npx claudepluginhub arbazkhan971/godmodeThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
/godmode:rbac, "permissions", "access control"App type: monolith|microservices|multi-tenant SaaS
Complexity:
Simple roles (admin/user/viewer) -> RBAC
Dynamic attributes (time/location) -> ABAC
Resource relationships (owner/member) -> ReBAC
Combination -> Hybrid
# Detect existing auth/authz
grep -rl "role\|permission\|authorize\|can\?" \
--include="*.ts" --include="*.rb" --include="*.py" src/
RBAC (Role-Based):
Role hierarchy:
super_admin -> org_admin -> team_admin -> member
Permissions: create|read|update|delete per resource
Role-permission mapping table
IF roles < 10 and stable: pure RBAC is sufficient.
ABAC (Attribute-Based):
Policy: (Subject, Resource, Action, Environment) -> PERMIT|DENY
Subject: user.role, user.department, user.clearance
Resource: resource.owner, resource.classification
Environment: time, IP, MFA status
IF decisions depend on context (time, location): ABAC.
ReBAC (Relationship-Based):
Tuples: user:alice has owner on document:doc1
Inheritance: owner implies editor implies viewer
Tools: OpenFGA, SpiceDB, Ory Keto
IF Google Docs-style sharing model: ReBAC.
Strict (tree): each role has one parent
Lattice (DAG): roles can have multiple parents
Scoped: roles apply within scope (org/team/project)
IF > 20 roles: audit for overlap and consolidate. IF unused permissions for 90+ days: flag as excessive.
Every resource has:
owner_id (full control)
tenant_id (isolation boundary)
visibility: private|team|organization|public
Evaluation chain:
1. Owner? -> ALLOW
2. Super admin? -> ALLOW (audit logged)
3. Explicit permission? -> Check
4. Role-based? -> Check hierarchy
5. ABAC policy? -> Evaluate
6. Default: DENY
function evaluate(subject, resource, action, context):
denials = findMatchingPolicies(DENY, ...)
IF denials.length > 0: return DENY
allows = findMatchingPolicies(ALLOW, ...)
IF allows.length > 0: return ALLOW
return DENY # default deny
LOG every decision (ALLOW and DENY) with full context.
Every authorization decision logged:
timestamp, subject, resource, action,
decision (allow/deny), policy_id, reason
Storage: append-only or write-once
Retention: minimum 1 year for compliance
IF audit log not append-only: security risk. IF no audit log: MUST implement before launch.
Append .godmode/rbac-decisions.tsv:
timestamp model roles permissions resources audit verdict
KEEP if: permission checks pass AND no escalation
AND audit captures allow/deny.
DISCARD if: unauthorized access possible OR
audit broken OR permissions regressed.
STOP when FIRST of:
- All resources have permission mappings
- Default deny enforced every endpoint
- Audit logging covers all decisions
On failure: git reset --hard HEAD~1. Never pause.
| Failure | Action |
|---|---|
| Legitimate request denied | Check audit log, verify hierarchy |
| Escalation possible | Fix policy, test both directions |
| Missing audit entries | Verify middleware, check async flush |