openevidence-enterprise-rbac
Sets up role hierarchies and permissions for managing access to clinical evidence and research data.
Install
mkdir -p .claude/skills/openevidence-enterprise-rbac && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/6321" && unzip -o skill.zip -d .claude/skills/openevidence-enterprise-rbac && rm skill.zipInstalls to .claude/skills/openevidence-enterprise-rbac
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Enterprise Rbac for OpenEvidence.Key capabilities
- →Manage institutional access and SSO configuration
- →Assign role-based permissions for clinicians and researchers
- →Track PHI access events for HIPAA compliance
- →Audit clinical query logs and compliance reports
How it works
Access is controlled through an institutional API that validates user roles against defined resource scopes. All actions are logged with specific metadata to satisfy HIPAA audit requirements.
Inputs & outputs
When to use openevidence-enterprise-rbac
- →Implementing SSO integration
- →Configuring role-based permissions
- →Setting up organization-level controls
- →Auditing clinical query access
About this skill
OpenEvidence Institutional Access Governance
Overview
Translate institutional roles and least-privilege expectations into verifiable product and contract controls. Keep inputs minimal, separate observed facts from assumptions, and leave consequential decisions with the named accountable owner.
Prerequisites
- A clearly bounded workflow, accountable clinical owner, and organizational policy
- Current first-party OpenEvidence documentation and applicable institution agreements
- Synthetic or properly authorized minimum-necessary data
Tool Discipline
Use Read, Glob, and Grep to inspect supplied policies, plans, and evidence. Use WebFetch only for current first-party OpenEvidence documentation. Use Write or Edit only when the user requests a named deliverable with an approved destination. Never expose credentials, PHI, recordings, or unrestricted environment output.
Current Contract
- No public RBAC, SCIM, provisioning, or administration API contract was found in the audited product documentation.
- Only the current institution agreement and authorized administration interface can establish available controls.
- Shared credentials are prohibited by the published account terms.
Authentication
Use only the official OpenEvidence web/mobile sign-in or an institution-approved access path. Do not invent API keys, OAuth clients, SDK credentials, service accounts, or private endpoints. Never ask a user to reveal a password, session token, cookie, or recovery code.
Instructions
- Inventory user populations, clinical roles, administrators, support staff, devices, workflows, and sensitive data exposure.
- Read the agreement and authorized admin documentation; mark SSO, provisioning, audit, and role features confirmed or unknown.
- Define joiner, mover, leaver, periodic review, break-glass, and compromised-account procedures.
- Map each workflow to minimum access and an accountable approver; prohibit shared accounts.
- Run a sample access review using authorized records without exporting unnecessary personal data.
- Return confirmed controls, gaps, compensating controls, vendor questions, owners, and review cadence.
Approval Boundaries
Do not create or share accounts; change access, roles, agreements, consent, retention, or security settings; enter PHI; record a conversation; copy content into another system; contact a patient; make a diagnosis or treatment decision; submit billing; transmit a support packet; run a production pilot; or represent vendor capabilities without explicit approval from the accountable owner. A qualified professional remains responsible for clinical decisions.
Output
Return scope, current first-party evidence and date, data classification, workflow or findings, citations reviewed, assumptions rejected, clinical and governance owners, approval state, unresolved risk, and the exact next action. Redact patient and credential data.
Error Handling
| Condition | Response |
|---|---|
| Admin capability unclear | Mark unknown and seek written confirmation; do not infer an endpoint. |
| Orphaned account | Follow the authorized deprovisioning path and record the owner. |
| Shared login discovered | Stop the practice, preserve evidence, and initiate individual access remediation. |
Examples
This compact example shows the minimum reviewable handoff; adapt fields to the approved workflow without adding sensitive data.
Input:
institution=clinic; users=physicians+schedulers; SSO=unknown; review=quarterly
Expected handoff:
controls=confirmed/unknown matrix; gaps=3; shared-accounts=0; owner=IAM
Resources
When not to use it
- →Granting researcher access to clinical PHI datasets
- →Assigning institutional admin roles to medical students
Prerequisites
Limitations
- →Dataset access restricted to IRB-approved studies
- →Export functionality requires specific researcher permissions
How it compares
Unlike generic RBAC, this system enforces specific clinical roles like 'Researcher' and 'Medical Student' with built-in HIPAA audit hooks.
Compared to similar skills
openevidence-enterprise-rbac side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| openevidence-enterprise-rbac (this skill) | 1 | 2mo | No flags | Intermediate |
| 1password | 27 | 4mo | Review | Intermediate |
| security-compliance | 19 | 9mo | Review | Advanced |
| information-security-manager-iso27001 | 11 | 9mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by jeremylongshore
View all by jeremylongshore →You might also like
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
security-compliance
davila7
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
information-security-manager-iso27001
davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
cursor-sso-integration
jeremylongshore
Configure SSO and enterprise authentication in Cursor. Triggers on "cursor sso", "cursor saml", "cursor oauth", "enterprise cursor auth", "cursor okta". Use when working with cursor sso integration functionality. Trigger with phrases like "cursor sso integration", "cursor integration", "cursor".
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.