schematize
Skills · Claude Code · Agent Skills

Identity is not email, and login must not be a wall — no negotiation.

One broker at auth.{domain} that knows who the person is and proves it to the apps: PKCE for every client, asymmetric JWTs, at least 2 factors, deny-by-default ReBAC and recovery at least as strong as login.

v0.2.1Segurança · Identidade e IAMgithub.com/schematizeme/skill-iam

Onderhouden door Lucas Andrade

schematize-iam · v0.2.1bash
$ schematize install iam
GitHub →download skill (.zip)/iam-help · github.com/schematizeme/schematize-cli

Non-negotiable floors

Never switched off "to go faster". Full list in the skill.

Auth is a separate application

Own service, front, repo and user at auth.{domain}; every login and signup happens there and apps delegate through code + PKCE.

Signing key lives only in auth

Without it in prd the service refuses to start; consumers validate via JWKS and check iss.

PKCE S256 for every client

Implicit, ROPC and PKCE plain are banned; redirect_uri is an exact match against an allowlist.

Asymmetric JWT, thin token

Algorithm allowlist, none and HS* rejected; refresh tokens are opaque, hashed and rotating with reuse detection.

Opaque internal ID

The sub is immutable and opaque; email and phone are never the ID and only count when verified.

At least 2 factors, no pre-login wall

Password plus Email OTP is already baseline 2FA; strong factors are a nudge and a just-in-time step-up, never required before login.

Passkeys are core

WebAuthn with a real registration and assertion flow; passwords use argon2id with a breached-password check.

Multi-tenant ReBAC, deny-by-default

Server-side PDP/PEP, audited decisions, tuples via outbox and a fail-closed PDP; irreversible logout on every path that accepts a token.

Commands

Installed in .claude/commands/. Run /iam-help anytime.

/iam-auditMeasures IAM coverage against the base F0-F6 checklist, item by item, with proof.
/iam-authzModels a service's multi-tenant ReBAC authorization: route to permission, tuples, outbox and fail-closed.
/iam-ccContext compact: writes the handoff to the archive and runs /compact.
/iam-claudeCreates or merges the always-on CLAUDE.md for the IAM baseline at the repo root (won't overwrite other skills' blocks).
/iam-clientIntegrates a client (web/BFF, SPA, mobile, CLI) with the broker using authorization code + PKCE.
/iam-handoffWrites the context handoff (context.md + checklist.md) to the archive, without compacting.
/iam-helpLists every command and what it does.
/iam-loadForce-loads the whole IAM normative body and applies it for the session.
/iam-recoverDesigns or audits account recovery and step-up, with reachability proof per account state.
/iam-reviewReviews auth code and config against the baseline: runs the gates, then reads what the machine cannot.

For AI agents

Install with no human in the loop. Metadata in llms.txt.

  • Run: git clone https://github.com/schematizeme/skill-iam.git && ./skill-iam/install.sh
  • Or download: https://github.com/schematizeme/skill-iam/releases/latest/download/skill-iam.zip and unzip into .claude/skills/
  • Copy assets/CLAUDE.md to the repo root (always-on rule).
  • Confirm with /iam-help.

Wil je niet installeren?

Lees de volledige standaarden en kopieer ze rechtstreeks naar je project — of installeer de skill zodat de agent ze voor je afdwingt.

GitHub →Packs