 0,\n      remaining,\n      resetAt: new Date(new Date().setHours(24, 0, 0, 0)),\n    };\n  }\n\n  async recordUsage(orgId: string, requests: number, tokens: number): Promise\u003Cvoid> {\n    const today = new Date().toISOString().split('T')[0];\n\n    await db.usage.updateOne(\n      { organizationId: orgId, date: today },\n      {\n        $inc: { requests, tokens },\n        $setOnInsert: { organizationId: orgId, date: today },\n      },\n      { upsert: true }\n    );\n  }\n}\n```\n\n## Output\n- Role definitions implemented\n- Permission middleware active\n- Model access control configured\n- API key scoping enabled\n\n## Error Handling\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| Permission denied | Wrong role | Update user role or permissions |\n| Key expired | TTL passed | Generate new key |\n| Quota exceeded | Heavy usage | Upgrade plan or wait for reset |\n| Model not allowed | Organization restriction | Contact admin |\n\n## Examples\n\n### Quick Permission Check\n```typescript\nif (!hasPermission(user.role, 'chat:stream')) {\n  throw new ForbiddenError('Streaming not allowed for your role');\n}\n```\n\n### Create Limited Service Key\n```typescript\nconst { key } = await keyManager.createScopedKey(\n  serviceUserId,\n  'background-processor',\n  ['chat:complete'],\n  {\n    allowedModels: ['mistral-small-latest'],\n    rateLimit: { requestsPerMinute: 10 },\n    expiresInDays: 30,\n  }\n);\n```\n\n## Resources\n- [RBAC Best Practices](https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Frole-based-access-control)\n- [Mistral AI Documentation](https:\u002F\u002Fdocs.mistral.ai\u002F)\n\n## Next Steps\nFor major migrations, see `mistral-migration-deep-dive`.\n","# Mistral AI Enterprise RBAC\n\n## Overview\nConfigure enterprise-grade access control for Mistral AI integrations within your organization.\n\n## Prerequisites\n- Mistral AI API access\n- Understanding of role-based access patterns\n- User management system in place\n- Audit logging infrastructure\n\n## Role Definitions\n\n| Role | Permissions | Use Case |\n|------|-------------|----------|\n| Admin | Full access, manage keys | Platform administrators |\n| Developer | All models, full features | Active development |\n| Analyst | Read-only, limited models | Data analysis, reports |\n| Service | API access, specific model | Automated systems |\n| Viewer | Read logs only | Auditors, stakeholders |\n\n## Instructions\n\n### Step 1: Define Permission Schema\n\n```typescript\n\u002F\u002F permissions.ts\nexport type MistralPermission =\n  | 'chat:complete'\n  | 'chat:stream'\n  | 'embeddings:create'\n  | 'models:list'\n  | 'models:use:small'\n  | 'models:use:large'\n  | 'keys:manage'\n  | 'usage:view'\n  | 'audit:view';\n\nexport type MistralRole = 'admin' | 'developer' | 'analyst' | 'service' | 'viewer';\n\nexport const ROLE_PERMISSIONS: Record\u003CMistralRole, MistralPermission[]> = {\n  admin: [\n    'chat:complete', 'chat:stream', 'embeddings:create',\n    'models:list', 'models:use:small', 'models:use:large',\n    'keys:manage', 'usage:view', 'audit:view',\n  ],\n  developer: [\n    'chat:complete', 'chat:stream', 'embeddings:create',\n    'models:list', 'models:use:small', 'models:use:large',\n    'usage:view',\n  ],\n  analyst: [\n    'chat:complete', 'embeddings:create',\n    'models:list', 'models:use:small',\n    'usage:view',\n  ],\n  service: [\n    'chat:complete', 'chat:stream', 'embeddings:create',\n    'models:use:small',\n  ],\n  viewer: [\n    'models:list', 'usage:view', 'audit:view',\n  ],\n};\n\nexport function hasPermission(role: MistralRole, permission: MistralPermission): boolean {\n  return ROLE_PERMISSIONS[role].includes(permission);\n}\n```\n\n### Step 2: User and Organization Management\n\n```typescript\ninterface MistralUser {\n  id: string;\n  email: string;\n  role: MistralRole;\n  organizationId: string;\n  apiKeyId?: string;\n  createdAt: Date;\n  lastActiveAt?: Date;\n}\n\ninterface MistralOrganization {\n  id: string;\n  name: string;\n  plan: 'free' | 'pro' | 'enterprise';\n  settings: {\n    allowedModels: string[];\n    maxRequestsPerDay: number;\n    requireApproval: boolean;\n  };\n  createdAt: Date;\n}\n\nclass OrganizationManager {\n  async createOrganization(name: string, plan: MistralOrganization['plan']): Promise\u003CMistralOrganization> {\n    const org: MistralOrganization = {\n      id: crypto.randomUUID(),\n      name,\n      plan,\n      settings: this.getDefaultSettings(plan),\n      createdAt: new Date(),\n    };\n\n    await db.organizations.insert(org);\n    return org;\n  }\n\n  private getDefaultSettings(plan: