Agent skill · security · jeremylongshore
palantir-security-basics
Establish a Foundry security baseline for users, service applications, data resources, Ontology policies, logs, and exports. Use when onboarding, reviewing architecture, or hardening a release. Trigger with "Palantir security".
Why this skill is useful
Provides specific security practices and scripts for managing Palantir Foundry credentials and access control that are not widely known.
What it needs
Requires palantir account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Palantir Foundry Security Baseline Overview Apply least privilege across discretionary roles, mandatory controls, OAuth clients, Ontology policies, logs, and exports. Test both intended access and denial because each control plane covers a different boundary. Prerequisites Identify owners, users/groups, service users, projects, organizations, markings/CBAC, datasets, Ontology resources, applications, logs, exports, and incident contacts. Classify the maximum data sensitivity and writeback impact for the workflow. Read references/official-docs.md and the target enrollment's policies. Begin with a read-only inventory and approved synthetic test personas. Current Contract Projects and roles govern discretionary access; organizations, markings, and CBAC remain mandatory. Developer Console application restrictions and OAuth scopes constrain API clients alongside user/service-user permissions. Ontology object/property policies support granular read controls, but mandatory controls are needed where downstream propagation matters. Logs and audit exports may contain sensitive values and require explicit access, marking, audience, and retention decisions. Authentication Prefer the grant designed for the architecture, keep secrets in an approved manager, restrict resources and operations, request minimum scopes, and assign rotation/revocation owners. Never use personal tokens for unattended production workloads. Instructions 1. Inventory every principal and control plane, then map each permission to a business purpose, resource, owner, and expiry. 2. Move routine access to groups and reduce project roles to the minimum capability. 3. Restrict Developer Console clients to required Ontology entities or Platform operations and verify the acting principal separately. 4. Apply object/property policies and mandatory controls according to read and propagation requirements. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/palantir-security-basics--4211d1