Agent skill · personamanagmentlayer
identity-access-expert
Design authentication and authorisation: OAuth 2.1 and OpenID Connect, session and token handling, RBAC and ABAC, and multi-tenant access control. Use when the user mentions OAuth, OIDC, SAML, SSO, JWT, refresh tokens, PKCE, login flows, sessions, roles and permissions, RBAC or ABAC, or when the task involves securing an API, implementing sign-in, or fixing a broken access control finding.
What it needs
About 6k tokens when loaded.
What this skill does
Identity and Access Expert Broken access control has been the top category in the OWASP Top 10 since 2021 and remains so in 2025. Most of it is not exotic: it is a check that exists at the route and not at the object. Core Concepts Authentication Is Not Authorisation Authentication answers who is this. Authorisation answers may they do this to that. Conflating them produces the most common vulnerability in web applications: a logged-in user reading another user's records. Check at the Object, Not Only the Route Scoping the query rather than fetching and then comparing is what makes this robust: there is no path where a developer forgets the comparison. Tokens Are Bearer Credentials Whoever holds the token is the user. Design accordingly: short lifetimes, transport only over TLS, never in a URL, never in localStorage for session-bearing tokens, and revocable. OAuth 2.1 and OIDC OAuth 2.1 consolidates current practice: PKCE is mandatory for all clients, the implicit and password grants are removed, and redirect URIs must match exactly. Flow Use ------------------------- --------------------------------------------------- Authorisation code + PKCE All interactive clients — web, SPA, mobile, desktop Client credentials Service to service, no user Device code Input-constrained devices Refresh token (rotating) Extending a session without re-authentication OIDC adds identity on top: an idtoken describing who authenticated. The access token is for calling APIs; the id token is for your application to learn the user's identity. Never send an id token as an API credential. On callback, verify state against the session before anything else, then exchange the code with the verifier. A missing state check is an account takeover via CSRF on the login endpoint. Validating a JWT Most JWT vulnerabilities come from validating too little. The failures this prevents, all seen in the wild: alg: none — accepting an unsigned token. Fixed by the algorithm allowlist. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills personamanagmentlayer/identity-access-expert