Agent skill · forcedotcom
service-itsm-agentic-setup-cmdb-access-assign
Grant a specific user access to CMDB (Configuration Management Database) data in Service Cloud ITSM against a production or sandbox org by assigning the license-backed CMDB permission sets (Configuration Item Reader, Owner, Type Reader, Type Manager) and their permission-set licenses. Use when the user asks to give someone CMDB access, assign CMDB permission sets, grant a user the Configuration Item Reader/Owner role, or fix a CMDB 403 FUNCTIONALITY_NOT_ENABLED that a user still hits after the CMDB feature is already enabled. Triggers on: assign CMDB permission set, grant CMDB access, give user Configuration Item access, CMDB access for user, user still gets CMDB 403 after enable. DO NOT TRIGGER when: the user wants to turn on the CMDB feature or provision the CMDB tenant for the whole org (that is the CMDB feature-enable skill), only install a CMDB content bundle, work with CMDB records directly, or assign general (non-CMDB) permission sets to users (use dx-org-permission-set-assign).
What it needs
About 11k tokens when loaded.
What this skill does
Assign a User CMDB Access (Service Cloud ITSM) Grants a specific user the ability to read and work with CMDB (Configuration Management Database) data by assigning the license-backed CMDB permission sets and their permission-set licenses. Every call runs through the Salesforce-hosted Headless-360 MCP server (server key headless-360) via its four meta-tools (discover, describe, dispatchreadonly, dispatch). The org is derived from the OAuth JWT bound to the current MCP session — the skill never handles an org id, alias, or credentials — so this works identically against production and sandbox with no per-user MCP install. This is Layer 3 of CMDB setup. It assumes the org-level CMDB gate is already lifted (the feature is ENABLED) — that is a separate skill (service-itsm-agentic-setup-cmdb-configure, Layers 0–2). This skill grants a user access; it does not enable the feature for the org. The gap this skill closes Enabling the CMDB feature lifts the org-level gate, but some CMDB reads (e.g. bundleListView) also enforce user-level access. A user with no CMDB permission sets still gets 403 FUNCTIONALITYNOTENABLED ("not enabled for this user") even when the feature is correctly ENABLED for the org. This skill assigns that user the CMDB permission sets so those reads succeed. This skill is a no-op if the org feature is not enabled. User-level access has no effect until the org-level CMDB feature is ENABLED. If you find the org gate is still closed, stop and tell the user the CMDB feature must be turned on for the org first — see the cross-skill note at the end. The four CMDB permission sets Each is a license-backed Standard permission set; assigning it also requires (and this skill assigns) its permission-set license (PSL). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills forcedotcom/service-itsm-agentic-setup-cmdb-access-assign