MistralOrganization['plan']) {\n    const settings = {\n      free: {\n        allowedModels: ['mistral-small-latest'],\n        maxRequestsPerDay: 100,\n        requireApproval: false,\n      },\n      pro: {\n        allowedModels: ['mistral-small-latest', 'mistral-large-latest'],\n        maxRequestsPerDay: 10000,\n        requireApproval: false,\n      },\n      enterprise: {\n        allowedModels: ['mistral-small-latest', 'mistral-large-latest', 'mistral-embed'],\n        maxRequestsPerDay: 1000000,\n        requireApproval: true,\n      },\n    };\n    return settings[plan];\n  }\n\n  async addUser(orgId: string, email: string, role: MistralRole): Promise\u003CMistralUser> {\n    const user: MistralUser = {\n      id: crypto.randomUUID(),\n      email,\n      role,\n      organizationId: orgId,\n      createdAt: new Date(),\n    };\n\n    await db.users.insert(user);\n    return user;\n  }\n\n  async updateUserRole(userId: string, newRole: MistralRole): Promise\u003Cvoid> {\n    await db.users.update({ id: userId }, { $set: { role: newRole } });\n\n    \u002F\u002F Audit log\n    await auditLogger.log({\n      action: 'user.role.updated',\n      userId,\n      newRole,\n      performedBy: getCurrentUser().id,\n    });\n  }\n}\n```\n\n### Step 3: Permission Middleware\n\n```typescript\nimport { Request, Response, NextFunction } from 'express';\n\ninterface AuthenticatedRequest extends Request {\n  user?: MistralUser;\n  organization?: MistralOrganization;\n}\n\nfunction requirePermission(permission: MistralPermission) {\n  return async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {\n    const user = req.user;\n\n    if (!user) {\n      return res.status(401).json({ error: 'Unauthorized' });\n    }\n\n    if (!hasPermission(user.role, permission)) {\n      \u002F\u002F Audit failed access attempt\n      await auditLogger.log({\n        action: 'permission.denied',\n        userId: user.id,\n        permission,\n        resource: req.path,\n      });\n\n      return res.status(403).json({\n        error: 'Forbidden',\n        message: `Missing permission: ${permission}`,\n      });\n    }\n\n    next();\n  };\n}\n\n\u002F\u002F Usage\napp.post('\u002Fapi\u002Fchat',\n  requirePermission('chat:complete'),\n  async (req: AuthenticatedRequest, res) => {\n    \u002F\u002F Handle chat request\n  }\n);\n\napp.post('\u002Fapi\u002Fchat\u002Fstream',\n  requirePermission('chat:stream'),\n  async (req: AuthenticatedRequest, res) => {\n    \u002F\u002F Handle streaming\n  }\n);\n```\n\n### Step 4: Model Access Control\n\n```typescript\nfunction requireModelAccess(model: string) {\n  return async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {\n    const user = req.user!;\n    const org = req.organization!;\n\n    \u002F\u002F Check organization allows this model\n    if (!org.settings.allowedModels.includes(model)) {\n      return res.status(403).json({\n        error: 'Model not allowed',\n        message: `Your organization does not have access to ${model}`,\n      });\n    }\n\n    \u002F\u002F Check user role allows this model\n    const modelPermission = model.includes('large')\n      ? 'models:use:large'\n      : 'models:use:small';\n\n    if (!hasPermission(user.role, modelPermission as MistralPermission)) {\n      return res.status(403).json({\n        error: 'Model access denied',\n        message: `Your role does not allow access to ${model}`,\n      });\n    }\n\n    next();\n  };\n}\n```\n\n### Step 5: API Key Scoping\n\n```typescript\ninterface ScopedApiKey {\n  id: string;\n  key: string; \u002F\u002F Hashed\n  userId: string;\n  organizationId: string;\n  name: string;\n  permissions: MistralPermission[];\n  allowedModels: string[];\n  rateLimit: {\n    requestsPerMinute: number;\n    tokensPerDay: number;\n  };\n  expiresAt?: Date;\n  createdAt: Date;\n}\n\nclass ApiKeyManager {\n  async createScopedKey(\n    userId: string,\n    name: string,\n    permissions: MistralPermission[],\n    options?: {\n      allowedModels?: string[];\n      rateLimit?: Partial\u003CScopedApiKey['rateLimit']>;\n      expiresInDays?: number;\n    }\n  ): Promise\u003C{ id: string; key: string }> {\n    const user = await db.users.findOne({ id: userId });\n    if (!user) throw new Error('User not found');\n\n    \u002F\u002F Validate permissions don't exceed user's role\n    for (const perm of permissions) {\n      if (!hasPermission(user.role, perm)) {\n        throw new Error(`Cannot grant permission ${perm} - exceeds user role`);\n      }\n    }\n\n    const rawKey = `msk_${crypto.randomBytes(32).toString('hex')}`;\n    const hashedKey = crypto.createHash('sha256').update(rawKey).digest('hex');\n\n    const scopedKey: ScopedApiKey = {\n      id: crypto.randomUUID(),\n      key: hashedKey,\n      userId,\n      organizationId: user.organizationId,\n      name,\n      permissions,\n      allowedModels: options?.allowedModels || ['mistral-small-latest'],\n      rateLimit: {\n        requestsPerMinute: options?.rateLimit?.requestsPerMinute || 60,\n        tokensPerDay: options?.rateLimit?.tokensPerDay || 100000,\n      },\n      expiresAt: options?.expiresInDays\n        ? new Date(Date.now() + options.expiresInDays * 24 * 60 * 60 * 1000)\n        : undefined,\n      createdAt: new Date(),\n    };\n\n    await db.apiKeys.insert(scopedKey);\n\n    return { id: scopedKey.id, key: rawKey };\n  }\n\n  async validateKey(rawKey: string): Promise\u003CScopedApiKey | null> {\n    const hashedKey = crypto.createHash('sha256').update(rawKey).digest('hex');\n    const key = await db.apiKeys.findOne({ key: hashedKey });\n\n    if (!key) return null;\n    if (key.expiresAt && key.expiresAt \u003C new Date()) return null;\n\n    return key;\n  }\n}\n```\n\n### Step 6: Usage Quotas\n\n```typescript\nclass UsageQuotaManager {\n  async checkQuota(userId: string, orgId: string): Promise\u003C{\n    allowed: boolean;\n    remaining: { requests: number; tokens: number };\n    resetAt: Date;\n  }> {\n    const org = await db.organizations.findOne({ id: orgId });\n    const today = new Date().toISOString().split('T')[0];\n\n    const usage = await db.usage.findOne({\n      organizationId: orgId,\n      date: today,\n    }) || { requests: 0, tokens: 0 };\n\n    const maxRequests = org!.settings.maxRequestsPerDay;\n    const remaining = {\n      requests: Math.max(0, maxRequests - usage.requests),\n      tokens: Math.max(0, 1000000 - usage.tokens), \u002F\u002F Example limit\n    };\n\n    return {\n      allowed: remaining.requests > 0 && remaining.tokens > 0,\n      remaining,\n      resetAt: new Date(new Date().setHours(24, 0, 0, 0)),\n    };\n  }\n\n  async recordUsage(orgId: string, requests: number, tokens: number): Promise\u003Cvoid> {\n    const today = new Date().toISOString().split('T')[0];\n\n    await db.usage.updateOne(\n      { organizationId: orgId, date: today },\n      {\n        $inc: { requests, tokens },\n        $setOnInsert: { organizationId: orgId, date: today },\n      },\n      { upsert: true }\n    );\n  }\n}\n```\n\n## Output\n- Role definitions implemented\n- Permission middleware active\n- Model access control configured\n- API key scoping enabled\n\n## Error Handling\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| Permission denied | Wrong role | Update user role or permissions |\n| Key expired | TTL passed | Generate new key |\n| Quota exceeded | Heavy usage | Upgrade plan or wait for reset |\n| Model not allowed | Organization restriction | Contact admin |\n\n## Examples\n\n### Quick Permission Check\n```typescript\nif (!hasPermission(user.role, 'chat:stream')) {\n  throw new ForbiddenError('Streaming not allowed for your role');\n}\n```\n\n### Create Limited Service Key\n```typescript\nconst { key } = await keyManager.createScopedKey(\n  serviceUserId,\n  'background-processor',\n  ['chat:complete'],\n  {\n    allowedModels: ['mistral-small-latest'],\n    rateLimit: { requestsPerMinute: 10 },\n    expiresInDays: 30,\n  }\n);\n```\n\n## Resources\n- [RBAC Best Practices](https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Frole-based-access-control)\n- [Mistral AI Documentation](https:\u002F\u002Fdocs.mistral.ai\u002F)\n\n## Next Steps\nFor major migrations, see `mistral-migration-deep-dive`.\n",{"name":5,"author":47,"license":15,"version":48,"description":49,"allowed-tools":50},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Configure Mistral AI enterprise access control and organization management.\nUse when implementing role-based permissions, managing team access,\nor setting up organization-level controls for Mistral AI.\nTrigger with phrases like \"mistral access control\", \"mistral RBAC\",\n\"mistral enterprise\", \"mistral roles\", \"mistral permissions\", \"mistral team\".