Agent skill · marketing growth · jeremylongshore
mistral-enterprise-rbac
Design Mistral organization, workspace, role, service-account, workload-identity, and application RBAC boundaries. Use when governing enterprise access. Trigger with "Mistral RBAC", "manage Mistral workspaces", or "audit Mistral service access".
Why this skill is useful
Provides specific API commands and organizational strategies for managing Mistral AI access control that the AI wouldn't reliably generate on its own.
What it needs
Requires mistral account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Mistral Enterprise Access Governance Overview Separate provider administration from application authorization. Provider controls govern resources/capacity; the application still enforces users, tenants, data, and tools. Prerequisites An identity source, joiner/mover/leaver process, and access owner. Organization/workspace inventory, role catalog, service identities, and break-glass policy. Current roles, service-account, workload-identity, and audit evidence. Current Contract Mistral documents workspaces, groups, roles, service accounts, workload identity, keys, and audit logs. Exact entitlements and plan access come from current admin evidence. Authentication Prefer approved non-human service identities. API keys authenticate provider calls but never substitute for application user identity or tenant authorization. Instructions 1. Inventory users, groups, roles, service accounts, workload identities, keys, and membership. 2. Map least-privilege provider permissions and separate billing, security, and runtime duties. 3. Define app roles/tenant checks separately for prompts, files, retrieval, tools, and output. 4. Set provisioning, review, expiration, rotation, revocation, and break-glass controls. 5. Verify audit coverage for critical admin actions and evidence retention. 6. Test joiner, mover, leaver, compromised service, wrong workspace, and emergency access. Tool Discipline Use Read, Glob, and Grep to inspect code, locks, configuration, tests, and evidence. Use Write and Edit only for approved repository changes. Invocation alone does not authorize network calls, paid usage, uploads, stateful resources, admin mutations, deployments, or deletion. Approval Boundaries Any user, group, role, workspace, service account, workload identity, key, or break-glass mutation requires authorized administration. Error Handling Broad workspace roles expose resources even when UI hides them. Shared human keys defeat attribution/offboarding. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/mistral-enterprise-rbac