Agent skill · security · jeremylongshore
palantir-enterprise-rbac
Design and audit Foundry access using projects, group role grants, mandatory controls, and Developer Console restrictions. Use when onboarding teams, service users, or applications. Trigger with "Palantir RBAC" or "Foundry access review".
Why this skill is useful
Provides specific role-based access control configurations and service user setup for Palantir Foundry that the AI wouldn't reliably generate on its own.
What it needs
Requires palantir account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Palantir Foundry Access-Control Design Overview Treat access as the intersection of several control planes. Project roles govern discretionary capabilities, mandatory controls continue to apply, and OAuth application restrictions constrain API clients independently. Prerequisites Identify the resources, projects, spaces, organizations, markings or CBAC requirements, groups, users, service users, and Developer Console applications in scope. Name the data owner, project owner, application owner, information-security owner, and access-review cadence. Read references/official-docs.md and use the Check access panel for concrete principals and resources. Begin with a read-only entitlement inventory; do not grant access while discovering it. Current Contract Default project roles are Owner, Editor, Viewer, and Discoverer, and deployments may also define custom roles. Palantir recommends group role grants at the project level to reduce individual-grant sprawl. Organizations, markings, and CBAC can deny access even when a project role is present. Developer Console token authority is limited by the user/service-user permissions, application restrictions, and requested OAuth scope. Authentication For API clients, record the OAuth grant type, service user or delegated user, requested scopes, and Developer Console resource/operation restrictions. Never treat possession of a token as evidence that the underlying principal should have access. Instructions 1. Build a matrix of principal or group, project role, resource purpose, mandatory requirements, application restrictions, owner, and expiry. 2. Replace unnecessary direct user grants with reviewed group grants while preserving break-glass and accountable-owner requirements. 3. Use Check access on representative resources to explain both discretionary and mandatory requirements for each persona. 4. For service applications, restrict the Developer Console client to the minimum operations and Ontology or Platform SDK resources. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/palantir-enterprise-rbac