What problem does it solve? Designing and enforcing authorization in a multi-site CMS is error-prone: permissions get scattered across handlers, frontend menus become accidental security boundaries, and cached grants go stale. This Skill provides a structured decision framework for implementing users/groups/roles, site-scoped permissions, and enforcement boundaries correctly in the Go CMS codebase. ## Core Features & Use Cases - Permission Model Design: Distinguishes authentication, authorization, visibility, and ownership scope, with explicit guidance on view/edit/delete/create semantics and permission implication rules. - Enforcement Boundary Guidance: Directs checks to authorizer or application-service layers so every transport path is covered, avoiding frontend-only or handler-only authorization. - Cache Coherence & Testing: Covers permission-cache invalidation with fail-closed policy and behavior-driven tests including negative cross-scope cases. - Use Case: When adding a new site-scoped permission (e.g., sites.edit), use this Skill to place the check at the right layer, wire group combination semantics, expose capabilities to the admin UI, and write cross-site denial tests. ## Quick Start Ask the assistant to review or implement a site-scoped permission change in the Go CMS backend using the authorization guidelines.
