checking-member-access

Files (1)

• SKILL.md

SKILL.md (first lines)

# Checking member access

Use this skill to answer "what can this person do here?" from the access control tools. The tools return
the enforced level and where it comes from. This skill is for reading them correctly.

## When to use this skill

- "What can this member do in this project?" / "Can this member edit feature flags?"
- "Who can edit dashboards?" / "Who has no access to experiments?"
- "Why can't this member open this dashboard?" / "Which tables is this role restricted from?"
- "Which properties are hidden from the support role?"
- "What does the `analyst` role grant?" / "What is the default access in this project?"

Access rules can also be changed with MCP write tools. Read the current rule first, explain the change, then use the prepare/execute flow and call execute only after the user confirms.

## Plan availability

- Free and pay-as-you-go plans have no access control, and the access control tools are not offered to
  them. If the tools are missing from the catalog, say that the plan does not include access control and
  suggest upgrading to the Boost plan. Link the plan comparison: https://posthog.com/platform-packages.
- Boost and Scale include the default levels and rules for single members on the project, on tools, on
  objects and on properties.
- Roles exist on every plan, but role rules are an Enterprise feature: they can be set and are enforced
  only there, and the three role access tools are offered only there. If the tools are missing, say that
  role-based access control needs the Enterprise plan, with the same link. On other plans a member's
  roles never change the enforced level.
- The tools do not say which plan the organization is on. A `source_subject` of `role` anywhere in a
  `members-list` result proves that role rules are enforced. Without that, ask the user whether the organization
  is on Enterprise before walking roles in step 4 of the workflow.

## How access resolves

- **Scopes.** The project itself, then each tool (`dashboard`, `insight`, `feature_flag`, `notebook`,
  `experiment`, `warehouse_objects`, and so on), then single objects inside a tool, then person and event
  properties. The tool names are the keys of `resources` in a members-list entry.
- **Project levels.** `none` blocks access to the project and its resources. `member` can view and edit the
  resources their other rules permit. `admin` can also edit project settings, manage the project's access rules,
  and delete the project.
- **Tool and object levels.** `none` cannot view. `viewer` can view but not change. `editor` can view and
  change. `manager` can also manage the access rules of the tool or object. Order: `none` < `viewer` <
  `editor` < `manager`.
- **Property levels.** `none` hides the property. `read` shows it. `read_write` also allows edits. Every
  property is `read_write` unless a rule exists.
- **Bounds.** `minimum` and `maximum` per tool, on `defaults-get`, are the levels a rule can set. A tool
  with `minimum` `viewer` can never be set to `none`.
- **Subjects.** A rule belongs to one member, one role, or everyone in the project (the default).
- **Organization admins and owners** have full access to everything in every project. No rule applies to
  them. `organization_level` is a number: 1 member, 8 admin, 15 owner.
- **Creators** have full access to the objects they created, and only those. A member with `viewer` on
  dashboards can still edit the dashboard they created, and cannot edit the others.
- **Two resolution modes.** Organizations resolve rules either most-specific-first (member rule, then
  role rules, then default, and object rule before tool rule) or legacy (the highest of the member's own
  rule and role rules wins). The tools do not say which mode applies. The server already applied it. So
  **trust `effective_access_level` and never recompute it from the stored rules.** If the user asks why,
  explain from `inherited_access`, not from your own precedence.

