instantly-enterprise-rbac
Manages Instantly workspace permissions, member roles, and secure API key governance.
Install
mkdir -p .claude/skills/instantly-enterprise-rbac && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/7278" && unzip -o skill.zip -d .claude/skills/instantly-enterprise-rbac && rm skill.zipInstalls to .claude/skills/instantly-enterprise-rbac
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Configure Instantly.ai workspace access control, team management, andKey capabilities
- →List, invite, update, and remove Instantly workspace members
- →Create API keys with specific scopes for different team roles
- →Audit existing API keys for overprivileged access
- →Revoke Instantly API keys
- →Manage workspace group members for agencies
- →View audit logs for workspace actions
How it works
The skill provides code examples and instructions for managing Instantly workspace access, including member operations, API key governance with scoped permissions, and audit logging through API calls.
Inputs & outputs
When to use instantly-enterprise-rbac
- →Manage workspace members
- →Audit API key permissions
- →Set up role-based access control
- →Configure organization-level security
About this skill
Instantly Workspace Access Governance
Overview
Review and change access with least privilege, explicit ownership, and tenant-boundary evidence. Record assumptions, evidence, approval state, and rollback ownership so another operator can reproduce the result.
Prerequisites
- The target repository, Instantly workspace, environment, and accountable owner
- Current security, privacy, compliance, capacity, and change-control requirements
- An approved API v2 key only when a bounded live verification is necessary
Tool Discipline
Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Instantly documentation and package metadata. Use Write or Edit only when implementation was requested and exact target files are known; never write credentials, lead data, email content, or unrestricted environment output.
Current Contract
- API v2 keys support granular resource/action scopes and can be revoked.
- Workspace groups let an admin key act for a sub-workspace through x-as-workspace.
- Only owners/admins can manage group membership, and only owners can leave a group.
Authentication
Use an API v2 key as Authorization: Bearer <key> against https://api.instantly.ai/api/v2. Grant only the endpoint-specific scopes needed, inject the key from an approved server-side secret manager, and never print, persist, commit, or place it in a URL. Treat key creation, rotation, revocation, member changes, workspace delegation, and production access as owner-approved actions.
Instructions
- Inventory members, roles, API keys, scopes, service owners, and last-use evidence.
- Map each automation to the narrowest read/create/update/delete scope set.
- Review audit logs and flag orphaned, broad, shared, or cross-workspace credentials.
- For sub-workspace actions, validate the target ID and x-as-workspace header before execution.
- Prepare member/key/group changes as a reviewed change set.
- Apply only approved changes and verify both intended access and denied cross-tenant access.
Approval Boundaries
Do not create, rotate, reveal, or revoke keys; invite or remove members; delegate across workspaces; connect sending accounts; create or activate campaigns; import or delete leads; change suppression or retention; register, patch, resume, or delete webhooks; alter plans or paid capacity; transmit diagnostics; or perform another production mutation without explicit approval from the accountable owner. Keep diagnosis read-only unless implementation was requested.
Output
Return the workspace-safe scope, files and contracts inspected, exact API v2 routes and required scopes, evidence collected, validation result, sensitive fields redacted, remaining risk, accountable owner, approval state, and rollback or next action.
Error Handling
| Condition | Response |
|---|---|
401 | Stop and verify that the bearer key exists, is current, and was not revoked. |
403 | Stop and compare the operation with its exact required scope; do not broaden to all:all by default. |
429 | Coordinate the workspace-wide budget, honor endpoint overrides, and bound retries. |
| Schema or tenant mismatch | Fail closed, preserve redacted evidence, and do not retry a mutation. |
Examples
Use a compact handoff that makes scope, mutation authority, and evidence reviewable.
Input:
mode=review; workspace=opaque-id; include-secrets=false
Expected handoff:
broad-keys=2; orphaned-members=1; changes=awaiting-owner
Resources
When not to use it
- →When Instantly API v1 is still in use
- →When only basic API key management is needed
Prerequisites
Limitations
- →Requires Instantly Hypergrowth plan or higher
- →Cannot self-revoke an API key
- →Audit logs may be empty if the feature is not available on the plan
How it compares
This approach uses API calls to programmatically manage Instantly access controls and API keys, unlike manual configuration through a dashboard.
Compared to similar skills
instantly-enterprise-rbac side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| instantly-enterprise-rbac (this skill) | 1 | 2mo | Review | Intermediate |
| 1password | 27 | 4mo | Review | Intermediate |
| security-compliance | 19 | 9mo | Review | Advanced |
| information-security-manager-iso27001 | 11 | 9mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by jeremylongshore
View all by jeremylongshore →You might also like
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
security-compliance
davila7
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
information-security-manager-iso27001
davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
cursor-sso-integration
jeremylongshore
Configure SSO and enterprise authentication in Cursor. Triggers on "cursor sso", "cursor saml", "cursor oauth", "enterprise cursor auth", "cursor okta". Use when working with cursor sso integration functionality. Trigger with phrases like "cursor sso integration", "cursor integration", "cursor".
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.