access-matrix – Data & Science skill for AI agents

Access Matrix

What it is: What each role can see and change.

Overview

Works out the smallest useful Access Matrix setup for the business in front of it, then

builds it only when asked. The default output is a short recommendation, not a

spreadsheet. Artifacts - CSV, SQL DDL, JSON Schema, Notion mapping - are produced on

request, from one field list so they cannot drift apart.

Layer: Layer 1: Foundation. Fits: Growth stage. Table code: n/a.

When to Use This Skill

• who can access what matrix
• role permission matrix
• access control spreadsheet
• who sees which data

Also use it when the user says "what each role can see and change", or describes the same process happening in a

spreadsheet, a document or someone inboxes.

Do not use it for: payroll calculation, tax filing, or legal advice. This skill produces

empty templates by default. A requested review may use supplied data transiently; do not imply that the host never processes it.

How It Works

Follow the shared execution contract. The module-specific rules below define only domain fields, decisions, calculations, and safety constraints.

The upstream shared contract is not bundled here; this procedure must remain usable on its own.

Step 1 - Identify intent

Read the request and pick the intent before asking anything.

• "set up" or "build" or "create" -> the user wants artifacts; go to Step 2.
• "our process is ..." or "it is in a sheet" -> the user wants to move an existing process; capture it, then Step 2.
• "is this right" or "review" or "audit" -> the user wants a check, not a build; answer from what they share.
• "how do I ..." -> advice question; answer directly and offer the build only if it helps.

Ask only if this is the highest-value missing fact; otherwise proceed without an opener:

> Q: How many roles exist in the company?

Step 2 - Ask only what is missing

Skip anything the user already answered, in any earlier message. Ask the rest one at a

time, and stop as soon as the remaining answers would not change the output.

• Scope - Which system or data? / How many roles? / Any external people?
• Roles - Who is owner or CEO? / Who is admin? / Who is line manager?
• Rules - View only or edit? / Any confidential areas? / Reviewed how often?
• Current process - How do you track access now? / Spreadsheet or none? / Any known gaps?
• Outcome - What should this produce? / An access list or a review cycle?

Never invent an answer. If the user does not know, record it as unknown and carry on.

Step 3 - Hold the internal context

Hold the answers in this shape. It stays internal - it is not shown to the user unless

they ask, and it never carries a value the user did not give.

module: access-matrix
intent: null            # setup | advice | review | fix | build | convert | export
scale: null             # Starter | Growth | Scale, only if the answer changes it
areas:
  "Scope": null
  "Roles": null
  "Rules": null
  "Current process": null
  "Outcome": null
requested_outputs: []   # csv | sql | json | notion | xlsx - requested formats only
confirmed_facts: []     # only what the user actually said
open_questions: []      # the unanswered ones, in the order worth asking

Step 4 - Recommend the smallest workflow

If an artifact was requested, build it after resolving essential missing facts. Otherwise give a short recommendation and offer the relevant artifact.

Recommended approach: Keep the matrix in the tool the team already reviews in, and treat it as a recurring review rather than a one-time document.

Why this one: Access problems are rarely about storage. They are about nobody re-checking who still needs what, so a review cycle matters more than the matrix itself.

Workflow: Role list → System inventory → Access rows → Quarterly review → Removal

Role columns contain permission scopes, not names. Use explicit no-access/unknown markers and deny by default; executive titles do not imply unrestricted access. In an actual review, compare intended grants with observed system grants and record reviewer, approval, evidence date and next review. Quarterly is a starting cadence; handle joiner/mover/leaver changes promptly.

Step 5 - Build only on request

Once the user asks for it, derive the fields from the confirmed context and emit the

requested artifacts. For machine-readable text, keep prose outside the data; for files,

provide a usable link. Report material validation failures or limitations separately.

**A selected Notion output is rendered by notion-manual-import, so route the

Notion step there.** When the user selects Notion, hand that step to

@notion-manual-import: it holds the CSV, the property

mapping, the import steps and the verification checklist, and it renders the Field

Reference below instead of defining a table of its own. Do not restate the mapping

here and do not improvise the import steps. Manual CSV and mapping outputs need no

connection. For requested workspace changes, follow the shared contract: verify actual

tool access and the target before writing. A user saying "connected" is not tool evidence.

