Claude Cursor GitHub Copilot Skill

preset-embedded-rls

Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download preset-io-agent-skills-plugins_preset-api-skills_skills_preset-embedded-rls-73d2674.zip · 1 KB

preset-io/agent-skills 12 1 forks Apache-2.0 Updated 15d ago

Part of preset-io/agent-skills — 28 skills

Install

skills CLI

npx skills add https://github.com/preset-io/agent-skills/tree/master/plugins/preset-api-skills/skills/preset-embedded-rls

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install preset-io-agent-skills@llmmart

Git git clone https://github.com/preset-io/agent-skills.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole preset-io/agent-skills collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

preset-embedded-rls

Use before guest-token creation when embedded viewers need row-level security.

Always

Auth and conventions come from preset-api (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.
Do not invent tenant identifiers, filters, dataset columns, or access rules.
Treat RLS clauses as permission controls that can leak or hide customer data.
Confirm every clause and intended viewer population before token creation.
Do not validate with broad data-returning queries unless the user approves target and limit.

Decision Rules

Classify embedded RLS review as plan-only safety work.
Identify tenant and user filter safety issues.
Require approval before clauses are used in token claims.
Avoid mutating embedded RLS configuration.

Workflow Order

Inspect embedded RLS clauses.
Flag unsafe tenant and user filters.
Summarize approval requirements.
Stop before using clauses in tokens.

Retrieve

Embedded RLS rule design and review: references/embedded-rls-rules.md

Files (agent-skills)

references

embedded-rls-rules.md 1.3 KB

# Embedded RLS Rules

Embedded row-level security limits data visible to external viewers through guest-token claims. Bad RLS can expose customer data or incorrectly block access.

## Inputs To Resolve

Before preparing `rls_rules`, resolve:

1. Embedded dashboard UUID or dashboard ID.
2. Dataset IDs or tables behind the dashboard, when relevant.
3. Tenant, account, customer, region, or user identity field.
4. Exact allowed value or predicate.
5. Whether the clause should apply to every dataset in the dashboard.

Do not guess these values.

## Guest Token Payload Mapping

Prepare `rls_rules` as reviewed clauses, then map them to the guest-token payload's `rls` field:

```python
rls_rules = [
    {"clause": "tenant_id = 'approved-tenant-id'"},
]

payload = {
    "user": {"username": "external-user-id"},
    "resources": [{"type": "dashboard", "id": embedded_dashboard_uuid}],
    "rls": rls_rules,
}
```

## Confirmation Required

Before using these clauses in a guest token, summarize:

1. Workspace hostname.
2. Dashboard or embedded dashboard UUID.
3. Dataset/table assumptions.
4. Each RLS clause.
5. External viewer population.
6. Expected data visibility.

Wait for explicit confirmation before token creation.

If the user cannot confirm the clauses, stop and ask for the approved tenant or access-control rule.

SKILL.md 1.4 KB

---
name: preset-embedded-rls
description: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.
---

# preset-embedded-rls

Use before guest-token creation when embedded viewers need row-level security.

## Always

- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.
- Do not invent tenant identifiers, filters, dataset columns, or access rules.
- Treat RLS clauses as permission controls that can leak or hide customer data.
- Confirm every clause and intended viewer population before token creation.
- Do not validate with broad data-returning queries unless the user approves target and limit.

## Decision Rules

- Classify embedded RLS review as plan-only safety work.
- Identify tenant and user filter safety issues.
- Require approval before clauses are used in token claims.
- Avoid mutating embedded RLS configuration.

## Workflow Order

1. Inspect embedded RLS clauses.
2. Flag unsafe tenant and user filters.
3. Summarize approval requirements.
4. Stop before using clauses in tokens.

## Retrieve

- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)