mastermind-access

Mastermind Access

This skill is invoked directly via /mastermind-access.

Bookkeeping only — not enforced by the Org Runtime. It writes .monomind/orgs/<org>-members.json, which no runtime code reads: roles and permission grants recorded here restrict nothing.

---

Inputs

• brain_context: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
• org_name: org to manage access for (required)
• action: list | invite | set-role | grant | revoke | remove | suspend | join-requests | approve-join | reject-join
• member_id: member slug/id (required for set-role/grant/revoke/remove/suspend)
• role: owner | admin | operator | viewer (required for invite/set-role)
• permission: permission key to grant/revoke (see Permission Keys below)
• request_id: join request id (required for approve-join/reject-join)
• caller: command | master

---

Permission Keys

Key	Label	Implied by role
agents:create	Create agents	owner, admin
users:invite	Invite members	owner, admin
users:manage_permissions	Manage members	owner
tasks:assign	Assign tasks	owner, admin, operator
tasks:assign_scope	Assign scoped tasks	— (explicit only)
tasks:manage_active_checkouts	Manage active checkouts	— (explicit only)
joins:approve	Approve join requests	owner, admin
environments:manage	Manage environments	owner, admin

Role implied grants:

• owner → all permissions
• admin → agents:create, users:invite, tasks:assign, joins:approve, environments:manage
• operator → tasks:assign
• viewer → (none)

---

Step 0 — Brain Load (standalone only)

If caller is not "command", load brain context following mastermind-protocol/SKILL.md Brain Load Procedure with namespace: ops.

---

Step 1 — Load Members File

orgFile=".monomind/orgs/${org_name}.json"
[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }

membersFile=".monomind/orgs/${org_name}-members.json"
[ ! -f "$membersFile" ] && cat > "$membersFile" <<'EOF'
{"members":[],"join_requests":[]}
EOF