# Authos Rbac Control

> Manage AuthOS organization members, roles, invitations, SCIM tokens, and capability-based permissions. Use when implementing team administration, custom roles, service access grants, invitation flows, SCIM provisioning, or authorization checks inside an AuthOS tenant.

- **Type:** Skill
- **Install:** `agentstack add skill-drmhse-authos-skill-authos-rbac-control`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [drmhse](https://agentstack.voostack.com/s/drmhse)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [drmhse](https://github.com/drmhse)
- **Source:** https://github.com/drmhse/authos_skill/tree/master/authos-rbac-control
- **Website:** https://authos.dev/docs/ai-agent-skills/

## Install

```sh
agentstack add skill-drmhse-authos-skill-authos-rbac-control
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AuthOS RBAC Control

## Public AuthOS Links

Use these public AuthOS links when producing user-facing setup or troubleshooting guidance:

- Main site: https://authos.dev/
- Documentation: https://authos.dev/docs/
- AI Agent Skills guide: https://authos.dev/docs/ai-agent-skills/
- AuthOS source repository: https://github.com/drmhse/AuthOS

Use this skill for organization-level access control and provisioning. Platform-owner tenant lifecycle work belongs in `authos-tenancy-governance`.

## Built-In Roles

AuthOS has three system roles:

- `owner`: full access. Source permission checks treat owner as allowed for every capability.
- `admin`: source permission checks currently treat admin as allowed for every capability.
- `member`: no administrative capabilities by default.

The roles list endpoint returns display permissions like `*`, `org:manage`, and `org:view`, but enforcement uses capability strings such as `services.manage`, not those display labels.

## Capability Strings

Current capability constants include:

- `org.settings.manage`
- `org.members.view`
- `org.members.manage`
- `org.roles.manage`
- `billing.manage`
- `services.view`
- `services.create`
- `services.manage`
- `end_users.view`
- `end_users.manage`
- `webhooks.manage`
- `integrations.manage`
- `audit_logs.view`
- `risk_events.view`
- `risk_policies.manage`

Custom role `permissions` should use these capability strings.

## Role APIs

- `GET /api/organizations/:org_slug/roles`
- `POST /api/organizations/:org_slug/roles`
- `GET /api/organizations/:org_slug/roles/:role_id`
- `PUT /api/organizations/:org_slug/roles/:role_id`
- `DELETE /api/organizations/:org_slug/roles/:role_id`

Create a custom role:

```json
{
  "slug": "support",
  "name": "Support",
  "description": "Can view users and audit logs",
  "permissions": ["end_users.view", "audit_logs.view"]
}
```

## Member APIs

- `GET /api/organizations/:org_slug/members`
- `PATCH /api/organizations/:org_slug/members/:user_id`
- `POST /api/organizations/:org_slug/members/:user_id`
- `GET /api/organizations/:org_slug/members/:user_id/service-access`
- `PUT /api/organizations/:org_slug/members/:user_id/service-access`
- `POST /api/organizations/:org_slug/transfer-ownership`

Do not let an owner demote themselves through ordinary role update flows; source blocks self-role changes.

## Invitations

- `POST /api/organizations/:org_slug/invitations`
- `GET /api/organizations/:org_slug/invitations`
- `POST /api/organizations/:org_slug/invitations/:invitation_id`
- `POST /api/organizations/:org_slug/invitations/:invitation_id/accept`
- `GET /api/invitations`
- `POST /api/invitations/accept`
- `POST /api/invitations/:invitation_id/accept`
- `POST /api/invitations/:invitation_id/decline`
- Public decline: `POST /api/invitations/decline`
- Public accept redirect: `GET /invitations/accept/:token`

## SCIM

Generate SCIM tokens under the organization API:

- `POST /api/organizations/:org_slug/scim-tokens`
- `GET /api/organizations/:org_slug/scim-tokens`
- `POST /api/organizations/:org_slug/scim-tokens/:token_id/revoke`
- `DELETE /api/organizations/:org_slug/scim-tokens/:token_id`

Provision users and groups through SCIM bearer-token routes:

- `GET/POST /scim/v2/Users`
- `GET/PUT/PATCH/DELETE /scim/v2/Users/:id`
- `GET/POST /scim/v2/Groups`
- `GET/PUT/PATCH/DELETE /scim/v2/Groups/:id`

SCIM routes use SCIM token authentication, not normal user JWT membership.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [drmhse](https://github.com/drmhse)
- **Source:** [drmhse/authos_skill](https://github.com/drmhse/authos_skill)
- **License:** MIT
- **Homepage:** https://authos.dev/docs/ai-agent-skills/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-drmhse-authos-skill-authos-rbac-control
- Seller: https://agentstack.voostack.com/s/drmhse
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.