Agent skill · software engineering · jeremylongshore
ramp-enterprise-rbac
Audit effective Ramp integration authority across OAuth grants, scopes, user roles, business entities, app restrictions, and spend approvals. Use when onboarding an enterprise tenant or investigating excess access. Trigger with "Ramp RBAC audit" or "Ramp least privilege".
Why this skill is useful
Provides specific API call patterns and error handling for Ramp's enterprise RBAC that the AI wouldn't reliably generate on its own.
What it needs
Requires ramp account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Ramp Enterprise Authority and Scope Review Overview Ramp API authority is layered. Build an effective-access matrix rather than treating an OAuth scope as the whole permission decision, and verify both allowed and denied operations per business entity. Prerequisites Identify the Ramp application, environment, business entities, affected data and workflows, accountable owner, and rollback boundary. Read references/official-docs.md and re-check endpoint schemas, scopes, limits, and support status before a live operation. Use synthetic fixtures or Ramp sandbox until production access and business effects are explicitly approved. Prepare approved secret storage and a sanitized evidence location. Current Contract Client Credentials represents an internal backend acting with application authority; Authorization Code represents an authorizing user and is required for third-party multi-tenant apps. Tokens are scope-bound and environment-bound, and scopes cannot be expanded after issuance. Only appropriately privileged users, typically Admin or Business Owner, can authorize Developer API applications. Resource behavior also depends on business entity, user role, object ownership, spend controls, and endpoint-specific permissions. Instructions 1. Inventory applications, environments, grant types, redirect URIs, client owners, scopes, authorizing or service principals, entities, subscriptions, and credential rotation. 2. Map each business operation to exact endpoint, HTTP verb, scope, entity, role, spend approval, data class, and accountable owner. 3. Remove unused scopes and stale clients, then issue new tokens because existing tokens do not acquire changed scopes. 4. Run positive tests for intended reads/writes and negative tests across an ungranted endpoint, entity, role, and environment using sandbox or approved production reads. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/ramp-enterprise-rbac--a4b0d8