Agent skill · design visual · jeremylongshore
canva-enterprise-rbac
Implement application-owned authorization from Canva scopes, user capabilities, resource ownership, and tenant policy. Use when gating Enterprise or privileged operations without inventing a Canva custom-role API. Trigger with: "Canva RBAC", "check Canva capability", "authorize Canva action".
Why this skill is useful
Provides specific implementation patterns for managing RBAC with Canva's API that the AI wouldn't reliably generate on its own.
What it needs
Requires canva account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Capability-Aware Authorization Overview Use Canva scopes and capabilities as provider inputs to your own authorization decision. Do not equate OAuth consent with tenant role, resource ownership, feature entitlement, or approval to process content. Prerequisites Application roles, actions, tenants, and deny-by-default policy Current explicit Canva scopes and capability response contract Resource ownership and data-classification checks Instructions Step 1: Define the decision tuple Name subject, tenant, application role, action, resource, environment, requested Canva operation, and data class. Step 2: Separate provider inputs Treat granted scopes, capability fields, resource access, and preview availability as independent facts. Absence, unknown values, or stale evidence must deny. Step 3: Map application policy Use Write or Edit to map each application action to minimum scopes, required capability evidence, ownership rule, approval, and audit class. Step 4: Enforce server-side Resolve the policy after authenticated tenant identity and before dispatch. Keep the generic Canva client unaware of business roles. Step 5: Handle changes Invalidate cached decisions after scope, membership, consent, capability, policy, or resource-owner changes; require reauthorization only when scopes changed. Step 6: Audit without content Record policy version, opaque subject/resource references, decision inputs, allow/deny result, and reason code without tokens or design contents. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically. Tool Discipline Use Read and Grep for discovery and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-enterprise-rbac