{"id":48415,"plugin_id":"plugins_6ac7198c35d48191857f44d58398daf7","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-10-24T13:36:24.686Z","digest":"10a763a892a7737eec8129229214c582923f5589dec80773b5c98fffa6491550","against":null,"payload":{"description":"Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.","included_files":[{"relative_path":"references/embedded-rls-rules.md","size_in_bytes":1330}],"name":"preset-embedded-rls","skill_md_contents":"---\nname: preset-embedded-rls\ndescription: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.\n---\n\n# preset-embedded-rls\n\nUse before guest-token creation when embedded viewers need row-level security.\n\n## Always\n\n- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.\n- Do not invent tenant identifiers, filters, dataset columns, or access rules.\n- Treat RLS clauses as permission controls that can leak or hide customer data.\n- Confirm every clause and intended viewer population before token creation.\n- Do not validate with broad data-returning queries unless the user approves target and limit.\n\n## Decision Rules\n\n- Classify embedded RLS review as plan-only safety work.\n- Identify tenant and user filter safety issues.\n- Require approval before clauses are used in token claims.\n- Avoid mutating embedded RLS configuration.\n\n## Workflow Order\n\n1. Inspect embedded RLS clauses.\n2. Flag unsafe tenant and user filters.\n3. Summarize approval requirements.\n4. Stop before using clauses in tokens.\n\n## Retrieve\n\n- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}