Existing projects

AuthRight Harness is built for brownfield IAM: mixed IdPs, legacy sessions, partial OIDC, framework security that grew over years. You do not document the entire identity estate before the first useful change.

Start with scan, not a blank encyclopedia

cd your-existing-app
authright init
authright scan

Omit --tools to pick the agent you are in, or pass --tools cursor (or claude / codex). Installation.

scan writes heuristic signals into .authright/context.yaml. Sparse repos get sparse context—that is expected. The first Auth Change locks decisions from that intent and from scan observations. A later change appends, or explicitly supersedes a prior decision through conflict clarification. Do not maintain constitution.yaml as iron law; init writes an empty stub that is not enforced.

Scan and pack-idiomatic landing work best on Java and Node.js / TypeScript today. Python and Go are supported and being strengthened; more languages and stacks will follow. Hybrid repos (for example a Vite frontend next to a Maven or Go backend) get a surface per build root. Concepts.

One change at a time

Pick a concrete identity problem (SSO for one app surface, token audience fix, logout consistency). The host writes .authright/brief/brief.yaml (bounded aperture, one accepted slice) before Decide. Then create an Auth Change for that slice:

authright explore -- "Add Entra OIDC for the admin console"
# or: authright change -- "…" for auto-plan
authright change AUTH-YYYY-NNNN --analyze

Keep the contract scoped. Export one OpenSpec package. Implement. Review. Then take the next slice.

What “good enough” context looks like

• Named IdPs / protocols you actually touch
• Where sessions/tokens are established today
• Still-valid accepted decisions from earlier changes (append, or supersede one lock explicitly)
• Explicit non-goals for this change

Avoid boiling the ocean: full protocol matrices, every microservice, or Knowledge Graph dumps are not required for a first useful scan.

Team adoption

• Commit .authright/ so decisions travel with the repo, including .authright/knowledge/ and .authright/AGENTS.md
• Do not commit .authright/logs/ — init (and the first later command) writes .authright/logs/.gitignore so run JSONL stays local
• Prefer CLI for id allocation and export so humans share the same AUTH-YYYY-NNNN
• Use Reviewing decisions before to-openspec or to-plan so implementation doesn't invent auth policy in code review

Related

• Workflows
• Examples
• Overview