Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsAuth & Multi Tenant SaaS Foundation
Design secure multi-tenant SaaS architectures with robust tenant isolation, RBAC, and adversarial test plans.
$23.99
Auth & Multi Tenant SaaS Foundation
Example session with this skill installed
Plan a multi-tenant auth system for a Next.js app using Supabase. We need organizations, roles (admin/member), and tenant isolation via PostgreSQL RLS for a shared-table model.
- Read your context and instructions
- Compiled the auth & multi
I have designed the multi-tenant foundation for your Next.js and Supabase stack using a shared-table isolation model with PostgreSQL Row Level Security.
SaaS Auth & Isolation Plan
1. Data Model & Constraints
| Table | Columns | Constraints |
|---|---|---|
profiles | id (PK), email, full_name | One-to-one with auth.users |
organizations | id (PK), name, slug, created_at | Unique slug |
memberships | user_id (FK), org_id (FK), role | Composite PK (user_id, org_id) |
projects | id (PK), org_id (FK), name, data | FK to organizations |
2. Tenant Isolation (PostgreSQL RLS)
-- Enable RLS on organization-owned data
ALTER TABLE projects ENABLE ROW LEVEL SECURITY;
-- Policy: Users can only see projects in their active organization
CREATE POLICY "Users can view projects in their organization"
ON projects
FOR SELECT
USING (
org_id IN (
SELECT org_id
FROM memberships
WHERE user_id = auth.uid()
)
);
-- Policy: Only admins can insert new projects
CREATE POLICY "Admins can create projects"
ON projects
FOR INSERT
WITH CHECK (
EXISTS (
SELECT 1 FROM memberships
WHERE user_id = auth.uid()
AND org_id = projects.org_id
AND role = 'admin'
)
);
3. Negative Test Matrix
| Scenario | Expected Result | Verification Method |
|---|---|---|
| Cross-tenant IDOR | 404 / Empty Set | Attempt to fetch project_id from Org B while authenticated to Org A. |
| Role Escalation | 403 Forbidden | Non-admin user attempts POST to /api/projects. |
| Stale Invitation | 400 Bad Request | Attempt to join organization using an expired or revoked token. |
| Direct SQL Leak | Zero Rows | Query projects table without a valid auth.uid() context in the transaction. |
Next steps
- Implement the
membershipstable and seed the initial roles. - Apply the RLS policies to all tables containing
org_id. - Configure the Supabase client to handle organization switching via session metadata.
Connects securely to your tools. The creator never sees your data.
About this skill
Designing a secure SaaS foundation is error-prone. One mistake in tenant isolation or session handling leads to data leaks. This skill generates a comprehensive technical implementation plan for multi-tenant authentication, authorization, and data isolation tailored to your specific stack.
What it does
- Trust mapping identifies actors and maps access across routes, records, and background jobs.
- Session architecture defines OAuth/OIDC flows, rotation, revocation, and CSRF controls.
- Organization modeling separates global identity from tenant membership with ownership transfer logic.
- Policy definition creates an authorization matrix covering resource ownership and server-side enforcement.
- Isolation enforcement compares shared-table keys vs. schema-per-tenant models with RLS strategies.
- Adversarial verification generates negative test cases for IDOR, privilege escalation, and token reuse.
How it works
- Provide your application stack, database, and identity provider requirements.
- The skill analyzes trust boundaries and tenant-isolation needs for your specific domain.
- It generates a detailed architecture plan including data models and API contracts.
- You receive a milestone-based implementation roadmap with a negative-test matrix for security verification.
Frameworks & tools
Works with any web stack including Node.js, Python/Django, Go, or Ruby on Rails. Compatible with identity providers like Auth0, Clerk, or Kinde, and databases supporting RLS like PostgreSQL.
Why this beats prompting it yourself
Standard prompts often forget edge cases like background job isolation, invitation expiry, or session revocation. This skill uses a systematic workflow to ensure no trust boundary is left unmapped and no tenant-leak vector is ignored.
Use cases
- Architecting a B2B SaaS from scratch with organization-based billing and permissions.
- Migrating a single-tenant application to a multi-tenant shared-database architecture.
- Designing granular RBAC for an enterprise platform with complex team hierarchies.
- Hardening existing auth flows against IDOR and cross-tenant data leaks.
Known limitations
Does not execute code or perform live security audits. Requires manual configuration of third-party identity providers and database row-level security policies.
Does not execute code or perform live security audits. Requires manual configuration of third-party identity providers and database row-level security policies.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 14 days ago