Skill

auth-architecture

Designs authentication and authorization architectures using OAuth2, OIDC, RBAC, ABAC, and identity provider integration. Trigger: "auth architecture", "authentication design", "authorization patterns", "OAuth2", "OIDC", "identity provider".

From sovereign-architect

Install

Run in your terminal

npx claudepluginhub javimontano/mao-sovereign-architect

Tool Access

This skill is limited to using the following tools:

ReadGlobGrepBashAgent

Supporting Assets

View in Repository

evals/evals.json

examples/sample-output.md

prompts/use-case-prompts.md

references/body-of-knowledge.md

Skill Content

Auth Architecture

Designs authentication (AuthN) and authorization (AuthZ) architectures selecting appropriate protocols, identity providers, access control models, and token strategies for secure, scalable systems.

Guiding Principle

"Authentication answers 'who are you?' Authorization answers 'what can you do?' Never confuse the two."

Procedure

Step 1 — Requirements Analysis

Identify user types: end users, service accounts, machine-to-machine, admin operators.
Map authentication methods needed: passwords, SSO, MFA, passwordless, API keys, certificates.
Determine authorization granularity: coarse (role-based) vs. fine (attribute/policy-based).
Inventory regulatory requirements: SOC 2, HIPAA, PCI-DSS, GDPR consent management.
Document the trust boundaries: which services are internal, external, third-party?

Step 2 — Authentication Architecture

Select the identity provider strategy: managed (Auth0, Okta, Cognito) vs. self-hosted (Keycloak).
Define the authentication flows per client type:
- Web apps: Authorization Code Flow with PKCE.
- SPAs: Authorization Code Flow with PKCE (no implicit flow).
- Mobile: Authorization Code Flow with PKCE + secure storage.
- Machine-to-machine: Client Credentials Flow.
Design the token strategy: JWT access tokens, opaque refresh tokens, token lifetimes.
Specify MFA requirements per user type and sensitivity level.

Step 3 — Authorization Architecture

Select the access control model:
- RBAC: Role-Based Access Control for static permission hierarchies.
- ABAC: Attribute-Based Access Control for dynamic, context-aware policies.
- ReBAC: Relationship-Based Access Control for resource-ownership models (Zanzibar-style).
Design the permission model: roles, permissions, scopes, resource-level access.
Define the policy enforcement point (PEP) — where authorization checks happen in the request flow.
Specify the policy decision point (PDP) — centralized vs. distributed authorization evaluation.

Step 4 — Security Hardening

Define token rotation and revocation strategy.
Specify session management: cookie security, session timeouts, concurrent session limits.
Design audit logging for all authentication and authorization events.
Plan for credential breach response: token revocation, forced password reset, notification.
Document the security headers: CSP, HSTS, X-Frame-Options, SameSite cookies.

Quality Criteria

No authentication flow uses the implicit grant (deprecated by OAuth 2.1).
Access tokens have a lifetime < 15 minutes; refresh tokens are rotated on each use.
Authorization checks happen at the API gateway AND the service level (defense in depth).
All auth events are logged with correlation IDs for audit trail reconstruction.

Anti-Patterns

Storing JWTs in localStorage (XSS vulnerable) instead of httpOnly secure cookies.
Using long-lived access tokens (>1 hour) without refresh token rotation.
Implementing custom authentication protocols instead of using proven standards (OAuth2/OIDC).
Checking permissions only at the UI layer without server-side enforcement ("UI-only authorization").

Similar Skills

agent-harness-construction

Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.

everything-claude-code

138.0k

agent-payment-x402

Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.

everything-claude-code

138.0k

agent-eval

Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.

everything-claude-code

138.0k

Stats

Stars0

Forks0

Last CommitMar 28, 2026

Actions

View Source View Plugin View on GitHub View README

Procedure

Step 1 — Requirements Analysis

Identify user types: end users, service accounts, machine-to-machine, admin operators.

Map authentication methods needed: passwords, SSO, MFA, passwordless, API keys, certificates.

Determine authorization granularity: coarse (role-based) vs. fine (attribute/policy-based).

Inventory regulatory requirements: SOC 2, HIPAA, PCI-DSS, GDPR consent management.

Document the trust boundaries: which services are internal, external, third-party?

Step 2 — Authentication Architecture

Select the identity provider strategy: managed (Auth0, Okta, Cognito) vs. self-hosted (Keycloak).

Define the authentication flows per client type:

Web apps: Authorization Code Flow with PKCE.
SPAs: Authorization Code Flow with PKCE (no implicit flow).
Mobile: Authorization Code Flow with PKCE + secure storage.
Machine-to-machine: Client Credentials Flow.

Design the token strategy: JWT access tokens, opaque refresh tokens, token lifetimes.

Specify MFA requirements per user type and sensitivity level.

Step 3 — Authorization Architecture

Select the access control model:

RBAC: Role-Based Access Control for static permission hierarchies.
ABAC: Attribute-Based Access Control for dynamic, context-aware policies.
ReBAC: Relationship-Based Access Control for resource-ownership models (Zanzibar-style).

Design the permission model: roles, permissions, scopes, resource-level access.

Define the policy enforcement point (PEP) — where authorization checks happen in the request flow.

Specify the policy decision point (PDP) — centralized vs. distributed authorization evaluation.

Step 4 — Security Hardening

Define token rotation and revocation strategy.

Specify session management: cookie security, session timeouts, concurrent session limits.

Design audit logging for all authentication and authorization events.

Plan for credential breach response: token revocation, forced password reset, notification.

Document the security headers: CSP, HSTS, X-Frame-Options, SameSite cookies.

Quality Criteria

No authentication flow uses the implicit grant (deprecated by OAuth 2.1).

Access tokens have a lifetime < 15 minutes; refresh tokens are rotated on each use.

Authorization checks happen at the API gateway AND the service level (defense in depth).

All auth events are logged with correlation IDs for audit trail reconstruction.

Anti-Patterns

Storing JWTs in localStorage (XSS vulnerable) instead of httpOnly secure cookies.

Using long-lived access tokens (>1 hour) without refresh token rotation.

Implementing custom authentication protocols instead of using proven standards (OAuth2/OIDC).

Checking permissions only at the UI layer without server-side enforcement ("UI-only authorization").