domains / families / security / marketplace-rbac-audit

marketplace-rbac-audit

authentic

Audit multi-role marketplace authorization across roles, resource ownership, tenant boundaries, and order-state transitions; use when access rules need evidence, not UI assumptions.

When to use

• Reviewing authorization in a marketplace, delivery platform, multi-vendor store, or fulfillment system.
• Adding or changing roles, administrative powers, ownership rules, or order-state transitions.
• Investigating whether one customer, vendor, courier, hub, or tenant can access another party's resources.
• Preparing negative authorization tests before release or after an access-control incident.

When not to use

• A source review cannot prove runtime identity-provider configuration or database policies without corresponding evidence.
• Negative tests prove only the identities, resources, operations, states, and environments exercised.
• This skill does not replace threat modeling, authentication review, privacy assessment, or an authorized penetration test.
• Marketplace policy varies by product and jurisdiction; unresolved business decisions must remain **UNDEFINED**.

Skill page

Source