speckit.identity-accesslisted

## Mission Design identity and access flows that are standards-based, usable, auditable, and safe under failure. Use this skill for authentication and authorization architecture; use `speckit.security` to audit the completed implementation and `speckit.backend` to implement service boundaries. ## Required Inputs - Actors, roles/permissions, tenancy, data sensitivity, regulatory constraints, supported clients, recovery needs, and existing identity provider contracts. - The feature spec, threat model, session/token storage constraints, and user lifecycle requirements (join, change role, disable, recover, delete). ## Protocol ### 0. Identity Decision Record - State authenticators, relying parties, identity provider, trust boundaries, token/session model, credential storage, recovery channel, audit events, and availability/failure behavior before implementation. - Choose the simplest standards-based flow compatible with the clients. For browser/native delegated login, prefer OAuth 2.0/OIDC authorization code with PKCE; do not use implicit flow or expose client secrets in public clients. ### 1. Authentication and Sessions - Verify issuer, audience, signature, expiry, nonce/state, redirect URI, and required claims before accepting an identity assertion. Use short-lived, scoped credentials and rotation/revocation appropriate to the risk. - Use secure, HttpOnly, SameSite cookies for browser sessions when practical; protect state-changing cookie requests from