Claims
Grant, revoke, and verify scoped claims so spawned agents cannot exceed read/write/spawn/network permissions you intend.
Overview
claims is an agent skill for the Ship phase that grants, revokes, and verifies scoped permissions for multi-agent claude-flow operations.
Install
npx skills add https://github.com/ruvnet/ruflo --skill claimsWhat is this skill?
- Seven claim types: read, write, execute, spawn, memory, network, admin
- Scoped patterns: *, /src/**, /config/*.toml, memory:patterns
- CLI via npx claude-flow claims check, grant, revoke, list
- Preset security levels: minimal, standard, elevated, admin
- Explicit skip guidance when open access or single-agent local work suffices
- 7 claim types documented in SKILL.md table
- 4 security levels: minimal, standard, elevated, admin
Adoption & trust: 639 installs on skills.sh; 58.5k GitHub stars; 2/3 security scanners passed (skills.sh audits).
What problem does it solve?
Spawned agents inherit broad capabilities and you cannot prove which agent may write, execute, or touch network resources.
Who is it for?
Indie teams running multiple claude-flow agents against the same repo or memory namespaces.
Skip if: Open-access experiments or purely local single-agent work with no security requirements—SKIP per SKILL.md.
When should I use this skill?
Permission management, access control, secure operations, or authorization checks for multi-agent work.
What do I get? / Deliverables
Each agent carries explicit claims and scopes verifiable with claude-flow claims check before sensitive work proceeds.
- Verified claim check output per agent
- Updated grant/revoke state for target agents
- Documented security level assignment
Recommended Skills
Journey fit
Spans multiple journey phases - primary shelf plus alternate fits below.
Authorization hardening belongs in ship security before agents touch production repos or shared memory. security subphase is the canonical shelf for access-control skills that gate agent operations.
Where it fits
Grant write only under /src/** before a swarm refactors shared libraries.
Set elevated spawn+memory for coordinator agents while keeping network denied.
List and revoke stale admin claims after an incident review.
How it compares
In-agent authorization layer via CLI claims, not a full IAM product or OAuth server.
Common Questions / FAQ
Who is claims for?
Builders orchestrating several agents who need read/write/spawn/network gates aligned to paths and memory namespaces.
When should I use claims?
Use in ship security before production agent runs, in build when wiring agent-tooling permissions, and in operate when auditing elevated agents.
Is claims safe to install?
It manages permission metadata via claude-flow CLI; review the Security Audits panel on this page and treat admin claims as highly sensitive.
SKILL.md
READMESKILL.md - Claims
# Claims Authorization Skill ## Purpose Claims-based authorization for secure agent operations and access control. ## Claim Types | Claim | Description | |-------|-------------| | `read` | Read file access | | `write` | Write file access | | `execute` | Command execution | | `spawn` | Agent spawning | | `memory` | Memory access | | `network` | Network access | | `admin` | Administrative operations | ## Commands ### Check Claim ```bash npx claude-flow claims check --agent agent-123 --claim write ``` ### Grant Claim ```bash npx claude-flow claims grant --agent agent-123 --claim write --scope "/src/**" ``` ### Revoke Claim ```bash npx claude-flow claims revoke --agent agent-123 --claim write ``` ### List Claims ```bash npx claude-flow claims list --agent agent-123 ``` ## Scope Patterns | Pattern | Description | |---------|-------------| | `*` | All resources | | `/src/**` | All files in src | | `/config/*.toml` | TOML files in config | | `memory:patterns` | Patterns namespace | ## Security Levels | Level | Claims | |-------|--------| | `minimal` | read only | | `standard` | read, write, execute | | `elevated` | + spawn, memory | | `admin` | all claims | ## Best Practices 1. Follow principle of least privilege 2. Scope claims to specific resources 3. Audit claim usage regularly 4. Revoke claims when no longer needed