Skip to content
cccskills
FreePublished on GitHub

dygo-access-control

Design, implement, or review dygo roles, Entity access metadata, Permissions, and permission-aware Business App behavior. Use when access to Records or business actions is central to the task.

The English summary is being prepared. Showing the original description.

See how to install

Files included (1)

  • SKILL.md1.8 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

dygo Access Control

Make server-side access the source of truth. Default to deny.

Start

Read docs/access.md, docs/auth.md, and the current permission actions in internal/permissions/actions.go. Inspect the target App's access/ directory and Core access metadata.

Rules

  • Define App-contributed roles in access/_roles.yml.
  • Define Entity grants in access/<entity>.access.yml.
  • Use canonical App and Entity identities. Do not use labels or route slugs as permission identity.
  • Keep the built-in action set small. Do not model business lifecycle verbs as global CRUD actions.
  • Enforce access on the server before you add UI visibility rules.
  • Trace the effective Record access mode for each caller: actor-scoped, trusted action, or system. Actor attribution in Activity does not prove permission enforcement.
  • Use AsActor for user-scoped access and a non-empty AsSystem reason for intentional system access. Do not copy an unscoped constructor into a new caller without establishing its trust boundary.
  • Treat Administrator bypass as a narrow framework rule, not an App authorization shortcut.
  • Do not add a second permission engine or a private Core-only permission path.
  • Preserve database-owned Studio access Records when the documented sync contract requires it.
  • Make denials observable without exposing secrets or protected Record data.

Check

Use dygo access validate and dygo access show <app>/<entity>. Access metadata is applied only through dygo db migrate. Test the actual permission boundary when the change can expose or mutate business data.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Design, implement, or review dygo HTTP APIs and public App SDK contracts. Use for Record APIs, metadata and boot endpoints, query behavior, response envelopes, compatibility, and public Go interfaces.

The English summary is being prepared. Showing the original description.

hapyco/dygo16Updated Oct 18, 2026

Diagnose a dygo Business App that does not validate, boot, route, render, authorize, migrate, or execute background work correctly. Use for evidence-first investigation rather than feature implementation.

The English summary is being prepared. Showing the original description.

hapyco/dygo16Updated Oct 18, 2026

Build or extend a dygo Business App using the supported project layout, generators, metadata, SDK, and validation workflow. Use for general app work that is not primarily Entity modeling, access, hooks, Jobs, fixtures, or patches.

The English summary is being prepared. Showing the original description.

hapyco/dygo16Updated Oct 18, 2026

Review a dygo Business App for framework conventions, model quality, access control, SDK boundaries, observability, and safe lifecycle behavior. Use for App audits and pre-merge reviews, not ordinary implementation.

The English summary is being prepared. Showing the original description.

hapyco/dygo16Updated Oct 18, 2026

Design, implement, or review the dygo framework CLI in Go with Cobra. Use for commands, flags, help, prompts, plans, output contracts, completion, and project-aware CLI behavior. Do not use for operating a deployed business through the reserved dygo-cli operator skill.

The English summary is being prepared. Showing the original description.

hapyco/dygo16Updated Oct 18, 2026

Improve or review ordinary dygo code changes for simplicity, focused scope, canonical ownership, clear boundaries, and verifiable behavior. Use for normal implementation and refactoring quality; use dygo-thermonuclear-review only for an explicitly severe audit.

The English summary is being prepared. Showing the original description.

hapyco/dygo16Updated Oct 18, 2026

See all skills by hapyco

Report a problem with this skill