{"id":48419,"plugin_id":"plugins_6ac7198c35d48191857f44d58398daf7","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-10-24T13:36:24.736Z","digest":"590fb1ea816a744bf3a8fbb1786fcbb331619bf854353d15888b3420ea1d4899","against":null,"payload":{"description":"Review Preset role, workspace membership, permission, access-control, DAR/RLS-adjacent, and effective-access changes through direct API calls. Use only for direct API workflows; Do not use for MCP-only work.","included_files":[{"relative_path":"references/role-permission-changes.md","size_in_bytes":1770}],"name":"preset-roles-permissions","skill_md_contents":"---\nname: preset-roles-permissions\ndescription: Review Preset role, workspace membership, permission, access-control, DAR/RLS-adjacent, and effective-access changes through direct API calls. Use only for direct API workflows; Do not use for MCP-only work.\n---\n\n# preset-roles-permissions\n\nUse as the approval and access-review gate for permission-sensitive workflows.\n\n## Always\n\n- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known.\n- Use this skill alongside `preset-admin` role identifier and membership references for Management API role work.\n- Use `preset-superset` for workspace current-user roles, permissions, and OpenAPI availability.\n- Treat role and permission changes as `permission_write`.\n- Do not guess role IDs or custom role identifiers.\n- Do not use internal `/api-internal/*`, billing, SCIM, broad Superset security manager, or unsupported permission APIs from this skill; defer to `references/role-permission-changes.md`.\n- Require confirmation of target principal, current access, new access, seat impact, and rollback path.\n\n## Decision Rules\n\n- Classify role and permission changes as access mutations.\n- Resolve role identifiers before effect summary.\n- Require approval with target and effect.\n- Avoid applying role or permission changes until approval is explicit.\n\n## Workflow Order\n\n1. Inspect membership roles and permissions.\n2. Resolve target and role identifiers.\n3. Summarize access effect, seat impact, and rollback path.\n4. Stop before role or permission change.\n\n## Retrieve\n\n- Role/permission mutation guidance and approval checks: [references/role-permission-changes.md](references/role-permission-changes.md)\n- Approval policy: load `preset-api` and then `references/safety-policy.md`.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}