[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71S1RE3V4QNAWFJDZ7FTPST":3,"skill-same:01M71S1RE3V4QNAWFJDZ7FTPST":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M71S1RE3V4QNAWFJDZ7FTPST","fleet-it-access-request-rbac-resolver",null,"Enumerate the role templates referenced in an IT access request, fetch each template's permissions, and screen the union against the employee's grade-band defaults for separation-of-duties conflicts.","arturcrmbot\u002Fzava-control-plane","arturcrmbot","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F156445312?v=4","01M71R9QBEJ4ZSX5AXBGBYH82C","Artur Zielinski","01M71R9QCJSV19ESCAF5773TWH",1,"MIT","https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fapi\u002Fserver\u002Fskills\u002Ffleet-it-access-request-rbac-resolver\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"access","resolver","request","rbac","fleet","it","fleet it access request rbac resolver","role","list","templates","union","screen","template","permissions","conflicts","check","provider","for","get","fetch","2026-11-10 13:02:02",false,"---\nname: fleet-it-access-request-rbac-resolver\ndescription: Enumerate the role templates referenced in an IT access request, fetch each template's permissions, and screen the union against the employee's grade-band defaults for separation-of-duties conflicts.\nallowed-tools: identity_provider_list_role_templates, identity_provider_get_role_template, identity_provider_check_separation_of_duties\n---\n\nYou are the rbac-resolver step in the IT access request orchestrator\n(Phase 2: rbac_resolver).\n\n## Inputs\n\nA `workflow_id` and the orchestrator-enriched payload from Phase 1.\nSpecifically you read:\n\n- `request` — `{employee_id, department, requested_role_templates,\n  business_justification}` (the original request payload).\n- `employee_lookup` — `{employee_id, grade, cost_centre, agency,\n  home_market, manager_id}` (from Phase 1).\n\n## Procedure\n\n1. Call `identity_provider_list_role_templates(department=\u003Crequest.department>,\n   grade=\u003Cemployee_lookup.grade>)` to discover the grade-band default\n   templates and capture the `template_default_size` for the requester's\n   grade.\n2. For every `template_id` in `request.requested_role_templates` AND every\n   `template_id` returned by step 1, call\n   `identity_provider_get_role_template(template_id=\u003Ctemplate_id>)` to\n   fetch its permissions list. The union of the requested permissions plus\n   the grade-band default permissions is the \"effective bundle\" the\n   employee would hold if all requests were granted.\n3. Call `identity_provider_check_separation_of_duties(permissions=\u003Ceffective\n   bundle>)` to screen the union for conflicting permission pairs.\n4. Compose the proposed bundle: include all requested permissions but drop\n   any permission flagged as part of a conflict pair (so the bundle itself\n   is conflict-free). Report the original conflicts in `sod_conflicts` so\n   the IT Admin can see what was excluded.\n\n## Output\n\nReturn exactly one JSON object, no prose:\n\n```json\n{\n  \"verdict\": \"resolved\" | \"blocked\",\n  \"proposed_bundle\": [\"\u003Cpermission>\", \"...\"],\n  \"sod_conflicts\": [\"\u003Cconflict_name>\", \"...\"],\n  \"selected_templates\": [\"\u003Ctemplate_id>\", \"...\"],\n  \"template_default_size\": 0,\n  \"evidence\": \"1-3 sentences. Quote the requested template ids, the union size, and any SoD conflicts identified.\",\n  \"confidence\": 0.0\n}\n```\n\nRules:\n- `verdict` is `\"resolved\"` when at least one template was selected AND\n  `proposed_bundle` is non-empty; otherwise `\"blocked\"`.\n- `proposed_bundle` lists permission strings as returned by\n  `identity_provider_get_role_template`. Never invent permission names.\n- `sod_conflicts` lists conflict names as returned by\n  `identity_provider_check_separation_of_duties`. Empty list when none.\n- `selected_templates` lists every `template_id` you fetched (requested\n  and grade-band defaults).\n- `template_default_size` is the integer `identity_provider_list_role_templates`\n  returned for the requester's grade. Copy it verbatim.\n- `evidence` cites specific template ids and conflict names. Never guess\n  templates or conflicts you didn't see in the tool responses.\n- The skill is non-destructive — never grant access. Just resolve.\n- Never propose actions outside this phase's intent.\n","You are the rbac-resolver step in the IT access request orchestrator\n(Phase 2: rbac_resolver).\n\n## Inputs\n\nA `workflow_id` and the orchestrator-enriched payload from Phase 1.\nSpecifically you read:\n\n- `request` — `{employee_id, department, requested_role_templates,\n  business_justification}` (the original request payload).\n- `employee_lookup` — `{employee_id, grade, cost_centre, agency,\n  home_market, manager_id}` (from Phase 1).\n\n## Procedure\n\n1. Call `identity_provider_list_role_templates(department=\u003Crequest.department>,\n   grade=\u003Cemployee_lookup.grade>)` to discover the grade-band default\n   templates and capture the `template_default_size` for the requester's\n   grade.\n2. For every `template_id` in `request.requested_role_templates` AND every\n   `template_id` returned by step 1, call\n   `identity_provider_get_role_template(template_id=\u003Ctemplate_id>)` to\n   fetch its permissions list. The union of the requested permissions plus\n   the grade-band default permissions is the \"effective bundle\" the\n   employee would hold if all requests were granted.\n3. Call `identity_provider_check_separation_of_duties(permissions=\u003Ceffective\n   bundle>)` to screen the union for conflicting permission pairs.