access-control-rbac
Role-based access control (RBAC) with permissions and policies. Use for admin dashboards, enterprise access, multi-tenant apps, fine-grained authorization, or encountering permission hierarchies, role inheritance, policy conflicts.
90
88%
Does it follow best practices?
Impact
92%
1.53xAverage score across 3 eval scenarios
Passed
No known issues
Quality
Discovery
89%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong skill description with excellent trigger term coverage and clear 'Use for' guidance that explicitly states when to apply the skill. The main weakness is that it describes the domain rather than specific actions Claude can perform with RBAC (e.g., designing role hierarchies, implementing permission checks, resolving policy conflicts).
Suggestions
Add specific concrete actions like 'Design role hierarchies, implement permission checks, resolve policy conflicts, create authorization matrices' to improve specificity.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (RBAC) and mentions related concepts like 'permissions', 'policies', 'role inheritance', and 'policy conflicts', but doesn't list concrete actions (e.g., 'create roles', 'assign permissions', 'resolve conflicts'). | 2 / 3 |
Completeness | Clearly answers both what (RBAC with permissions and policies) and when (explicit 'Use for' clause listing multiple trigger scenarios including admin dashboards, enterprise access, multi-tenant apps, and specific technical situations). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms users would say: 'admin dashboards', 'enterprise access', 'multi-tenant apps', 'fine-grained authorization', 'permission hierarchies', 'role inheritance', 'policy conflicts' - these are terms users naturally use when dealing with access control. | 3 / 3 |
Distinctiveness Conflict Risk | Very distinct niche focused specifically on RBAC and authorization patterns. The specific triggers like 'role inheritance', 'policy conflicts', and 'fine-grained authorization' clearly distinguish it from general authentication or security skills. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
87%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured skill with excellent conciseness and actionability. The code examples are complete and executable, and the progressive disclosure is exemplary with clear references to detailed implementations. The main weakness is the lack of explicit workflow guidance for implementing access control in a real project, particularly around migration, testing, and validation steps.
Suggestions
Add a brief implementation workflow section with steps like: 1) Define roles/permissions, 2) Implement middleware, 3) Test with sample users, 4) Audit existing access patterns
Include validation guidance for testing permission configurations before deployment (e.g., unit test examples for permission checks)
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is lean and efficient, presenting access control models in a compact table and providing executable code without unnecessary explanation of concepts Claude already knows. No padding or verbose introductions. | 3 / 3 |
Actionability | Provides fully executable Node.js RBAC implementation with classes, middleware, and setup code that is copy-paste ready. Python ABAC pattern is similarly complete with condition functions and engine implementation. | 3 / 3 |
Workflow Clarity | While the code examples are clear, there's no explicit workflow for implementing RBAC in a project (e.g., steps to audit existing permissions, migrate users, validate role assignments). The best practices section lists guidelines but lacks a sequenced implementation process with validation checkpoints. | 2 / 3 |
Progressive Disclosure | Excellent structure with overview table, core implementations inline, and clear one-level-deep references to detailed files (python-abac.md, java-spring-security.md). External references are well-signaled with descriptions of what they contain. | 3 / 3 |
Total | 11 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- secondsky/claude-skills
- Commit
90d6bd7
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.