---
name: ba-audit-rbac
description: >
  Audits the RBAC permission matrix of a `.smartstack/ba/` module — minimum
  permissions, segregation of duties, actor coverage and reference integrity
  (RBAC-001..005). Reads the module `rbac.md`, the app `acteur.md` and the
  section `use-case.md`, writes a verdict to `_audit/rbac.md`. Run after
  `/ba-create-rbac` or as part of pre-dev readiness.
allowed-tools: [Read, Write, Glob, Grep]
---

# ba-audit-rbac — RBAC permissions audit

You audit the RBAC permission matrix of a `.smartstack/ba/` module against the
rules below and write a verdict file. The rules are unchanged from the SmartStack
convention; only the I/O is file-based.

## File model — how to audit

1. **Read state**: `Glob .smartstack/ba/**/index.md` to rebuild the tree, then
   read the module's `rbac.md` (the permission matrix — actor ×
   `module.section[.resource].action` × scope), the parent app's `acteur.md` (the
   authoritative actor list, codes `BA-…-AC-…`), and each section's `use-case.md`
   under the module (the actions the use cases imply, for coverage). Permissions
   are `module.section[.resource].action` within the module (3 segments for a
   section, 4 for a resource); the app prefix is added downstream, not here.
2. **Apply** the rules RBAC-001..005 (below) to every permission in the module.
3. **Write** the verdict to `_audit/rbac.md` under the audited module:
   `.smartstack/ba/<APP>/<MODULE>/_audit/rbac.md` (use the audit-verdict skeleton
   from `_workflow/doc-templates.md`). Then print a 3–6 line business summary in chat.

There is no database, no `[ACTION]` envelope, no i18n label codes — the `.md`
verdict IS the record. The verdict header (`0 err` = pass) is what a downstream
gate reads.

## Scope

- **Module scope** (default): audit one module — apply RBAC-001..005 to its
  matrix. RBAC-004 only checks actors that have at least one permission entry in
  this application's modules; do NOT flag actors from other applications as
  missing permissions in this module.
- The verdict file lives at the audited module's `_audit/rbac.md`.

## Rules

### RBAC-001 — At least 1 permission exists per module
- **Severity**: err (if 0), ok (if >= 1)
- **ok**: the module's matrix has at least one permission entry (state the count).
- **err**: the module has zero permissions — name the module.
- Fix: `/ba-create-rbac`.

### RBAC-002 — Every section has minimum permissions (access + read) for at least 1 actor
- **Severity**: err (if missing), ok (if all have)
- Check: for each section, at least 1 actor must have both `access` and `read` actions.
- **err**: list the sections lacking the minimum (access + read) for any actor.
- Fix: `/ba-create-rbac`.

### RBAC-003 — No segregation of duties violations
- **Severity**: warn (if found), ok (if none)
- **Toxic pairs** (same actor, same target must NOT have both):
  - `create` + `approve` (creator should not approve their own work)
  - `delete` + `restore` (prevents abuse)
- **warn**: list the offending actor × target × pair violations.
- Fix: `/ba-create-rbac`.

### RBAC-004 — All defined actors have at least 1 permission in the module
- **Severity**: warn (if orphan actors), ok (if all have)
- **warn**: list the actors (of this application) with no permission entry in the module.
- Fix: `/ba-create-rbac`.

### RBAC-005 — All permission actor references point to existing actors
- **Severity**: err (if unknown actor IDs), ok (if all valid)
- Check: every `BA-…-AC-…` referenced in the matrix is authored in the app's `acteur.md`.
- **err**: list the unknown actor IDs.
- Fix: `/ba-create-rbac`.

## Output

Write `_audit/rbac.md` per the doc-templates skeleton:
- Header `# Audit rbac — <APP> / <MODULE>` + `_<date> · Verdict : <emoji> N warn · M err · K ok_`.
- `## ✅ Conforme`, `## ⚠️ Avertissements`, `## ❌ Bloquants` sections; one bullet
  per finding. For `warn`/`err`: what's wrong (offending actor/permission/section
  codes **bold**), why it matters, and a `→` fix naming `/ba-create-rbac`. Include
  the concrete offending permission/actor/section names so the fix is actionable.
- Re-Write the whole file each run (overwrite — it's a fresh verdict).

Then a 3–6 line chat summary in the user's language — business terms, not rule
codes. If any `err`, state clearly that the permissions must be fixed before moving on.

## Used by the readiness orchestrator

`/ba-audit-pre-dev` runs every dimension and aggregates the verdicts. When invoked
by it, still write `_audit/rbac.md` as usual — the orchestrator reads these files.
