Agent skill · software engineering · jeremylongshore
procore-enterprise-rbac
Govern Procore DMSA and user access through endpoint-to-tool permission mapping, permitted projects, installation review, and negative tests. Use when designing least privilege, investigating 403 or hidden 404 responses, or upgrading an app manifest. Trigger with: "audit Procore permissions", "scope a Procore DMSA", "review Procore project access".
Why this skill is useful
Provides specific API call patterns and error handling for Procore's enterprise RBAC that the AI wouldn't reliably generate on its own.
What it needs
Requires procore account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Procore Permission and Project-Scope Governance Overview Procore access is the intersection of OAuth principal, tool permission, enabled project tool, project membership, permitted projects, and company routing. Manage these dimensions explicitly rather than treating a broad role label as the API contract. Prerequisites User or DMSA identity and installed app version Complete endpoint, method, company, project, and data-classification inventory Current permission builder output and administrator for the target company Instructions Step 1: Map operations to tools For each endpoint, record the company- or project-level Procore tool and minimum documented permission. Remove permissions that lack a current call-site owner. Step 2: Review the DMSA manifest Compare declared permissions with the inventory before releasing a new app version. Treat newly requested permissions as a reviewed contract change. Step 3: Review permitted projects List the projects selected during installation and compare them with the approved tenant scope. Remember that administrators may need to reconfigure permitted projects after app update or reinstall. Step 4: Avoid manual drift Use App Management and the intended manifest workflow. Investigate directory-level manual adjustments because they can diverge from app permissions and complicate upgrades. Step 5: Test both sides Run approved reads for required tools and expected-denial tests for an unpermitted project and an unnecessary operation. Treat excess access as a release blocker. Step 6: Record approval Capture app version, permission diff, project-scope diff, administrator decision, test results, and rollback procedure without exposing tenant data. Authentication API calls use OAuth 2.0 Bearer tokens. Authorization Code assumes the current user's permissions; DMSA Client Credentials assumes the DMSA permissions and permitted-project configuration established through installation. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/procore-enterprise-rbac--266908