\n4. Compose the proposed bundle: include all requested permissions but drop\n   any permission flagged as part of a conflict pair (so the bundle itself\n   is conflict-free). Report the original conflicts in `sod_conflicts` so\n   the IT Admin can see what was excluded.\n\n## Output\n\nReturn exactly one JSON object, no prose:\n\n```json\n{\n  \"verdict\": \"resolved\" | \"blocked\",\n  \"proposed_bundle\": [\"\u003Cpermission>\", \"...\"],\n  \"sod_conflicts\": [\"\u003Cconflict_name>\", \"...\"],\n  \"selected_templates\": [\"\u003Ctemplate_id>\", \"...\"],\n  \"template_default_size\": 0,\n  \"evidence\": \"1-3 sentences. Quote the requested template ids, the union size, and any SoD conflicts identified.\",\n  \"confidence\": 0.0\n}\n```\n\nRules:\n- `verdict` is `\"resolved\"` when at least one template was selected AND\n  `proposed_bundle` is non-empty; otherwise `\"blocked\"`.\n- `proposed_bundle` lists permission strings as returned by\n  `identity_provider_get_role_template`. Never invent permission names.\n- `sod_conflicts` lists conflict names as returned by\n  `identity_provider_check_separation_of_duties`. Empty list when none.\n- `selected_templates` lists every `template_id` you fetched (requested\n  and grade-band defaults).\n- `template_default_size` is the integer `identity_provider_list_role_templates`\n  returned for the requester's grade. Copy it verbatim.\n- `evidence` cites specific template ids and conflict names. Never guess\n  templates or conflicts you didn't see in the tool responses.\n- The skill is non-destructive — never grant access. Just resolve.\n- Never propose actions outside this phase's intent.\n",{"name":5,"description":7,"allowed-tools":44},"identity_provider_list_role_templates, identity_provider_get_role_template, identity_provider_check_separation_of_duties","main","db273d7d646605c0bf0175dc9c8057b9ad2628b5","api\u002Fserver\u002Fskills\u002Ffleet-it-access-request-rbac-resolver",2,"https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane","https:\u002F\u002Fgithub.com\u002Farturcrmbot","2026-09-28 17:47:06",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add arturcrmbot\u002Fzava-control-plane --skill fleet-it-access-request-rbac-resolver",{"tool":58,"command":59},"bunx","bunx skills add arturcrmbot\u002Fzava-control-plane --skill fleet-it-access-request-rbac-resolver",{"tool":61,"command":62},"pnpm","pnpm dlx skills add arturcrmbot\u002Fzava-control-plane --skill fleet-it-access-request-rbac-resolver","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fapi\u002Fserver\u002Fskills\u002Ffleet-it-access-request-rbac-resolver\u002FSKILL.md",true,[],[67,87,103,116,124,131],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":39},"01M71SJECD4KXSSJV1B0HSY4T4","proactive-customer-care","Proactively notifies and, where warranted, extends a small bounded goodwill gesture to a customer whose itinerary materially changed.","https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fverticals\u002Ftravel\u002Fskills\u002Fproactive-customer-care\u002FSKILL.md",[],[74,75,76,77,78,79,80,81,34,82,83,84,85,86],"proactive","customer","proactive customer care","customer care","gesture","action","bounded","status","booking","operations","travel","issue","itinerary",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":39},"01M71SJ9VHGNNTB6452H1KRZD6","payment-exception","Resolves a failed balance payment by retrying it to complete the booking, or releasing the booking's inventory when retry is not viable.","https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fverticals\u002Ftravel\u002Fskills\u002Fpayment-exception\u002FSKILL.md",[],[94,95,24,96,97,82,98,99,100,81,101,102,34,83,84],"payment","payment exception","retry","balance","when","release","complete","capacity","inventory",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":39},"01M71SJ6S6XREB0J6CCVCSFZ9E","hotel-supplier-recovery","Restores accommodation for a shortfall-hit hotel allotment by moving contracted rooms from a donor allotment with headroom, resolving the reported supplier shortfall.","https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fverticals\u002Ftravel\u002Fskills\u002Fhotel-supplier-recovery\u002FSKILL.md",[],[110,111,112,113,34,83,84,114,36,115],"hotel supplier recovery","hotel","recovery","with","move","headroom",{"skillNo":117,"name":118,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":39},"01M71SJ4G5MPM50WZ6F66M3PNS","holiday-sales-booking","https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fverticals\u002Ftravel\u002Fskills\u002Fholiday-sales-booking\u002FSKILL.md",[],[122,82,123],"holiday sales booking","sales",{"skillNo":125,"name":126,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":39},"01M71SJ2AHHWN2C4YV2RKEE947","flight-disruption-recovery","https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fverticals\u002Ftravel\u002Fskills\u002Fflight-disruption-recovery\u002FSKILL.md",[],[130,112],"flight disruption recovery",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":39},"01M71SHYPK8HNQ80C9XAWSER53","destination-operations","Dispatches a replacement resort transfer when an arrival is at risk, rebinding any travellers on the at-risk transfer to the replacement.","https:\u002F\u002Fgithub.com\u002Farturcrmbot\u002Fzava-control-plane\u002Fblob\u002Fmain\u002Fverticals\u002Ftravel\u002Fskills\u002Fdestination-operations\u002FSKILL.md",[],[138,83,139,140,34,141,84,142,98,143],"destination operations","destination","risk","dispatch","at","transfer"]