Agent skill · product strategy · jeremylongshore
navan-enterprise-rbac
Map Navan account roles and integration privileges to application-owned enterprise controls. Use when designing admin, API, SFTP, SCIM, SSO, finance, or support access. Trigger with "Navan RBAC", "Navan permissions", or "review Navan access".
Why this skill is useful
Provides specific API commands and configurations for managing enterprise RBAC and travel policies in Navan that the AI wouldn't reliably generate on its own.
What it needs
Requires navan account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Navan Enterprise Access Governance Overview Map Navan account roles and integration privileges to application-owned enterprise controls. This workflow produces an auditable decision or artifact before any live action. Prerequisites Access to the selected tenant's current Navan Help Center and contracted integration documentation. A named business owner and data owner for the travel or expense workflow. A non-production evidence set with secrets and traveler data removed. Current Contract Public integration listings confirm identity and user-management options, but exact Navan roles and entitlements are account-specific. Capture them from the current tenant and never invent universal role names or assignment APIs. Authentication Separate human login, organization administration, provisioning, data ingestion, finance reconciliation, write-back, and support access. Bind automation identities to one purpose and tenant. Instructions 1. Inventory human roles, groups, integration identities, and current privileges. 2. Map each business action and data class to least-privilege access. 3. Document SSO, SCIM, HRIS, manual, and break-glass authority paths. 4. Identify toxic combinations across booking, expense, payment, approval, and export. 5. Define joiner, mover, leaver, periodic review, and emergency revocation controls. 6. Test denied paths and reconcile Navan assignments with the enterprise source of authority. Tool Discipline Use Read, Glob, and Grep to inspect documentation, schemas, configuration, code, fixtures, and evidence. Use Write and Edit only for approved repository artifacts. Invocation alone does not authorize network access, credentials, traveler or expense data, bookings, payments, policy or identity changes, file transfers, deployments, or deletion. Approval Boundaries Admin grants, provisioning changes, finance or payment privileges, break-glass use, service identities, and cross-tenant access require named approvers. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/navan-enterprise-rbac