cosec-policy-authorlisted
Install: claude install-skill Ahoo-Wang/skills
# CoSec Policy Authoring
Produce the smallest policy that expresses the requested access rule. Establish the endpoint paths and methods, anonymous/authenticated behavior, roles or principal attributes, tenant scope, and explicit deny cases before writing JSON.
## Minimal complete policy
```json
{
"id": "orders-api",
"name": "Orders API",
"category": "orders",
"description": "Order endpoint access",
"type": "global",
"tenantId": "(platform)",
"statements": [
{
"name": "ReadOwnOrder",
"action": {
"path": {
"method": "GET",
"pattern": "/users/{userId}/orders/*"
}
},
"condition": {
"eq": {
"part": "request.path.var.userId",
"value": "#{principal.id}"
}
}
}
]
}
```
Use the full field set above so both runtime deserialization and the bundled JSON Schema accept the policy. Runtime requires `id`, `name`, `type`, and `tenantId`, while the current schema requires `category`, `name`, `description`, `tenantId`, `type`, and `statements` but omits `id`. A statement requires `action`; `effect` defaults to `allow` and `condition` defaults to match-all. Local files normally live under `src/main/resources/cosec-policy/` and match `*-policy.json`.
## Evaluation semantics
Authorization evaluates in tiers: root bypass, blacklist, global policies, principal-attached policies, then role permissions. The first tier that produces a result stops evaluation.
Within a poli