Identity is not email, and login must not be a wall — no negotiation.
One broker at auth.{domain} that knows who the person is and proves it to the apps: PKCE for every client, asymmetric JWTs, at least 2 factors, deny-by-default ReBAC and recovery at least as strong as login.
$ schematize install iamNon-negotiable floors
Never switched off "to go faster". Full list in the skill.
Auth is a separate application
Own service, front, repo and user at auth.{domain}; every login and signup happens there and apps delegate through code + PKCE.
Signing key lives only in auth
Without it in prd the service refuses to start; consumers validate via JWKS and check iss.
PKCE S256 for every client
Implicit, ROPC and PKCE plain are banned; redirect_uri is an exact match against an allowlist.
Asymmetric JWT, thin token
Algorithm allowlist, none and HS* rejected; refresh tokens are opaque, hashed and rotating with reuse detection.
Opaque internal ID
The sub is immutable and opaque; email and phone are never the ID and only count when verified.
At least 2 factors, no pre-login wall
Password plus Email OTP is already baseline 2FA; strong factors are a nudge and a just-in-time step-up, never required before login.
Passkeys are core
WebAuthn with a real registration and assertion flow; passwords use argon2id with a breached-password check.
Multi-tenant ReBAC, deny-by-default
Server-side PDP/PEP, audited decisions, tuples via outbox and a fail-closed PDP; irreversible logout on every path that accepts a token.
Commands
Installed in .claude/commands/. Run /iam-help anytime.
/iam-auditMeasures IAM coverage against the base F0-F6 checklist, item by item, with proof./iam-authzModels a service's multi-tenant ReBAC authorization: route to permission, tuples, outbox and fail-closed./iam-ccContext compact: writes the handoff to the archive and runs /compact./iam-claudeCreates or merges the always-on CLAUDE.md for the IAM baseline at the repo root (won't overwrite other skills' blocks)./iam-clientIntegrates a client (web/BFF, SPA, mobile, CLI) with the broker using authorization code + PKCE./iam-handoffWrites the context handoff (context.md + checklist.md) to the archive, without compacting./iam-helpLists every command and what it does./iam-loadForce-loads the whole IAM normative body and applies it for the session./iam-recoverDesigns or audits account recovery and step-up, with reachability proof per account state./iam-reviewReviews auth code and config against the baseline: runs the gates, then reads what the machine cannot.For AI agents
Install with no human in the loop. Metadata in llms.txt.
- Run: git clone https://github.com/schematizeme/skill-iam.git && ./skill-iam/install.sh
- Or download: https://github.com/schematizeme/skill-iam/releases/latest/download/skill-iam.zip and unzip into .claude/skills/
- Copy assets/CLAUDE.md to the repo root (always-on rule).
- Confirm with /iam-help.
Обсуждение
Загрузка…