[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H96MQ4DM0SFW0NFZN8B471":3,"skill-same:01M6H96MQ4DM0SFW0NFZN8B471":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6H96MQ4DM0SFW0NFZN8B471","twinmind-enterprise-rbac",null,"Implement enterprise role-based access control for TwinMind.\nUse when setting up team permissions, configuring SSO\u002FSAML,\nor implementing organization-level access policies.\nTrigger with phrases like \"twinmind RBAC\", \"twinmind permissions\",\n\"twinmind enterprise access\", \"twinmind SSO\", \"twinmind team management\".","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Ftwinmind-pack\u002Fskills\u002Ftwinmind-enterprise-rbac\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"rbac","twinmind enterprise rbac","Enterprise","use","for","implementing","with","trigger","io","control","Access Control","up","codex","access","team","sso","saml","permissions","code","implement","2026-11-10 10:12:30",false,"---\nname: twinmind-enterprise-rbac\ndescription: |\n  Implement enterprise role-based access control for TwinMind.\n  Use when setting up team permissions, configuring SSO\u002FSAML,\n  or implementing organization-level access policies.\n  Trigger with phrases like \"twinmind RBAC\", \"twinmind permissions\",\n  \"twinmind enterprise access\", \"twinmind SSO\", \"twinmind team management\".\nallowed-tools: Read, Write, Edit\nversion: 1.0.0\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\ncompatible-with: claude-code, codex, openclaw\n---\n# TwinMind Enterprise RBAC\n\n## Contents\n- [Overview](#overview)\n- [Prerequisites](#prerequisites)\n- [Instructions](#instructions)\n- [Output](#output)\n- [Error Handling](#error-handling)\n- [Examples](#examples)\n- [Resources](#resources)\n\n## Overview\nEnterprise-grade role-based access control for TwinMind with SSO\u002FSAML integration, team management, resource-level authorization, and access audit logging.\n\n## Prerequisites\n- TwinMind Enterprise account\n- Admin access to TwinMind organization\n- Identity provider (Okta, Azure AD, Google Workspace)\n- Understanding of RBAC concepts\n\n## Instructions\n\n### Step 1: Define Roles and Permissions\nCreate `Permission` enum covering transcript, summary, action item, team, settings, billing, and admin permissions. Define role hierarchy: Viewer -> Member -> Manager -> Admin -> Owner with permission inheritance via `resolvePermissions()`.\n\n### Step 2: Implement Permission Checking\nBuild `AuthorizationService` with `hasPermission()`, `hasAnyPermission()`, `hasAllPermissions()` methods. Support admin wildcard, explicit deny lists, and resource-level authorization (own transcripts vs all transcripts).\n\n### Step 3: Configure SSO\u002FSAML Integration\nSet up SAML strategy with passport-saml. Map IdP attributes (email, name, groups) to TwinMind users. Configure group-to-role mapping (e.g., \"TwinMind-Admins\" -> admin role).\n\n### Step 4: Team Management\nBuild `TeamManager` with create team, add\u002Fremove\u002Finvite members, role updates, and sync to TwinMind organization. Enforce permission checks on team operations.\n\n### Step 5: Access Audit Logging\nCreate `AccessAuditLogger` that records all access attempts (granted and denied) with user, action, resource, IP, and user agent. Send to SIEM if configured. Add Express middleware for automatic audit trail.\n\nSee [detailed implementation](${CLAUDE_SKILL_DIR}\u002Freferences\u002Fimplementation.md) for complete RBAC code including Permission enum, role definitions, SSO config, team management, and audit logging.\n\n## Output\n- Role and permission definitions\n- Permission checking service\n- SSO\u002FSAML configuration\n- Team management functionality\n- Access audit logging\n\n## Error Handling\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| SSO login failed | Certificate mismatch | Update IdP certificate |\n| Role not syncing | SCIM misconfigured | Check provisioning setup |\n| Permission denied | Wrong role assigned | Review role mapping |\n| Audit gaps | Middleware not applied | Add to all routes |\n\n## Examples\n\n\n**Basic usage**: Apply twinmind enterprise rbac to a standard project setup with default configuration options.\n\n**Advanced scenario**: Customize twinmind enterprise rbac for production environments with multiple constraints and team-specific requirements.\n\n## Resources\n- [TwinMind Enterprise](https:\u002F\u002Ftwinmind.com\u002Fenterprise)\n- [SAML 2.0 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fsecurity\u002Fsaml\u002Fv2.0\u002F)\n- [SCIM Protocol](https:\u002F\u002Fscim.cloud\u002F)\n\n## Next Steps\nFor migration from other tools, see `twinmind-migration-deep-dive`.","# TwinMind Enterprise RBAC\n\n## Contents\n- [Overview](#overview)\n- [Prerequisites](#prerequisites)\n- [Instructions](#instructions)\n- [Output](#output)\n- [Error Handling](#error-handling)\n- [Examples](#examples)\n- [Resources](#resources)\n\n## Overview\nEnterprise-grade role-based access control for TwinMind with SSO\u002FSAML integration, team management, resource-level authorization, and access audit logging.\n\n## Prerequisites\n- TwinMind Enterprise account\n- Admin access to TwinMind organization\n- Identity provider (Okta, Azure AD, Google Workspace)\n- Understanding of RBAC concepts\n\n## Instructions\n\n### Step 1: Define Roles and Permissions\nCreate `Permission` enum covering transcript, summary, action item, team, settings, billing, and admin permissions. Define role hierarchy: Viewer -> Member -> Manager -> Admin -> Owner with permission inheritance via `resolvePermissions()`.