\n","Read, Write, Edit","main","90b50ed0778745a80fd5bfb13b1843d45b9e82f7","tests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fmistral-pack\u002Fskills\u002Fmistral-enterprise-rbac",231,"https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust","https:\u002F\u002Fgithub.com\u002FDicklesworthstone","https:\u002F\u002Fwww.jeffreyemanuel.com\u002F","Building in NY","2026-11-12 03:15:57",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add Dicklesworthstone\u002Fpi_agent_rust --skill mistral-enterprise-rbac",{"tool":66,"command":67},"bunx","bunx skills add Dicklesworthstone\u002Fpi_agent_rust --skill mistral-enterprise-rbac",{"tool":69,"command":70},"pnpm","pnpm dlx skills add Dicklesworthstone\u002Fpi_agent_rust --skill mistral-enterprise-rbac","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fmistral-pack\u002Fskills\u002Fmistral-enterprise-rbac\u002FSKILL.md",true,[],[75,114,138,164,191,213],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":80,"sourceHtmlUrl":81,"categories":82,"keywords":88,"publishedAt":42},"01M6FEGPPK0ZTKCCM0R3E3KS33","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,34,107,108,109,110,111,25,112,113],"web artifacts builder","web","artifacts","artifacts builder","builder","frontend","css","components","react","component","routing","state management","state","shadcn","file","ui","Tools","Tailwind","html","single-file","simple","ui components","multi","jsx","suite",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":125,"publishedAt":42},"01M6FEE9VTK1W4GY21AKREJXRG","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[121,124],{"categoryNo":122,"categoryName":123,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[126,127,128,94,129,130,90,131,132,133,104,134,135,136,137,27,25],"testing","webapp testing","webapp","screenshots","playwright","debugging","toolkit","browser","logs","applications","behavior","local",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":142,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":42},"01M6FE20F7ZTQBFWKF4MPJ2SBX","neuropixels-analysis","Neuropixels neural recording analysis. Load SpikeGLX\u002FOpenEphys data, preprocess, motion correction, Kilosort4 spike sorting, quality metrics, Allen\u002FIBL curation, AI-assisted visual analysis, for Neuropixels 1.0\u002F2.0 extracellular electrophysiology. Use when working with neural recordings, spike sorting, extracellular electrophysiology, or when the user mentions Neuropixels, SpikeGLX, Open Ephys, Kilosort, quality metrics, or unit curation.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fneuropixels-analysis\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fneuropixels-analysis\u002FSKILL.md",[],[146,147,148,149,150,151,152,153,34,154,155,156,157,158,159,160,27,161,162,163,25,24],"analysis","neuropixels analysis","spike","metrics","data","open","quality","user","recordings","Neural","motion","visual","quality metrics","unit","sorting","curation","recording","load",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":168,"sourceHtmlUrl":169,"categories":170,"keywords":174,"publishedAt":42},"01M6FDP0PDK6F1GGX395C7625Z","skill-creator","Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FSKILL.md",[171],{"categoryNo":172,"categoryName":173,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000023","Skill与智能体开发",[175,176,177,178,179,180,181,182,183,184,185,186,187,188,27,25,189,24,190],"skill creator","creator","workflows","create","update","capabilities","knowledge","tool","integrations","specialized","guide","new skill","existing skill","users","Existing","new",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":195,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":42},"01M6FDM8Y7VK7NYG9SM7QPA3PW","notebooklm","Use this skill to query your Google NotebookLM notebooks directly from Claude Code for source-grounded, citation-backed answers from Gemini. Browser automation, library management, persistent auth. Drastically reduced hallucinations through document-only responses.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnotebooklm\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnotebooklm\u002FSKILL.md",[198],{"categoryNo":172,"categoryName":173,"taxonomyType":86,"taxonomyTypeDesc":87},[193,200,201,202,203,204,205,133,206,207,34,208,209,210,211,25,212],"google","browser automation","gemini","automation","auth","code","library","management","only","document","query","Citation","source",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":217,"sourceHtmlUrl":218,"categories":219,"keywords":226,"publishedAt":42},"01M6FDHPXE10J3XGTCH5HBHS1M","slack-gif-creator","Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like \"make me a GIF of X doing Y for Slack.\"","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FSKILL.md",[220,223],{"categoryNo":221,"categoryName":222,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":224,"categoryName":225,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000016","图像与多媒体",[227,228,229,176,230,105,231,232,181,34,233,188,234,235,236,25,237,24],"slack gif creator","slack","gif","validation","constraints","Animation","me","make","Utilities","concepts","request"]