Agent skill · software engineering · jeremylongshore
persona-reference-architecture
Design an account-linked KYC control plane around Persona with explicit trust, data, event, and decision boundaries. Use when conducting an architecture review. Trigger with: "architect Persona integration", "Persona KYC design", "design identity workflow".
Why this skill is useful
Provides specific implementation details and error handling for integrating with the Persona API for KYC services.
What it needs
Requires requests installed locally. Requires persona account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Account-Linked KYC Control Plane with Persona Overview Put Persona behind a server-side identity orchestration boundary. The application owns subject identity, operation idempotency, policy and decisions; Persona owns inquiry and verification resources; authenticated events plus reconciliation connect the two. Prerequisites System context, data classification, and threat model Business and regulatory decision policy Availability, latency, retention, residency, and recovery requirements Instructions Step 1: Draw trust boundaries Separate client, application API, orchestration service, secret store, Persona REST API, embedded inquiry flow, webhook edge, durable queue, decision engine, and reviewer console. Step 2: Define authoritative identifiers Map internal subject to Persona account and inquiry IDs. Store operation IDs and event IDs under uniqueness constraints; do not make PII the join key. Step 3: Design commands and sessions Create inquiries with durable idempotency and supported account-auto-create metadata. Issue or resume sessions only through authenticated subject ownership. Step 4: Design event intake Terminate HTTPS, retain raw bytes, verify timestamped HMAC, persist before acknowledgement, deduplicate, order by provider creation time, and tolerate unknown event types. Step 5: Separate evidence from decision Normalize verification resources conservatively, then apply a versioned internal policy with explicit review and appeal paths. Step 6: Engineer recovery and privacy Use durable queues, GET reconciliation, bounded retries, environment and quota controls, data minimization, retention, irreversible-redaction governance, and tested rollback. Authentication The server-side REST boundary owns environment bearer keys; the webhook edge owns signing secrets; the client receives only its inquiry session token. No credential crosses those roles. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/persona-reference-architecture--17d97c