oborchers/permissions-and-settings
saas-design-principles/skills/permissions-and-settings/SKILL.md
This skill should be used when the user is building or reviewing role-based access control (RBAC), invitation flows, settings pages, admin panels, or feature gating. Covers the hide/disable/reduce strategy for restricted features, RBAC progression, account vs workspace settings separation, and invitation UX.
$ install --global
skillsauthnpx skillsauth add oborchers/fractional-cto permissions-and-settingsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 13, 2026, 6:52 AM165.0s1 file scanned
SKILL.md
- name:
- permissions-and-settings
- description:
- This skill should be used when the user is building or reviewing role-based access control (RBAC), invitation flows, settings pages, admin panels, or feature gating. Covers the hide/disable/reduce strategy for restricted features, RBAC progression, account vs workspace settings separation, and invitation UX.
- version:
- 1.0.0
Permissions Should Be Felt, Not Fought
Every user should see exactly what they need to get their job done — no more, no less.
Three Strategies for Restricted Features
All three are needed — choose per feature:
| Strategy | When to Use | Example | |----------|-------------|---------| | Hide completely | Entire section irrelevant to the role | Admin-only billing section hidden from members | | Show but disable (with tooltip) | User should know the feature exists — upsell path | Plan-gated feature with "Upgrade to Pro" tooltip | | Show with reduced functionality | Read access appropriate, write access isn't | View-only dashboard for member role |
RBAC Progression
Follow WorkOS's practical progression, building incrementally:
- Simple admin/member differentiation — start here
- Fine-grained permissions per feature — define what each role can do
- Roll-up roles — combine permissions into named roles
- Resource groups — scope roles to orgs, teams, projects
- Custom roles — let admins define their own
- IdP attribute mapping — for enterprise SSO
Key UX guardrail: Expose permission bundles that map to real product concepts, not 40 atomic checkboxes. Enforce limits like "max 20 custom roles per tenant" to prevent configuration chaos.
Invitation Flows
Three mechanisms are needed:
1. Email Invite (Default)
Admin enters addresses, sets access level before sending.
2. Link Invite (Bulk)
For bulk invitations. Support expiration dates and domain restrictions.
3. Domain-Based Provisioning (Enterprise SSO)
Accounts auto-created on first login.
Invitation email must include:
- Who invited them
- What the product does
- Who else from their team is already using it
Differentiate onboarding for invited users — they get a shorter, different flow because context already exists.
Settings Architecture
Clean split between two concerns:
| Settings Type | Belongs To | Examples | |--------------|-----------|----------| | Account settings | The person | Profile, password, notifications, appearance | | Workspace settings | The organization | Members, billing, integrations, security policies |
Never mix them.
Layout: Sidebar navigation + content area. This is the standard used by GitHub, Linear, and Vercel.
Avoid tab-based settings when there are more than 5–6 categories — tabs don't scale.
Two-column layout (Shopify Polaris pattern):
- Left column: scannable labels and descriptions
- Right column: grouped settings in cards
Review Checklist
When reviewing or building permissions and settings:
- [ ] Restricted features use the correct strategy (hide / disable with tooltip / reduced functionality)
- [ ] RBAC uses permission bundles, not atomic checkboxes
- [ ] Custom roles have a reasonable limit per tenant
- [ ] Email, link, and domain-based invitation flows all supported
- [ ] Invitation emails include who invited, what the product does, and who else is using it
- [ ] Invited users get a shorter, differentiated onboarding
- [ ] Account settings (person) and workspace settings (org) are fully separated
- [ ] Settings use sidebar navigation, not tabs (if >5–6 categories)
- [ ] Two-column layout: labels/descriptions on left, controls on right
Related Skills
oborchers/using-planning-tools
tools
VerifiedTrustedCommunity
This skill should be used when the user invokes any /plan-* command from the planning-tools plugin (/plan-context, /plan-master, /plan-open-questions, /plan-verify, /plan-tick, /plan-progress, /plan-delete), asks how Claude Code's plan files work, asks where plans are stored, asks to author or audit a multi-phase master planning document, asks how to walk through a plan's Open Questions interactively, asks how to write progress entries, or mentions ~/.claude/plans/ or .claude/planning-tools.local.md. Provides the index of planning-tools commands, the master-plan workflow lifecycle, the v0.3.0+ list-shape mandate (phases and questions as headings + bulleted scope items, never tables), the v0.3.2+ plain-bullet shape (no `- [ ]` checkboxes — heading emoji is the sole tick signal), the progress-entry methodology, and the mechanics of Claude Code's plan-mode file storage.
14SKILL.mdUpdated May 13, 2026
oborchers/whitespace-density
testing
VerifiedTrustedCommunity
This skill should be used when the user is adjusting spacing, padding, margins, content density, section gaps, vertical rhythm, or separation between elements. Also applies when reviewing whether a design feels cramped or too sparse, choosing between borders and whitespace for separation, or defining a spacing system. Covers the 4px/8px spacing system, macro vs micro whitespace, content density spectrum, separation techniques (whitespace > background shifts > borders), and vertical rhythm.
12SKILL.mdUpdated May 22, 2026
oborchers/visual-interest-expression
development
VerifiedTrustedCommunity
This skill should be used when the user is defining brand personality in design, choosing between illustration and photography, adding motion or animation, creating visual motifs, ensuring layout variety, customizing CSS framework defaults, or calibrating the level of creative expression for a given context. Covers Lavie & Tractinsky's expressive aesthetics, the expression spectrum (restrained to bold), brand personality translation, illustration systems, photography direction, and template independence.
12SKILL.mdUpdated May 22, 2026
oborchers/visual-hierarchy
development
VerifiedTrustedCommunity
This skill should be used when the user is establishing visual importance, designing headings, creating focal points, designing CTAs or buttons, arranging label-data relationships, implementing scanning patterns (F-pattern, Z-pattern), or ensuring one dominant element per screen. Covers the three levers of hierarchy (size, weight, color), three-tier information architecture, the 'emphasize by de-emphasizing' principle, CTA design, and label-data relationships.
12SKILL.mdUpdated May 22, 2026