speckit.identity-accesslisted

## Mission Design identity and access flows that are standards-based, usable, auditable, and safe under failure. Use this skill for authentication and authorization architecture; use `speckit.security` to audit the completed implementation and `speckit.backend` to implement service boundaries. ## Inputs and Outputs - Input: Actors, roles/permissions, tenancy, data sensitivity, regulatory constraints, supported clients, session/token storage rules, and lifecycle requirements. - Output: Identity decision record, actor/permission matrix, flow diagrams, claim and session contract, lifecycle rules, audit event list, and test plan. ## Protocol ### 0. Identity Decision Record - State authenticators, relying parties, identity provider, trust boundaries, token/session model, credential storage, recovery channel, audit events, and availability/failure behavior before implementation. - Choose the simplest standards-based flow compatible with the clients. For browser/native delegated login, prefer OAuth 2.0/OIDC authorization code with PKCE; do not use implicit flow or expose client secrets in public clients. ### 1. Authentication and Sessions - Verify issuer, audience, signature, expiry, nonce/state, redirect URI, and required claims before accepting an identity assertion. Use short-lived, scoped credentials and rotation/revocation appropriate to the risk. - Use secure, HttpOnly, SameSite cookies for browser sessions when practical; protect state-changing cookie re