# Idmp User Access

> IDMP user-access skill. Use it to inspect users, roles, permission groups, assignable roles, and granted roles while keeping current-user reads separate from admin paginated user lists.

- **Type:** Skill
- **Install:** `agentstack add skill-taosdata-agent-skills-idmp-user-access`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [taosdata](https://agentstack.voostack.com/s/taosdata)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [taosdata](https://github.com/taosdata)
- **Source:** https://github.com/taosdata/agent-skills/tree/main/plugins/idmp-plugin/skills/idmp-user-access

## Install

```sh
agentstack add skill-taosdata-agent-skills-idmp-user-access
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# user / role / permission

**Read [`../idmp-shared/SKILL.md`](../idmp-shared/SKILL.md) first.**

## What this skill covers

- Read current-user context, paginated admin user views, roles, permission groups, and safe authorization previews.
- Keep current-user inspection separate from directory-wide admin surfaces.

## Recommended reference

- [`references/user-access-read-flows.md`](references/user-access-read-flows.md)

## Missing context to resolve first

- Admin visibility.
- Permission group seed.
- Whether the request is about the current user, a directory user, a role, or a permission scope.
- Whether the operator only needs a dry-run preview or a real mutation.
- Which scope, group, or role ID is already known.

## Constrained live behaviors

- `user users list` returns the current-user object.
- `permission users assignable` and `permission roles list-get` can return structured 403.
- `role roles create` requires a non-empty `permissionGroupIds` list.
- `user users list` is the current-user surface; `user page list` is the paginated directory view.
- Role and permission reads can succeed even when grant previews are permission-bound.
- Keep `--dry-run --ack-risk` on grant previews until the operator explicitly wants a real mutation.

## Execution flow

1. Start with `idmp-cli user users list` to separate current-user context from directory-wide admin views.
2. Use `idmp-cli user page list --params` only when the task really needs admin directory scope.
3. Pair role detail with `idmp-cli permission groups list` before any grant preview or temporary role create.
4. Keep authorization work on `permission policy grant-post --dry-run --ack-risk --params` until the operator explicitly wants a real mutation.
5. If a temporary role must be created, reread it and pair the create with a delete cleanup step in the same workflow.

## Evidence of completion

- A current-user answer is only complete when it comes from `user users list`, not from a guessed admin directory row.
- A permission boundary is still valid evidence when the backend returns a structured 403 for assignable or granted-role reads.
- A temporary-role workflow is only complete when both the reread and the delete cleanup succeed.

## Key commands

1. `idmp-cli user users list` for the current-user shape.
2. `idmp-cli user page list --params` for the admin directory view.
3. `idmp-cli user users get --params` to inspect a specific user.
4. `idmp-cli role roles get --params` to inspect one role deeply.
5. `idmp-cli permission groups list` to enumerate reusable permission bundles.
6. `idmp-cli permission policy grant-post --dry-run --ack-risk --params` to preview authorization safely.
7. `idmp-cli role roles create --ack-risk --data` when a temporary custom role is really needed.
8. `idmp-cli role roles delete --ack-risk --params` to remove that temporary role after verification.

## Exception paths

- If paginated admin reads are forbidden, do not infer that the current-user surface is also broken.
- Stop at dry-run when the operator has not explicitly requested a real grant.
- Clean up any temporary custom role you create.

## Validation scenarios

### 1. Current-user shape
Use `idmp-cli user users list` first. This should answer “who am I” questions without requiring admin directory access.

### 2. Admin directory view
Use `idmp-cli user page list --params` for scoped directory inspection. Treat permission failures here as directory-boundary evidence, not a total auth failure.

### 3. Role and permission-group context
Pair `idmp-cli role roles get --params` with `idmp-cli permission groups list`. The answer should explain both role detail and reusable permission groups.

### 4. Safe grant preview
Use `idmp-cli permission policy grant-post --dry-run --ack-risk --params` before any real grant. A dry-run failure is still useful boundary evidence.

### 5. Temporary custom-role lifecycle
If you must mutate, pair `idmp-cli role roles create --ack-risk --data` with `idmp-cli role roles delete --ack-risk --params`. Build a temporary custom role with one real permission group, reread it, then delete it.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [taosdata](https://github.com/taosdata)
- **Source:** [taosdata/agent-skills](https://github.com/taosdata/agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-taosdata-agent-skills-idmp-user-access
- Seller: https://agentstack.voostack.com/s/taosdata
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.