Agent skill · security · jeremylongshore
openevidence-enterprise-rbac
Define and verify institutional OpenEvidence access governance without inventing RBAC, SCIM, or administration APIs. Use when working with OpenEvidence in a healthcare organization. Trigger with "openevidence enterprise rbac", "OpenEvidence access", or a matching workflow request.
Why this skill is useful
Provides specific TypeScript functions and compliance patterns for managing RBAC in healthcare settings, which are not commonly known.
What it needs
Requires openevidence account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
OpenEvidence Institutional Access Governance Overview Translate institutional roles and least-privilege expectations into verifiable product and contract controls. Keep inputs minimal, separate observed facts from assumptions, and leave consequential decisions with the named accountable owner. Prerequisites A clearly bounded workflow, accountable clinical owner, and organizational policy Current first-party OpenEvidence documentation and applicable institution agreements Synthetic or properly authorized minimum-necessary data Tool Discipline Use Read, Glob, and Grep to inspect supplied policies, plans, and evidence. Use WebFetch only for current first-party OpenEvidence documentation. Use Write or Edit only when the user requests a named deliverable with an approved destination. Never expose credentials, PHI, recordings, or unrestricted environment output. Current Contract No public RBAC, SCIM, provisioning, or administration API contract was found in the audited product documentation. Only the current institution agreement and authorized administration interface can establish available controls. Shared credentials are prohibited by the published account terms. Authentication Use only the official OpenEvidence web/mobile sign-in or an institution-approved access path. Do not invent API keys, OAuth clients, SDK credentials, service accounts, or private endpoints. Never ask a user to reveal a password, session token, cookie, or recovery code. Instructions 1. Inventory user populations, clinical roles, administrators, support staff, devices, workflows, and sensitive data exposure. 2. Read the agreement and authorized admin documentation; mark SSO, provisioning, audit, and role features confirmed or unknown. 3. Define joiner, mover, leaver, periodic review, break-glass, and compromised-account procedures. 4. Map each workflow to minimum access and an accountable approver; prohibit shared accounts. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/openevidence-enterprise-rbac