Claude Cursor GitHub Copilot Skill

preset-roles-permissions

Review Preset role, workspace membership, permission, access-control, DAR/RLS-adjacent, and effective-access changes through direct API calls. Use only for direct API workflows; Do not use for MCP-only work.

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download preset-io-agent-skills-plugins_preset-api-skills_skills_preset-roles-permissions-73d2674.zip · 1 KB

preset-io/agent-skills 12 1 forks Apache-2.0 Updated 14d ago

Part of preset-io/agent-skills — 28 skills

Install

skills CLI

npx skills add https://github.com/preset-io/agent-skills/tree/master/plugins/preset-api-skills/skills/preset-roles-permissions

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install preset-io-agent-skills@llmmart

Git git clone https://github.com/preset-io/agent-skills.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole preset-io/agent-skills collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

preset-roles-permissions

Use as the approval and access-review gate for permission-sensitive workflows.

Always

Auth and conventions come from preset-api (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known.
Use this skill alongside preset-admin role identifier and membership references for Management API role work.
Use preset-superset for workspace current-user roles, permissions, and OpenAPI availability.
Treat role and permission changes as permission_write.
Do not guess role IDs or custom role identifiers.
Do not use internal /api-internal/*, billing, SCIM, broad Superset security manager, or unsupported permission APIs from this skill; defer to references/role-permission-changes.md.
Require confirmation of target principal, current access, new access, seat impact, and rollback path.

Decision Rules

Classify role and permission changes as access mutations.
Resolve role identifiers before effect summary.
Require approval with target and effect.
Avoid applying role or permission changes until approval is explicit.

Workflow Order

Inspect membership roles and permissions.
Resolve target and role identifiers.
Summarize access effect, seat impact, and rollback path.
Stop before role or permission change.

Retrieve

Role/permission mutation guidance and approval checks: references/role-permission-changes.md
Approval policy: load preset-api and then references/safety-policy.md.

Files (agent-skills)

references

role-permission-changes.md 1.7 KB

# Role And Permission Changes

Role and permission changes can grant or revoke access to customer data, workspace assets, and administration workflows. Treat them as `permission_write`.

## Planning Essentials

For role or permission change review, first inspect membership roles and permissions. Resolve the target principal, dynamic workspace role identifier, and numeric `team_role_id` source before summarizing impact. Summarize current access, requested access, customer-data/admin effect, creator-seat risk, endpoint/body, and rollback path. Require explicit approval and stop before any role or permission mutation. Do not guess role IDs.

## Sources Of Truth

Use these references before mutating:

- `preset-admin/references/role-identifiers.md` for team role IDs and workspace role identifiers.
- `preset-admin/references/team-memberships.md` for team membership changes and seat preflights.
- `preset-admin/references/workspace-management.md` for workspace membership role changes.
- `preset-superset/references/current-user-and-permissions.md` for workspace current-user and role diagnostics.

## Confirmation Required

Before any role or permission mutation, summarize:

1. Team and workspace, if applicable.
2. Target user, group, service account, or invite.
3. Current role/access, including group-derived role status when visible.
4. New role/access.
5. Whether a creator seat may be consumed.
6. API endpoint and request body.
7. Rollback path.

Wait for explicit confirmation.

## Deferrals

Do not improvise examples for SCIM provisioning, internal permission APIs, billing/payment access, DAR changes, or broad Superset security manager routes unless they are explicitly approved and validated against the source code/OpenAPI for the target version.

SKILL.md 1.8 KB

---
name: preset-roles-permissions
description: Review Preset role, workspace membership, permission, access-control, DAR/RLS-adjacent, and effective-access changes through direct API calls. Use only for direct API workflows; Do not use for MCP-only work.
---

# preset-roles-permissions

Use as the approval and access-review gate for permission-sensitive workflows.

## Always

- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known.
- Use this skill alongside `preset-admin` role identifier and membership references for Management API role work.
- Use `preset-superset` for workspace current-user roles, permissions, and OpenAPI availability.
- Treat role and permission changes as `permission_write`.
- Do not guess role IDs or custom role identifiers.
- Do not use internal `/api-internal/*`, billing, SCIM, broad Superset security manager, or unsupported permission APIs from this skill; defer to `references/role-permission-changes.md`.
- Require confirmation of target principal, current access, new access, seat impact, and rollback path.

## Decision Rules

- Classify role and permission changes as access mutations.
- Resolve role identifiers before effect summary.
- Require approval with target and effect.
- Avoid applying role or permission changes until approval is explicit.

## Workflow Order

1. Inspect membership roles and permissions.
2. Resolve target and role identifiers.
3. Summarize access effect, seat impact, and rollback path.
4. Stop before role or permission change.

## Retrieve

- Role/permission mutation guidance and approval checks: [references/role-permission-changes.md](references/role-permission-changes.md)
- Approval policy: load `preset-api` and then `references/safety-policy.md`.