Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/iblai/api/iblai-api-rbacnpx skills add iblai/api --skill iblai-api-rbacgit clone --depth 1 https://github.com/iblai/apiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iblai/api/iblai-api-rbac)<a href="https://agentmods.dev/skills/iblai/api/iblai-api-rbac"><img src="https://agentmods.dev/badge/skills/iblai/api/iblai-api-rbac.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00070 | $0.03687 |
| Opus 5 | $0.00035 | $0.01843 |
| Sonnet 5 | $0.00014 | $0.00737 |
| Haiku 4.5 | $0.00007 | $0.00369 |
Grade A, and why
iblai-api-rbac scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST \ How it starts
The opening of the file, as written. The whole thing — 246 lines — stays where its author put it; the contents beside it link to each section on GitHub.
iblai-api-rbac
Drive the organization's role-based access control from the API: define
roles and policies, attach them to groups and users, check permissions, discover
assignable resources and actions, share agents and teams, and toggle what
students may do — the org-wide "who can do what" surface under
…/dm/api/core/rbac/… (bulk user policies live under …/dm/api/core/platform/…).
Auth & conventions
- Base URL:
https://api.iblai.app - Header:
Authorization: Api-Token $IBLAI_API_KEYon every request. - Path vars:
{org}=$IBLAI_ORG(a.k.a.platform_key),{username}=$IBLAI_USERNAME,{mentor_id}= the agent's numeric id. - Not connected yet? Run
/iblai-api-loginfirst to populateIBLAI_ORG,IBLAI_USERNAME, andIBLAI_API_KEY. - The RBAC developer docs phrase auth as
Authorization: Token <key>— that is the same platform key; useApi-Token. mentor/agentroute alias. Thementor-*routes are canonical; the platform also serves an identicalagent-*twin (same view, auth, and data) forrbac/mentor-access/andrbac/student-mentor-creation/…. Both spellings resolve. This skill usesagent-*; the canonicalmentor-*path is noted inline.
Concepts
Every permission check resolves to one question — can this identity perform this
action on this resource? — evaluated at two levels: action (the operation
gate: list/read/write/delete/action) and data (field-level read /
write masking). All RBAC state is scoped to the org.
- Resource paths are hierarchical and rooted at a platform, e.g.
/platforms/{pk}/mentors/{mentor_id}/documents/{id}/. A policy granted on a parent resource applies to all its children. In request bodies you supply the short, platform-relative form —/mentors/,/mentors/123/,/students/,/users/,/groups/,/usergroups/5/— and the/platforms/{pk}/prefix is added server-side from your token /platform_key. - Actions follow
Ibl.{Namespace}/{Resource}/{operation}. Namespaces:Mentor,Core,CRM,Catalog,Notifications,Analytics,Billing. Operations areread,write,list,delete, andaction(create/perform). Examples:Ibl.Mentor/Chat/action,Ibl.Mentor/Settings/read,Ibl.Mentor/ChatHistory/list,Ibl.Core/Groups/write,Ibl.Core/Policies/delete,Ibl.Analytics/CanViewAnalytics/action. Wildcards match any segment:Ibl.Mentor/Settings/*,Ibl.Mentor/*,Ibl.*(full admin). - Data actions control field-level access:
Ibl.{Namespace}/{Resource}/{field}/{operation}, e.g.Ibl.Mentor/Settings/display_name/read,Ibl.Mentor/Settings/*/read. Missing read permission → the field returns empty; missing write permission →403. - Model. A role carries
actions+data_actions(allow) andnot_actions+not_data_actions(deny). A policy binds one role to a set ofresourcesand to users/groups. A group bundles users. Permissions are additive — if any policy grants an action, it is allowed. - Well-known / owner roles apply dynamically. Owner roles (
mentor-owner,document-owner,prompt-owner,user-group-owner, …) are auto-granted to a resource's creator without an explicit policy. The agent-accessrolefield takes friendly keys:viewer,editor,chat,analytics_viewer,dataset_curator. - Literal spelling. The
mentor/agentalias is a URL-route convenience only. Action, data-action, and resource payload strings are not aliased — always write the literalMentor/mentorsform inactions,data_actions, andresources.Ibl.Agent/…and/agents/are not recognized.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 246 lines · 70 tokens per session scan A 9fb6ffbee6c3
iblai-api-rbac is a skill published in the GitHub repository iblai/api (15 stars, last pushed 3d ago), licensed MIT. It adds 70 tokens to every session and 3,687 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
design-improvement
WHAT - Browser-grounded iterative design improvement. Consumes design-assessment findings, defines direction, prioritizes safe vs ambiguous changes, implements within existing design system, runs app, captures rendered evidence via browser, reviews and iterates. Reuses evidence model — no new scoring framework.
architecture-patterns
Use when selecting architecture patterns for a new feature, performing Event Modeling, defining bounded contexts, choosing DDD tactical patterns, evaluating pattern fitness, or understanding how patterns compose. Covers Event Modeling methodology, DDD strategic design, DDD tactical patterns, Clean Architecture, CQRS…
architecture-review-criteria
Use when reviewing DESIGN artefacts (event models, ADRs, component diagrams, context maps, interface contracts) for quality, DDD compliance, and architectural correctness. Contains gate definitions and scoring rubric for the solution-architect-reviewer lenses.
autoresearch
Autonomous iterative experimentation loop for any programming task. Guides the user through defining goals, measurable metrics, and scope constraints, then runs an autonomous loop of code changes, testing, measuring, and keeping/discarding results. Inspired by Karpathy's autoresearch. USE FOR: autonomous improvement…
acceptance-review-criteria
Use when reviewing DISTILL artefacts (Gherkin scenarios, test plans, implementation plans) for quality, completeness, and alignment. Contains the gate definitions and scoring rubric for the acceptance-designer-reviewer lenses.
discovery-review-criteria
Use when reviewing DISCOVER artefacts (triage reports, sprint proposals) for completeness, prioritization quality, and duplicate handling. Contains gate definitions G1-G6 and scoring rubric for the backlog-discoverer-reviewer lenses.