Examples

Short recipes using design product commands. Assume Installation is done.

Recipe: OIDC adapter decision (auto-plan)

authright init
authright scan
authright change -- "Integrate OIDC via adapter for the BFF"
authright change AUTH-YYYY-NNNN --plan

Review resolved/unresolved together. Override with --set as needed, then:

  1. authright change AUTH-YYYY-NNNN --confirm-plan
  2. Fill contract.md if still thin.
  3. Handoff and verify:
authright change AUTH-YYYY-NNNN --ready
authright request-match AUTH-YYYY-NNNN
authright to-openspec AUTH-YYYY-NNNN
# … openspec apply / agent implementation …
authright review AUTH-YYYY-NNNN

In chat, pick /auth-explore or /auth-change (Claude Code uses colon forms; Codex uses $authright-*), then /auth-request-match, then pick /auth-to-openspec or Plan mode + /auth-to-plan, then /auth-review. Scan first with /auth-scan when you want a full picture.

Recipe: Greenfield HITL Decide (explore)

(in chat)  /auth:explore
           (Brief + slice accept via native HITL when unbounded; recommended is **not** a default)
           (after accepted: same session starts Decide — Agenda next,
            summary; --ready → request-match → confirm before to-openspec or to-plan)

Explore allocates an Auth Change only after a Brief slice is accepted_for_lock. Cancelled-empty slice-accept does not start Decide.

Recipe: Greenfield auto-plan (change)

(in chat)  /auth:change
           (Brief + slice accept; analyze → auto-plan of all resolved + unresolved)
           (NL → --set → --confirm-plan → --ready → request-match → export)

Recipe: Doctor then Decide

(in chat)  /auth:doctor
           → open .authright/diagnosis/report.md
(in chat)  pick /auth:explore or /auth:change to design the fix
           /auth:explore "Fix logout not clearing IdP session"

Recipe: Codex

$authright-scan
$authright-explore
$authright-change
$authright-request-match
$authright-to-openspec
$authright-review
$authright-doctor

Existing projects

AuthRight Harness is built for brownfield IAM: mixed IdPs, legacy sessions, partial OIDC, framework security that grew over years. You do not document the entire identity estate before the first useful change.

Reviewing decisions

Before to-openspec, treat the Auth Change as a plan you are willing to lock. After implementation, authright review checks for silent inversions.

On this page

Recipe: OIDC adapter decision (auto-plan)Recipe: Greenfield HITL Decide (explore)Recipe: Greenfield auto-plan (change)Recipe: Doctor then DecideRecipe: CodexRelated