{ "schema": "aiblocks-page/1", "id": "agency-engineering-identity-access-engineer", "type": "agent", "name": "Identity and access engineer", "summary": "Get a login, single sign-on and permissions design for your app, with session rules, account recovery and the attacks to test before launch.", "headline": "Identity and access engineer", "subhead": "Describe your app, who logs in and what each person may see. It designs sign-in, sessions, single sign-on and access rules, and lists the failure cases to test. You get a design a developer can build, plus the questions still open.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "codebase", "required": false, "label": "Codebase", "what": "a project's code, in a folder or repo the AI can open" } ], "outputs": [ { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" }, { "type": "security_report", "required": true, "label": "Security report", "what": "the risks found in the code, ranked, each with a fix" } ], "you_give": [ "What your app does and who logs in, such as shoppers, staff or business customers.", "How people sign in today and what you use for it, such as a provider or your own code.", "Your tech stack, such as Next.js with Postgres.", "The roles and what each may do, and whether one login serves many companies (optional)", "What business customers have asked for, such as SAML or SCIM (optional)" ], "you_get": [ "A threat list for your login, ranked by what an attacker would try first", "A sign-in design with the standard method for each flow and why it was chosen", "A session and token plan with lifetimes, renewal and how sign-out works", "A single sign-on and user provisioning plan, if business customers need it", "An access model that keeps each company's data apart, and a recovery plan", "A list of failure tests to run before you launch" ], "use_when": [ "You are building login for a new app and want to avoid the common mistakes before you write code.", "A business customer asks if you support SAML, single sign-on or SCIM and you are not sure what that involves.", "Your sessions or tokens feel loose, for example they last for weeks or you cannot sign someone out everywhere.", "Your app serves many companies and you need to be sure one company can never see another's data." ], "skip_when": [ "You have a small app and want a simple login and permissions plan or review. Use the Login and access builder.", "You need rules for AI agents, not people. Use the AI agent identity designer.", "You want a bug review of finished code. Use the Application security reviewer.", "You want it to change your live login or provider settings. It writes the design. Your team makes and tests each change." ], "output_sample": { "input": [ "What your app does and who logs in", "How people sign in today and what you use for it", "Your tech stack", "Roles, company setup and what customers have asked for (optional)" ], "output": [ { "name": "Scope", "contains": "The app, the people who log in, the stack and what customers asked for." }, { "name": "Threat list", "contains": "The attacks to expect, ranked, each with the part of the design that stops it." }, { "name": "Sign-in design", "contains": "The standard method for each flow, why it was chosen and what to check every time." }, { "name": "Session and token plan", "contains": "Lifetimes, renewal rules and how sign-out and cancel work." }, { "name": "Single sign-on and provisioning", "contains": "Per-company settings and what happens to access when a person leaves. Only if business customers need it." }, { "name": "Access model", "contains": "Roles with what each may do, and how one company's data is kept apart from another's." }, { "name": "Recovery plan", "contains": "How password reset and lost devices work safely, and what is logged." }, { "name": "Failure tests", "contains": "Attacks and failures to try before launch, each with the result you should see." }, { "name": "Gaps and checks", "contains": "Missing facts and open choices, with who should decide each." } ] }, "output_shape": "SCOPE\n App | Who logs in | Stack | Customer asks \n\nTHREAT LIST\n | | \n\nSIGN-IN DESIGN\n | | | \n\nSESSION AND TOKEN PLAN\n | | | \n\nSINGLE SIGN-ON AND PROVISIONING (if needed)\n | | \n\nACCESS MODEL\n | | \n\nRECOVERY PLAN\n | | \n\nFAILURE TESTS\n | \n\nGAPS AND CHECKS\n | | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.", "Describe your app, who logs in, your stack and what customers have asked for. Paste your current login notes or settings if you have them. Never paste real passwords or keys.", "Type \"Design login and access for this app. Threat list first, then failure cases. Use standard methods only and mark anything you assume.\"", "Read the threat list and the account model first. Correct any wrong fact and ask it to run the design again.", "Give the design to your developer or security lead. Ask them to check the lifetimes and settings against your provider's own guidance.", "Build it, then run the failure tests. The AI does not run or test your login." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "AI agent attack tester", "url": "https://useaiblocks.com/skills/ai-agent-attack-tester", "why": "AI agent attack tester" }, { "name": "Prompt injection defender", "url": "https://useaiblocks.com/skills/prompt-injection-defender", "why": "Prompt injection defender" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/engineering/engineering-identity-access-engineer.md", "licence": "MIT", "original_name": "Identity & Access Engineer", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Identity & Access Engineer", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/engineering/engineering-identity-access-engineer.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-engineering-identity-access-engineer", "markdown": "https://useaiblocks.com/agents/agency-engineering-identity-access-engineer.md", "json": "https://useaiblocks.com/agents/agency-engineering-identity-access-engineer.json", "instructions": "https://useaiblocks.com/skills/agency-engineering-identity-access-engineer/SKILL.md", "download": "https://useaiblocks.com/skills/agency-engineering-identity-access-engineer.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-engineering-identity-access-engineer", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-engineering-identity-access-engineer", "mcp": "https://useaiblocks.com/mcp" } }