Hire an AI identity and access engineer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A threat list for your login, ranked by what an attacker would try first
• A sign-in design with the standard method for each flow and why it was chosen
• A session and token plan with lifetimes, renewal and how sign-out works
• A single sign-on and user provisioning plan, if business customers need it
• An access model that keeps each company's data apart, and a recovery plan
• A list of failure tests to run before you launch

How it does the job well

• Never invent security methods. No custom token formats, no home-made password hashing, no "simplified" OAuth. Name the standard, and say "check this against your provider's current guidance".
• The browser or app screen is never the authority. Every permission is checked on the server on every request.
• Redirect links must match an exact allowed list. Verify state and nonce on every callback.
• Tenant identity comes from the signed-in context, never from a request field.
• Tokens hold identifiers, not secrets or personal data.
• Never invent auth primitives. No custom token formats, no hand-rolled password hashing, no "simplified" OAuth. Use authorization code + PKCE, Argon2id/bcrypt via vetted libraries, and boring, audited standards.
• The client is never the authority. Every permission check runs server-side on every request. UI hiding is UX, not security.

Mistakes it avoids

• Suggesting the user build their own token or password scheme.
• Adding single sign-on and provisioning work for an app with no business customers.
• Copying the profile's code samples as if they were the user's design.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You are building login for a new app and want to avoid the common mistakes before you write code.

• Scope. The app, the people who log in, the stack and what customers asked for.
• Threat list. The attacks to expect, ranked, each with the part of the design that stops it.
• Sign-in design. The standard method for each flow, why it was chosen and what to check every time.
• Session and token plan. Lifetimes, renewal rules and how sign-out and cancel work.
• Single sign-on and provisioning. Per-company settings and what happens to access when a person leaves. Only if business customers need it.
• Access model. Roles with what each may do, and how one company's data is kept apart from another's.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Threat-model the login. It asks who logs in, from which devices, and which attackers matter, such as stolen passwords, leavers keeping access or staff over-reaching.
• Choose standard building blocks. It picks a sign-in provider or library and the flow to use. It records why, and rejects home-made methods in writing.
• Design the account model. It sets users, companies, roles, and the rule for when a sign-in email matches an account that already exists.
• Design each flow, failures first. It plans expired codes, reused tokens, removed staff and provider outages before the normal case.
• Plan the record of events. It lists which sign-in, reset and permission events to log, without showing attackers the reason a login failed.
• Plan tests and rollout. It writes attack tests, a way to switch changes on slowly, and a recovery path for admins if the sign-in provider is down.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id engineering-identity-access-engineer only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/engineering-identity-access-engineer/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• What your app does and who logs in, such as shoppers, staff or business customers.
• How people sign in today and what you use for it, such as a provider or your own code.
• Your tech stack, such as Next.js with Postgres.
• The roles and what each may do, and whether one login serves many companies (optional)
• What business customers have asked for, such as SAML or SCIM (optional)

Helpful context (optional)

• Your sign-in provider's settings page or notes, with secrets removed.
• The sign-in or access questions from your last security questionnaire or customer review.
• A list of roles and the pages or data each one should reach.

Tools and access

• Claude, ChatGPT or Gemini: A strong reasoning model gives a better threat list. If you attach your current login code, it can point at the exact place a rule is missing.

Functions and deliverables

• Identity and access engineer: Get a login, single sign-on and permissions design for your app, with session rules, account recovery and the attacks to test before launch.
  • A threat list for your login, ranked by what an attacker would try first
  • A sign-in design with the standard method for each flow and why it was chosen
  • A session and token plan with lifetimes, renewal and how sign-out works
  • A single sign-on and user provisioning plan, if business customers need it
  • An access model that keeps each company's data apart, and a recovery plan
  • A list of failure tests to run before you launch
  Source: Michael Sitarzewski and Agency Agents contributors.
• Login and access builder: Describe your app and login setup. Get a session design, access rules, and security gaps.
  • A login and session design
  • A roles and permissions map
  • Token lifetime and storage rules
  • A list of security gaps to fix
  Source: sickn33.
• Marketplace access auditor: Share your marketplace app code and access rules. Get a permissions table, code-backed risks and test gaps.
  • A table of what each role may do
  • Findings with code evidence
  • A severity ranking
  • A list of tests that should be blocked
  • A fix list
  Source: sickn33.
• AI system attack tester: Find prompt injection, jailbreak and tool abuse risks in your AI app prompts. Get ranked findings with a fix for each. No live app needed.
  • Prompt injection and jailbreak findings, matched by pattern in your prompt text
  • Risk scores for data leaks and data poisoning, taken from fixed tables
  • Tool misuse risks for agents
  • Each finding mapped to a MITRE ATLAS attack ID, a public list of attacks on AI
  • Guardrail fixes ranked by severity
  Source: Alireza Rezvani.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You are building login for a new app and want to avoid the common mistakes before you write code.
• A business customer asks if you support SAML, single sign-on or SCIM and you are not sure what that involves.
• Your sessions or tokens feel loose, for example they last for weeks or you cannot sign someone out everywhere.
• Your app serves many companies and you need to be sure one company can never see another's data.

Limits to check before starting

• You have a small app and want a simple login and permissions plan or review. Use the Login and access builder.
• You need rules for AI agents, not people. Use the AI agent identity designer.
• You want a bug review of finished code. Use the Application security reviewer.
• You want it to change your live login or provider settings. It writes the design. Your team makes and tests each change.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.
• Describe your app, who logs in, your stack and what customers have asked for. Paste your current login notes or settings if you have them. Never paste real passwords or keys.
• Type "Design login and access for this app. Threat list first, then failure cases. Use standard methods only and mark anything you assume."
• Read the threat list and the account model first. Correct any wrong fact and ask it to run the design again.
• Give the design to your developer or security lead. Ask them to check the lifetimes and settings against your provider's own guidance.
• Build it, then run the failure tests. The AI does not run or test your login.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/engineering-identity-access-engineer for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.