AuthRight Harnessv0.3.3

Let AI think through IAM before agents implement it.

See risks in the code you already have—or lock identity architecture and technology choices—then hand coding agents a package they can follow, not a vague prompt.

Get startedSee the scenarios

Real product asks

Vague identity prompts become locked decisions.

You do not need IAM vocabulary first. Describe what the product needs—optionally run /auth:doctor on the current code—then Decide so agents inherit a design, not a wish list.

  1. Copy a product
    “Look at that well-known product we use every day—copy the same login, orgs, invites, roles, and SSO. Make ours feel the same.”

    Jump to code

    Agents mirror screens and start coding. What’s a must-have vs nice-to-have, how orgs and roles really work, and what “same” means stay fuzzy.

    With AuthRight Harness

    The reference becomes a checklist of decisions—accounts, tenants, invites, roles, SSO—not a UI to paste. You lock the model before anyone builds.

  2. Add enterprise SSO
    “We already ship email/password. Big customers want company SSO. Keep self-serve signup for everyone else—don’t break existing users.”

    Jump to code

    SSO gets bolted onto the same login path. Account linking, which users must use SSO, and who owns the org stay undecided until production breaks.

    With AuthRight Harness

    Password vs SSO paths, join rules, and tenant policy are decided first. Existing accounts stay usable while enterprise can turn SSO on.

  3. Swap the IdP
    “We’re on Keycloak today. Leadership wants OpenAM instead—same login, SSO, and roles for users. Don’t break the apps that already trust us.”

    Jump to code

    Agents rip out the old SDK and paste a new one. Token shape, logout, brokered IdPs, and what “same roles” means stay undefined until cutover fails.

    With AuthRight Harness

    The swap becomes a decided migration: what must stay equivalent, what can change, protocols and session rules, and a technology choice you can defend—then agents implement against that lock.

  4. Diagnose the code
    “Before we redesign anything—what’s actually open in this repo? Which APIs skip login? Where can someone reach data they shouldn’t?”

    Jump to code

    A chat skim of a few files. No shared report, weak file pointers, and the team argues from memory instead of evidence.

    With AuthRight Harness

    /auth:doctor reads the app source and writes .authright/diagnosis/report.md—routes, risks, and next steps you can open and share. Decide comes after you know what’s broken.

  5. IAM as source of truth
    “Here’s what the product must do for login, orgs, and permissions. Make that the source of truth—not a slide deck, not a thread that goes stale.”

    Jump to code

    Requirements live in docs and chat. Agents invent auth as they go. Six months later nobody knows which rules are still real.

    With AuthRight Harness

    Your ask becomes a locked IAM source of truth (IAM SoT)—accepted decisions, contracts, and a package agents must follow. Later changes append or supersede; they don’t silently rewrite the model.

How it works

Diagnose or decide—always before agents build.

Check risks in code you already have, or lock identity architecture first. Either way, coding agents inherit a decided design—not a vague prompt.

  • Already have code

    Check what’s risky today

    Open APIs, missing login, weak permissions—get a shareable report before you redesign.

    /auth:doctordiagnosis/report.md

  • Need to change identity

    Lock the design first

    Turn the product ask into architecture and tech choices agents must follow.

    /auth:explore · /auth:changeAuth Decision Package

Typical AI path

  1. Requirement
  2. Coding agent
  3. Write auth code
  4. Discover IAM issues
  5. Iterate & fix

Rework loop after code ships

With AuthRight Harness

  1. Requirement
  2. Clarify & analyze
  3. Architecture & tech
  4. Auth Decision Package
  5. Coding agent

Decision before the first auth line

Decide → handoff → verify

One main path. Two forks where you choose.

Scan when you want the full picture. Pick /auth:explore or /auth:change to lock decisions. Pick OpenSpec or Plan mode to hand off. Review after code lands. /auth:doctor is separate—run it anytime, including before Decide. Details live in the commands guide.

  1. /auth:scan

    Understand — scan

    See what identity already exists in the repo. Optional if you already know the need—Decide can scan when context is missing or stale.

    FlowRepo → current identity picture

  2. Pick one — decide

    /auth:explore

    Walk options in chat. Answer shape questions, then lock the plan in the same session.

    FlowQuestions → choices → locked plan

    /auth:change

    Get a full auto-plan, override what you need, confirm, and lock.

    FlowAuto-plan → overrides → locked plan

  3. /auth:request-match

    Request match

    Confirm the locked plan still matches what you asked. Export waits until this check passes.

    FlowLocked plan ↔ original ask

  4. Pick one — handoff

    /auth:to-openspec

    Export to OpenSpec when that tool is installed. Without it, use Plan mode instead.

    FlowPackage → OpenSpec → coding agent

    /auth:to-plan

    Export into your editor’s Plan mode. OpenSpec is not required.

    FlowPackage → Plan mode → coding agent

  5. /auth:review

    Verify — review

    After implementation, check that the code still matches the locked package—not vibes.

    FlowImplemented change → review report

What you get

Artifacts agents can follow—and you can read.

Not another chat transcript. Doctor writes a risk report. Decide produces a verifiable Auth Decision Package—architecture, technology, contracts—for OpenSpec or Plan mode.

Doctor → diagnosis/report.md
# Source risk report
## Open without login
- GET /api/users  → src/routes/users.ts
  Anyone can list accounts

## Weak permissions
- PATCH /api/orgs/:id
  Member can change billing owner

## Next
Use /auth:explore or /auth:change
Decide → Auth Decision Package
# Locked for this change
Identity: org-scoped users
Auth: password + optional SSO
AuthZ: role + resource checks
Tech: keep current stack
Handoff: to-plan or to-openspec
Verify: review against contract
  • Readable — open the markdown; jump to file paths and decisions.
  • Vendor-neutral — evaluate IdPs against your context; none is the default sale.
  • Explainable — major choices stay tied to requirement → evidence → decision.

Ready when you are

Don't let AI code your IAM before it understands your IAM.

Install in the repo, then in chat run /auth:doctor on what you have—or /auth:explore / /auth:change when you’re ready to lock a design for Cursor, Codex, or Claude Code.

Get startedCommands

npm install -g @authright/cli@latest && authright init