Agent skill · software engineering · jeremylongshore
linear-enterprise-rbac
Govern Linear workspace roles, team access, OAuth scopes, SCIM provisioning, and audit evidence. Use when designing enterprise access or reviewing identity-provider mappings. Trigger with "audit Linear access", "configure Linear SCIM", or "review Linear roles".
Why this skill is useful
Provides specific implementation patterns for Linear's RBAC, OAuth scopes, and SSO that the AI wouldn't reliably generate on its own.
What it needs
Requires linear account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Linear Enterprise Access Governance Overview Model access from the workspace's actual plan, roles, teams, OAuth actor, and identity-provider ownership instead of inventing application-side Linear roles. Prerequisites The target repository, Linear workspace, environment, and accountable owner Current security, privacy, compliance, capacity, and change-control requirements An approved Linear credential only when a bounded live verification is necessary Tool Discipline Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Linear documentation and package metadata. Use Write or Edit only for requested implementation with known target files. Never write credentials, customer content, unrestricted environment output, or unredacted GraphQL variables. Current Contract Workspace Owner exists only on Enterprise; Team Owner exists on Business and Enterprise; Free-plan users are admins. SCIM 2.0 is an Enterprise capability. Linear supplies the base connector URL and bearer token in security settings; do not hard-code a guessed endpoint. SCIM group push can map groups one-to-one to teams, and special linear-owners, linear-admins, and linear-guests groups control roles. Enterprise audit logs retain 90 days of events and are accessible only to workspace owners. Authentication Use a personal API key only for owner-controlled scripts, OAuth with PKCE for user-delegated applications, or an enabled client-credentials grant for approved automation. Personal keys use Authorization: <APIKEY>; OAuth tokens use Authorization: Bearer <ACCESSTOKEN>. Store credentials server-side in an approved secret manager. Treat app approval, team access, scope changes, credential creation, rotation, revocation, and production access as owner-approved actions. Instructions 1. Confirm plan, workspace owners, admins, team owners, members, guests, private teams, and existing SCIM ownership. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/linear-enterprise-rbac