preset-roles-permissionslisted

# preset-roles-permissions Use as the approval and access-review gate for permission-sensitive workflows. ## Always - Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. - Use this skill alongside `preset-admin` role identifier and membership references for Management API role work. - Use `preset-superset` for workspace current-user roles, permissions, and OpenAPI availability. - Treat role and permission changes as `permission_write`. - Do not guess role IDs or custom role identifiers. - Do not use internal `/api-internal/*`, billing, SCIM, broad Superset security manager, or unsupported permission APIs from this skill; defer to `references/role-permission-changes.md`. - Require confirmation of target principal, current access, new access, seat impact, and rollback path. ## Decision Rules - Classify role and permission changes as access mutations. - Resolve role identifiers before effect summary. - Require approval with target and effect. - Avoid applying role or permission changes until approval is explicit. ## Workflow Order 1. Inspect membership roles and permissions. 2. Resolve target and role identifiers. 3. Summarize access effect, seat impact, and rollback path. 4. Stop before role or permission change. ## Retrieve - Role/permission mutation guidance and approval checks: [references/role-permission-changes.md](references/role-permission-changes.md