saas role permission matrix builder
Converts SaaS roles and routes into a secure, auditable RBAC model with gap analysis and negative test plans.
$5
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentssaas role permission matrix builder
Example session with this skill installed
Audit RBAC for our Task Management module. Roles: OrgAdmin, ProjectLead, Contributor. Resources: Project, Task, Comment. Routes in ./app/Http/Controllers/TaskController.php.
- Read your context and instructions
- Compiled the saas role permission
I have analyzed the Task Management module. I mapped 3 roles against 3 resources and identified 4 security findings including one critical cross-tenant leakage risk.
SaaS Role-Permission Matrix: Task Management
| Resource | Action | OrgAdmin | ProjectLead | Contributor |
|---|---|---|---|---|
| Project | Create | Allow | Deny | Deny |
| Project | Delete | Allow | Deny | Deny |
| Task | Create | Allow | Allow | Allow (bound) |
| Task | Update | Allow | Allow (bound) | Allow (owner) |
| Comment | Delete | Allow | Allow (bound) | Deny |
Authorization Findings
| ID | Finding | Severity | Location |
|---|---|---|---|
| F-003 | Privilege Escalation | High | TaskController@update - Contributor can change project_id |
| F-005 | Cross-tenant Leakage | Critical | TaskController@index - Missing whereTenantId scope |
| F-007 | Destructive Action | Med | TaskController@destroy - No soft-delete or audit log |
| F-008 | Client-Side Guard | Low | Project deletion only hidden in UI; route is active |
Enforcement Spec & Negative Test Plan
### Enforcement: Task Update (Allow - Owner)
Pattern: Ensure `task->user_id === auth()->id()` AND `task->project->tenant_id === auth()->tenant_id`.
Location: `TaskPolicy.php`
### Negative Test: Contributor Delete Comment
- Attacker: Contributor (ID: 5, Tenant: A)
- Target: DELETE /api/comments/99 (Tenant: A, Owner: 10)
- Expected: 403 Forbidden
- Side-effect: Comment 99 must persist in DB.
Least-Privilege Scorecard
- Deny Coverage: 100% (6/6 deny cells have negative tests)
- Logic Integrity: Pass (No blanket admin bypass detected)
- Risk Level: High (F-005 must be remediated immediately)
Next steps
- Implement tenant scoping on the
TaskController@indexmethod to resolve F-005. - Add a server-side ownership check to the
Commentdeletion logic. - Update the
Contributorrole to use a policy-based guard for task updates.
Connects securely to your tools. The creator never sees your data.
About this skill
The problem
Vague authorization models lead to privilege escalation, cross-tenant data leaks, and failed security audits. Developers often rely on frontend visibility or blanket admin roles that hide dangerous server-side gaps.
What it does
- Builds a canonical Role-Permission matrix mapping every role, resource, and action.
- Performs a gap analysis to surface admin bypasses, unsafe exports, and missing server-side checks.
- Generates a negative test plan for every denied permission to prevent regression.
- Produces a least-privilege scorecard to validate SOC 2 or ISO 27001 compliance readiness.
Frameworks & tools
Agnostic. Works with any SaaS backend, OpenAPI specs, and framework-specific policy files (e.g., Laravel Policies, Pundit, or custom middleware).
Why this beats prompting it yourself
Standard LLMs often hallucinate "allow" by default or miss subtle cross-tenant leakage paths. This skill enforces a "deny-by-default" logic, specifically looks for known F-series authorization flaws, and ensures 100% test coverage for every denied route.
Use cases
- Preparing for a security audit by documenting the formal permission model.
- Mapping out RBAC for a new multi-tenant SaaS feature before coding.
- Auditing existing controllers to find routes that lack ownership checks.
- Designing negative integration tests for a security-critical API.
Known limitations
Does not execute code or apply patches. It does not model API gateway configurations or infrastructure-level CORS policies.
Requires manual input of roles, resources, and routes if they cannot be found in the workspace. Cannot model infrastructure-level gateway auth or CORS settings.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 1 month ago
Permissions
No special permissions declared or detected