\n\n### Step 2: Implement Permission Checking\nBuild `AuthorizationService` with `hasPermission()`, `hasAnyPermission()`, `hasAllPermissions()` methods. Support admin wildcard, explicit deny lists, and resource-level authorization (own transcripts vs all transcripts).\n\n### Step 3: Configure SSO\u002FSAML Integration\nSet up SAML strategy with passport-saml. Map IdP attributes (email, name, groups) to TwinMind users. Configure group-to-role mapping (e.g., \"TwinMind-Admins\" -> admin role).\n\n### Step 4: Team Management\nBuild `TeamManager` with create team, add\u002Fremove\u002Finvite members, role updates, and sync to TwinMind organization. Enforce permission checks on team operations.\n\n### Step 5: Access Audit Logging\nCreate `AccessAuditLogger` that records all access attempts (granted and denied) with user, action, resource, IP, and user agent. Send to SIEM if configured. Add Express middleware for automatic audit trail.\n\nSee [detailed implementation](${CLAUDE_SKILL_DIR}\u002Freferences\u002Fimplementation.md) for complete RBAC code including Permission enum, role definitions, SSO config, team management, and audit logging.\n\n## Output\n- Role and permission definitions\n- Permission checking service\n- SSO\u002FSAML configuration\n- Team management functionality\n- Access audit logging\n\n## Error Handling\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| SSO login failed | Certificate mismatch | Update IdP certificate |\n| Role not syncing | SCIM misconfigured | Check provisioning setup |\n| Permission denied | Wrong role assigned | Review role mapping |\n| Audit gaps | Middleware not applied | Add to all routes |\n\n## Examples\n\n\n**Basic usage**: Apply twinmind enterprise rbac to a standard project setup with default configuration options.\n\n**Advanced scenario**: Customize twinmind enterprise rbac for production environments with multiple constraints and team-specific requirements.\n\n## Resources\n- [TwinMind Enterprise](https:\u002F\u002Ftwinmind.com\u002Fenterprise)\n- [SAML 2.0 Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fsecurity\u002Fsaml\u002Fv2.0\u002F)\n- [SCIM Protocol](https:\u002F\u002Fscim.cloud\u002F)\n\n## Next Steps\nFor migration from other tools, see `twinmind-migration-deep-dive`.",{"name":5,"author":43,"license":14,"version":44,"description":45,"allowed-tools":46,"compatible-with":47},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Implement enterprise role-based access control for TwinMind.\nUse when setting up team permissions, configuring SSO\u002FSAML,\nor implementing organization-level access policies.\nTrigger with phrases like \"twinmind RBAC\", \"twinmind permissions\",\n\"twinmind enterprise access\", \"twinmind SSO\", \"twinmind team management\".\n","Read, Write, Edit","claude-code, codex, openclaw","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","claude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Ftwinmind-pack\u002Fskills\u002Ftwinmind-enterprise-rbac",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add micsapp\u002Fmicstec-skills --skill twinmind-enterprise-rbac",{"tool":61,"command":62},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill twinmind-enterprise-rbac",{"tool":64,"command":65},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill twinmind-enterprise-rbac","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Ftwinmind-pack\u002Fskills\u002Ftwinmind-enterprise-rbac\u002FSKILL.md",true,[69],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fimplementation.md","REFERENCE","参考文档",6703,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Ftwinmind-pack\u002Fskills\u002Ftwinmind-enterprise-rbac\u002Freferences\u002Fimplementation.md",[76,111,139,157,177,202],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":92,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[82,87],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[93,94,95,96,97,98,99,100,101,102,32,103,104,105,106,107,108,109,110,22],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":125,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[117,118,121,124],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":119,"categoryName":120,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":122,"categoryName":123,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[126,127,128,129,94,130,36,131,132,133,134,135,102,32,108,136,137,109,138,23],"deployment","apiops deployment","workflows","azure devops","infrastructure","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[145],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[147,148,149,150,94,97,102,32,31,21,151,152,28,153,154,109,155,156,23,22],"policy","authoring","apim policy authoring","security","ready","api security","error","processing","cors configuration","production-ready",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":165,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[163,164],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[166,150,167,102,152,168,94,126,169,170,171,172,32,173,109,174,175,176,110,22],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[184,185,186,128,187,188,189,190,102,191,192,193,194,195,196,197,198,199,200,201],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[204,209,210,211,212,213,214,21,215,216],"npm","js","calculate","node","math","user","compute","errors"]