auth-access

Think Through Identity & Access

Overview

Production guidance for identity, authentication, authorization, and tenancy. Each reference paper captures the correctness, security, and lifecycle work that first drafts miss: token rotation and reuse detection, session fixation, account enumeration, OAuth linking edge cases, permission inheritance, tenant leakage, and admin audit paths.

Core principle: Authentication and authorization are invariant-enforcement systems, not login forms. Every identity, credential, session, and permission decision must trace to an enforceable rule at the authoritative data boundary.

Domain Law

NO AUTH OR ACCESS CHANGE WITHOUT:
1. the minimum required primary paper(s) for the feature selected from the context table;
2. the paper's pre-change questions
   answered, or each open point labeled as an assumption;
3. "Existing-codebase checks" run when changing an existing system;
4. every applicable MUST mapped to a decision, a test, or a documented
   exception — never silently downgraded.

When to Use

Use this skill when thinking through, reviewing, changing, or verifying:

• email/password, phone, passwordless, magic-link, or OTP login;
• password reset, change, verification, lockout, and account recovery;
• session management: cookies, rotation, fixation defense, device sessions;
• JWTs, opaque tokens, refresh-token rotation, revocation, reuse detection;
• OAuth 2.0 / OIDC social login, provider account linking, provider outages;
• MFA enrollment, removal, recovery codes, passkeys/WebAuthn, step-up auth;
• API keys and machine-to-machine / service-to-service authentication;
• permissions: roles, RBAC/ABAC/ReBAC, ownership checks, impersonation;
• account lifecycle: suspension, deletion, anonymization, merge, export;
• multi-tenant identification, isolation, quotas, and cross-tenant leakage prevention;
• internal admin operations and privileged tooling.

When Not to Use

• Designing the architecture of a whole new system: use system-architecture-harness.
• Building LLM/agent features: use ai-agent-system-architecture.
• API contracts, validation, pagination, error models: use api-contracts.
• Secrets storage, cryptography primitives, TLS, token randomness: use security-privacy (papers 063, 064, 127).
• Rate limiting and brute-force pacing mechanics: use resilience-flow-control (paper 038).