Architectural guidance for coding agents adding private customer access, connections, background work and subscriptions to existing apps. Specs only; reuse the host and chosen providers.
56
71%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
Use this optional structure or the host's existing working notes for the requested capability. Use actual paths and existing names. Omit irrelevant sections; stop before implementation unless requested. This template adds no approval step and does not prescribe the host's architecture.
meaning -> actual host field/path, provider source or derivation -> authority -> workflow that needs it. Add storage only for an identified gap; name that gap. Map relationships and the actual backend authorization boundary. Do not reproduce the full spec's field list.requirement -> route/query/worker -> check -> observed result or unrun. Include affected background/search paths, ordinary recovery and preservation of user-managed progress. State how to reverse the bounded change without losing subsequent data.An incomplete mapping is a valid plan if its unknowns are explicit. It is not an implemented or validated integration.
Ask the user business questions in ordinary language: whether people share work, who pays, or whether cancellation ends access now or later. Derive engineering decisions from inspected source and the contracts. Requiring the user to explain ownership propagation, credential scope or replay safety is engineering rescue, not normal clarification. If implementation is already requested, use this as a working note and continue through the authorized change and checks.
Example of a sufficient mapping: private note owner -> note.projectId -> project.ownerId -> existing authorized project lookup -> list/read/write notes. If this already resolves the right owner, add no note.ownerId and no workspace/membership model. If subscriptions later target that owner, map the purchase to that existing user; do not create an access-owner table. This is an illustrative decision, not an executed host trial.