From 66f47b63e8205e585f5fce36d6c37b1a5ed9d289 Mon Sep 17 00:00:00 2001 From: CRIMX Date: Mon, 31 Aug 2026 19:04:42 +0800 Subject: [PATCH] feat(permissions): add team permission guidance and examples --- contrib/skills/shared/oo/SKILL.md | 17 +++++++++++++++++ .../oo/references/search-and-selection.md | 6 ++++++ 2 files changed, 23 insertions(+) diff --git a/contrib/skills/shared/oo/SKILL.md b/contrib/skills/shared/oo/SKILL.md index 5c95e6d..c9d193f 100644 --- a/contrib/skills/shared/oo/SKILL.md +++ b/contrib/skills/shared/oo/SKILL.md @@ -21,6 +21,23 @@ Read only the reference file needed for the current state. OOMOL ops use provider `oomol_console` with the current credential and team context. +## OOMOL Connection permission mode + +When a request concerns a member, user, or collaborator's ability to use a +Connection in the current OOMOL context, including viewing or listing +permissions, allow, deny, read-only, action allowlists, or access to a named +provider, use `oomol_console` before routing to the provider. The user does not +need to say "team" for this mode to apply. + +This controls which Connector actions a member may run through OOMOL. It does +not change the provider's native account, mailbox, or resource delegation. + +For least-privilege access, list the team Connections, inspect the selected +Connection's permission groups, then create or update a custom group with only +schema-reported read actions. Use exact member IDs, preserve unrelated group +assignments, and do not change the default group unless the user requested a +change for every member. + ## Open Flow mode If the user wants to create, inspect, edit, check, run, publish, or open a diff --git a/contrib/skills/shared/oo/references/search-and-selection.md b/contrib/skills/shared/oo/references/search-and-selection.md index 5c63db0..eb818ee 100644 --- a/contrib/skills/shared/oo/references/search-and-selection.md +++ b/contrib/skills/shared/oo/references/search-and-selection.md @@ -53,6 +53,10 @@ Guidance: name can map onto a different global product. - Avoid meta words such as `oo`, `CLI`, `search`, or `skill` unless the user actually asked about them. +- When a request names a member, user, or collaborator and asks to view, list, + inspect, or change permission to use a connected provider, search for the + OOMOL Connection-permission outcome rather than the provider's native + account-permission outcome. The user does not need to say "team". - For a short multi-step workflow, search only the current unresolved external step, not the whole chain. @@ -64,6 +68,8 @@ Examples: - `find a Google Drive file by name and download it` - `collect Gmail messages from yesterday` - `create a Notion page from prepared content` +- `grant a specified team member read-only actions on the Outlook Connection in OOMOL` +- `list member permissions for Outlook in OOMOL` ## Repair weak first queries