What problem does it solve? Building consistent role-based access control across an ERP backend and frontend is error-prone: permissions get hardcoded as strings, policies drift from permission names, and UI buttons stay visible to unauthorized users. This Skill provides a complete, convention-driven RBAC implementation covering permission definition, policy registration, controller enforcement, handler-level checks, and frontend guards. ## Core Features & Use Cases - Permission Definition & Policy Registration: Define permissions as {module}.{entity}.{action} constants in static Domain classes and auto-register ASP.NET Core authorization policies from them, eliminating manual mapping. - Multi-Layer Enforcement: Apply [Authorize(Policy)] on every controller action, verify tenant ownership in MediatR handlers via ICurrentUser, and embed permissions as JWT claims with wildcard super-admin support. - Frontend Permission Guards: Use a usePermission React hook to conditionally render destructive or sensitive actions based on the user's permission set. - Use Case: When adding a new "approve invoice" endpoint to a finance module, generate the permission constant, register its policy, protect the controller action, verify tenant ownership in the handler, seed the permission in SQL Server, and hide the Approve button for unauthorized users. ## Quick Start Ask the AI to add authorization with a new permission for an endpoint, for example: add an approve permission for finance invoices and protect the endpoint, handler, and UI button.
