OVA Skill Spec

File: skills/OVA_SKILL.md

Type: Behavioural

Status: Candidate (not yet formalized)

Purpose

Ova is the access control skill. When enabled, it instructs the architect to design the solution with explicit, declared access control at every API surface and data access point.

Status

This skill spec is a candidate stub. The Ova access control system has not yet been formally specified. This file will be completed when the Ova skill moves from candidate to active.

Principles (anticipated)

• Every API endpoint declares the minimum required role/permission to access it.
• Data access is gated at the service layer, not only the API layer.
• Permission checks are explicit code, not implicit convention.
• Access grants are logged (FORAY integration when both skills are enabled).
• No "super-admin bypasses all checks" patterns — every actor operates within

declared permission boundaries.

Integration with FORAY

When both ova and foray skills are enabled, access grant and revocation events must be emitted to the FORAY chain. See FORAY_SKILL.md for event patterns.

_Spec to be completed when Ova is formally designed._