---
phase: permissions
kind: level
level: review
---

# Phase 3: REVIEW — validate the module matrix

> Follow this file when the decision table in `SKILL.md` routes here. The action
> vocabulary, scopes and authority rules live in `SKILL.md`.

## Goal

Validate the complete RBAC matrix for module M. Catch gaps, over-privilege and
segregation-of-duties slips before handing off to the data model.

## Completeness checklist — verify before marking M complete

- [ ] The module has at least one actor with `access` + `read`.
- [ ] Every section with use cases has lines matching its UC primary actors.
- [ ] No section is unreachable (zero actors with `access`).
- [ ] Every UC primary actor has actions matching its main-flow verbs for that
      section.
- [ ] No `external` actor has `delete` or `execute` (challenge the user if found).
- [ ] No segregation-of-duties violation: the same actor must NOT hold both
      `create` and `approve` on the same target.
- [ ] Every `custom` scope cell carries a concrete filter clause.
- [ ] Action hierarchy holds: no `read` without `access`, no `create`/`update`/
      `delete`/… without `access` + `read` (`lookup` alone is legal — machine-derived).
- [ ] The derived-lookups block is fresh: `derive-lookup-grants` in
      `"mode":"check"` reports no drift (deep check = RBAC-008).

## Present the matrix for validation

Summarize the module matrix in prose, grouped by actor (targets + actions +
scope, compact). Then ask the user to validate via **AskUserQuestion** with
closed choices, e.g.:

- *Matrix is correct — proceed*
- *Add / remove actions for a specific actor + target*
- *Change the scope for a specific actor + target*
- *Other adjustment* (describe in prose)

## Detect and fix gaps

If the checklist flags an issue, report it in prose before validating:

- **Unreachable section**: "Section `dashboard` has no actor with `access`. Grant
  `access` + `read` to the manager actor?"
- **Over-privilege**: "The external candidate actor has `delete` on the portal.
  External actors should not delete — remove it?"
- **SoD violation**: "The commercial actor holds both `create` and `approve` on
  `opportunites`. Split approval to the manager actor?"

When the user confirms a fix, re-Write `rbac.md` with the corrected lines
(re-list every line that must survive).

## After review → hand off

Once the matrix is validated (or corrected), run the **light self-check** in
`SKILL.md` (vocabulary, hierarchy, actor existence, SoD), surface any residual
gap, then hand off to the data model (`/ba-create-data-model`). The **deep
audit** (RBAC-001..010) is `/ba-audit-rbac`, which reads the tree and writes its
own verdict — do not produce audit findings here.

Refresh the App-level `rbac.md` rollup pointer to include this module, and leave
section/resource `rbac.md` as inheritance pointers unless a genuine refinement
exists.