Never ask for a Notion password or token.

For an Excel-compatible CSV, use UTF-8 with a byte order mark so Excel opens the

text correctly. A CSV is not an .xlsx workbook; create .xlsx only when the user

requests a workbook.

A CSV carries no types, so after it, name the columns

that need a number, date or currency format applied.

Module,Module ID,Layer,SME Tier,Owner / CEO,Board,Finance,Tax,HR,IT & Admin,Department Head,Line Manager,Employee,Intern,Client,Confidential
Invoices & Billing,,Layer 8: Operate,Small,Only explicitly approved modules and actions,Read - board pack only,"Read, add, edit - payroll and invoices","Read, add, edit - tax register",Read, add, edit - approved people modules,"Read, add, edit - assets and access",Read - approved departmental invoice summary,"Read, add, edit - own team",Read - own records,Read - onboarding only,Read - own issued invoices,Internal

CREATE TABLE access_matrix (
  module VARCHAR(255),
  module_id SERIAL PRIMARY KEY,
  layer VARCHAR(255),
  sme_tier VARCHAR(100),
  owner_ceo VARCHAR(255),
  board VARCHAR(255),
  finance VARCHAR(255),
  tax VARCHAR(255),
  hr VARCHAR(255),
  it_admin VARCHAR(255),
  department_head VARCHAR(255),
  line_manager VARCHAR(255),
  employee VARCHAR(255),
  intern VARCHAR(255),
  client VARCHAR(255),
  confidential VARCHAR(100),
  created_at TIMESTAMP DEFAULT NOW(),
  updated_at TIMESTAMP DEFAULT NOW()
);

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Access Matrix",
  "type": "object",
  "additionalProperties": false,
  "properties": {
      "Module": { "type": "string" },
      "Module ID": { "type": "integer" },
      "Layer": { "type": "string" },
      "SME Tier": { "type": "string" },
      "Owner / CEO": { "type": "string" },
      "Board": { "type": "string" },
      "Finance": { "type": "string" },
      "Tax": { "type": "string" },
      "HR": { "type": "string" },
      "IT & Admin": { "type": "string" },
      "Department Head": { "type": "string" },
      "Line Manager": { "type": "string" },
      "Employee": { "type": "string" },
      "Intern": { "type": "string" },
      "Client": { "type": "string" },
      "Confidential": { "type": "string" }
  },
  "required": []
}

| CSV column | Notion property | Set after import |
|---|---|---|
| Module | Title | Use as the database title |
| Module ID | Text (preserve source ID) | Keep imported IDs as Text; optionally add a separate Unique ID property |
| Layer | Text | Leave as Text |
| SME Tier | Select (add options after import) | Convert to Select, add options: "Micro", "Small", "Medium", "Large", "Enterprise" |
| Owner / CEO | Text | Leave as Text |
| Board | Text | Leave as Text |
| Finance | Text | Leave as Text |
| Tax | Text | Leave as Text |
| HR | Text | Leave as Text |
| IT & Admin | Text | Leave as Text |
| Department Head | Text | Leave as Text |
| Line Manager | Text | Leave as Text |
| Employee | Text | Leave as Text |
| Intern | Text | Leave as Text |
| Client | Text | Leave as Text |
| Confidential | Select (add options after import) | Convert to Select, add options: "Public", "Internal", "Restricted", "Highly Restricted" |

The rows above are documentation examples only. Emit empty templates unless the user explicitly requests examples. Money stays currency, dates stay date,

and anything pointing at another table stays relation.

The shown schema is illustrative. Derive required fields from confirmed record identity and access-review requirements; SME Tier is not intrinsically required to represent a permission. The SQL uses PostgreSQL SERIAL/NOW(); adapt identity and timestamp syntax to the confirmed engine. A matrix row describes intended permissions, not proof of enforced permissions.

Field Reference

| # | Field |

… (full content is in the download package)