## Available tools

| Tool                                                                                                  | Returns                                                                                          |
| ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| `posthog:access-control-members-list`                                                                 | Every member's enforced access to the project and to each tool. `member_id` narrows to a member. |
| `posthog:access-control-roles-list`                                                                   | The same per role. `role_id` narrows to a role.                                                  |
| `posthog:access-control-defaults-get`                                                                 | The project baseline, and which tools accept rules on single objects.                            |
| `posthog:access-control-default-rule-set-prepare` / `posthog:access-control-default-rule-set-execute` | Set or clear a default rule for a scope.                                                         |
| `posthog:access-control-member-rule-set-prepare` / `posthog:access-control-member-rule-set-execute`   | Set or clear one member's rule for a scope.                                                      |
| `posthog:access-control-role-rule-set-prepare` / `posthog:access-control-role-rule-set-execute`       | Set or clear one role's rule for a scope.                                                        |
| `posthog:access-control-member-objects-list`                                                          | The object rules set for a member: every object with a rule for that member.                     |
| `posthog:access-control-member-properties-list`                                                       | The property rules set for a member.                                                             |
| `posthog:access-control-role-objects-list`                                                            | The object rules set for a role.                                                                 |
| `posthog:access-control-role-properties-list`                                                         | The property rules set for a role.                                                               |
| `posthog:access-control-default-objects-list`                                                         | The object rules that apply to everyone in the project.                                          |
| `posthog:access-control-default-properties-list`                                                      | The property rules that apply to everyone in the project.                                        |
| `posthog:org-members-list`                                                                            | Membership ids, names and organization levels. No project access details.                        |
| `posthog:roles-list`, `posthog:role-members-list`                                                     | Role names by id, and who is in a role.                                                          |

All access control tools take an optional project id and default to the active project.

## Workflow

1. **Find the subject id.** `member_id` is the organization membership id: the `id` from
   `org-members-list`, or `organization_membership_id` from `members-list`. It is not the user id and not
   the user uuid. `role_id` is the `id` from `roles-list`.
2. **Tool-level questions need one call.** "Can this member view dashboards?" or "What access to feature
   flags does this member have?" is `members-list` with `member_id`. `effective_access_level` for that tool
   is the complete answer. It already includes the member's roles, the project default and the bypasses.
3. **Explain the level from `inherited_access`.** See the table below. Only mention the stored
   `access_level` when it differs from the enforced level.
4. **Object questions need the object and its rules.** "Can this member open dashboard 42?" cannot be
   answered from the tool level alone. Check in this order, and stop at the first hit:
   1. `organization_level` is 8 or 15 on the member's entry: full access, no rule applies.
   2. The member created the object: full access, no rule applies. The rule tools do not say who created
      an object, so fetch it with its own get tool, for example `dashboard-get` or `insight-get`, and
      compare `created_by.uuid` with `user.uuid` on the member's entry.
   3. A rule on that object. The member tools return only the rules set for that member, so collect
      `member-objects-list`, `role-objects-list` for each id in the member's `role_ids`, and
      `default-objects-list`, and pick out the rows for this object. Tell the user how many roles you
      would walk and ask before doing it for a member in many roles.
   4. No rule on the object: the tool-level answer from step 2 applies.
5. **Several rules on one object.** When the member, a role and the default each set a level on the
   same object, the server picks one by the organization's resolution mode, and no tool returns that
   pick for another member. Report every rule you found with its subject, say the enforced one depends
   on the mode, and do not guess. Property questions work like step 4 with the properties tools, minus
   the creator check, since properties have no creator.
6. **"Who can ..." questions** are `members-list` without `member_id`, filtered on
   `resources.<tool>.effective_access_level`. The response is every member times every tool and has no
   pagination. For a large organization, ask which people the user cares about first, or answer per
   member.

## Reading one entry

| Field                             | Meaning                                                                                                                                                                                                                                                                          |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `access_level`                    | The subject's own stored rule for this scope. `null` means no rule of its own.                                                                                                                                                                                                   |
| `effective_access_level`          | What is enforced. `null` means nothing resolves for this scope. It is not "no access".                                                                                                                                                                                           |
| `inherited_access`                | The level the subject falls back to without a rule of its own, and where it comes from. `null` when nothing supplies one.                                                                                                                                                        |
| `inherited_access.source`         | `resource` or `parent_resource` for a tool rule, `object` or `parent_object` for an object rule, `system_default` for the PostHog default. `org_admin` and `creator` are the bypasses described above. `org_membership` appears only when the object is the organization itself. |
| `inherited_access.source_subject` | `member`, `role` or `default`: whose rule supplied it. `null` when a bypass or the PostHog default did.                                                                                                                                                                          |

How to phrase the answer:

From PostHog/skills, MIT.