Abp Authorization
abpframework/abp
ABP permission system - PermissionDefinitionProvider, [Authorize] attribute, CheckPolicyAsync, IsGrantedAsync, ICurrentUser, IPermissionManager, multi-tenancy side.
Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin.
$ npx skills add ever-works/ever-works --skill organization-best-practices -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install ever-works/ever-works organization-best-practices --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/ever-works/ever-works.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/organization-best-practices .claude/skills/organization-best-practices && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "organization-best-practices" agent skill from https://github.com/ever-works/ever-works/tree/develop/.agents/skills/organization-best-practices into .claude/skills/organization-best-practices/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "organization-best-practices", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/ever-works/ever-works/tree/develop/.agents/skills/organization-best-practicesType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add ever-works/ever-works --skill organization-best-practices -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install ever-works/ever-works organization-best-practices --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ever-works/ever-works.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/organization-best-practices .agents/skills/organization-best-practices && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "organization-best-practices" agent skill from https://github.com/ever-works/ever-works/tree/develop/.agents/skills/organization-best-practices into .agents/skills/organization-best-practices/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "organization-best-practices", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ever-works/ever-works --skill organization-best-practices -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install ever-works/ever-works organization-best-practices --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ever-works/ever-works.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/organization-best-practices .cursor/skills/organization-best-practices && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "organization-best-practices" agent skill from https://github.com/ever-works/ever-works/tree/develop/.agents/skills/organization-best-practices into .cursor/skills/organization-best-practices/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "organization-best-practices", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/ever-works/ever-works.git --path .agents/skills/organization-best-practices--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add ever-works/ever-works --skill organization-best-practices -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install ever-works/ever-works organization-best-practices --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ever-works/ever-works.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/organization-best-practices .gemini/skills/organization-best-practices && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "organization-best-practices" agent skill from https://github.com/ever-works/ever-works/tree/develop/.agents/skills/organization-best-practices into .gemini/skills/organization-best-practices/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "organization-best-practices", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install ever-works/ever-works organization-best-practicesInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add ever-works/ever-works --skill organization-best-practices -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/ever-works/ever-works.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/organization-best-practices .github/skills/organization-best-practices && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "organization-best-practices" agent skill from https://github.com/ever-works/ever-works/tree/develop/.agents/skills/organization-best-practices into .github/skills/organization-best-practices/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "organization-best-practices", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ever-works/ever-works --skill organization-best-practices -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install ever-works/ever-works organization-best-practices --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ever-works/ever-works.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/organization-best-practices .opencode/skills/organization-best-practices && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "organization-best-practices" agent skill from https://github.com/ever-works/ever-works/tree/develop/.agents/skills/organization-best-practices into .opencode/skills/organization-best-practices/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "organization-best-practices", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
organization-best-practicesConfigure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin.
Organization Best Practices is an agent skill from ever-works/ever-works. Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin.
Its SKILL.md is about 2.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Authorization and RBAC and Multi-tenancy. It works with Better Auth. The repository describes itself as: Ever® Works™ - The Workshop for AI. An open agentic runtime that autonomously researches, ships, and maintains entire businesses, 24/7 - https://ever.works. The licence is AGPL-3.0.
4 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 330f7b9. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
npxFrom the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md. Its commands use npx, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Organization Best Practices loads about 2.6k tokens when it runs. Until then it costs about 82 tokens; SKILL.md has 400 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from ever-works/ever-works at commit 330f7b9, republished under its AGPL-3.0 licence (© ever-works). 400 words, ~2,609 tokens.
.claude/skills/organization-best-practices/SKILL.md (or your agent's skills folder).organization() plugin to server configorganizationClient() plugin to client confignpx @better-auth/cli migrateimport { betterAuth } from 'better-auth';
import { organization } from 'better-auth/plugins';
export const auth = betterAuth({
plugins: [
organization({
allowUserToCreateOrganization: true,
organizationLimit: 5, // Max orgs per user
membershipLimit: 100 // Max members per org
})
]
});import { createAuthClient } from 'better-auth/client';
import { organizationClient } from 'better-auth/client/plugins';
export const authClient = createAuthClient({
plugins: [organizationClient()]
});The creator is automatically assigned the owner role.
const createOrg = async () => {
const { data, error } = await authClient.organization.create({
name: 'My Company',
slug: 'my-company',
logo: 'https://example.com/logo.png',
metadata: { plan: 'pro' }
});
};Restrict who can create organizations based on user attributes:
organization({
allowUserToCreateOrganization: async (user) => {
return user.emailVerified === true;
},
organizationLimit: async (user) => {
// Premium users get more organizations
return user.plan === 'premium' ? 20 : 3;
}
});Administrators can create organizations for other users (server-side only):
await auth.api.createOrganization({
body: {
name: 'Client Organization',
slug: 'client-org',
userId: 'user-id-who-will-be-owner' // `userId` is required
}
});Note: The userId parameter cannot be used alongside session headers.
Stored in the session and scopes subsequent API calls. Set after user selects one.
const setActive = async (organizationId: string) => {
const { data, error } = await authClient.organization.setActive({
organizationId
});
};Many endpoints use the active organization when organizationId is not provided (listMembers, listInvitations, inviteMember, etc.).
Use getFullOrganization() to retrieve the active org with all members, invitations, and teams.
await auth.api.addMember({
body: {
userId: 'user-id',
role: 'member',
organizationId: 'org-id'
}
});For client-side member additions, use the invitation system instead.
await auth.api.addMember({
body: {
userId: 'user-id',
role: ['admin', 'moderator'],
organizationId: 'org-id'
}
});Use removeMember({ memberIdOrEmail }). The last owner cannot be removed — assign ownership to another member first.
Use updateMemberRole({ memberId, role }).
organization({
membershipLimit: async (user, organization) => {
if (organization.metadata?.plan === 'enterprise') {
return 1000;
}
return 50;
}
});import { betterAuth } from 'better-auth';
import { organization } from 'better-auth/plugins';
import { sendEmail } from './email';
export const auth = betterAuth({
plugins: [
organization({
sendInvitationEmail: async (data) => {
const { email, organization, inviter, invitation } = data;
await sendEmail({
to: email,
subject: `Join ${organization.name}`,
html: `
<p>${inviter.user.name} invited you to join ${organization.name}</p>
<a href="https://yourapp.com/accept-invite?id=${invitation.id}">
Accept Invitation
</a>
`
});
}
})
]
});await authClient.organization.inviteMember({
email: 'newuser@example.com',
role: 'member'
});const { data } = await authClient.organization.getInvitationURL({
email: 'newuser@example.com',
role: 'member',
callbackURL: 'https://yourapp.com/dashboard'
});
// Share data.url via any channelThis endpoint does not call sendInvitationEmail — handle delivery yourself.
organization({
invitationExpiresIn: 60 * 60 * 24 * 7, // 7 days (default: 48 hours)
invitationLimit: 100, // Max pending invitations per org
cancelPendingInvitationsOnReInvite: true // Cancel old invites when re-inviting
});Default roles: owner (full access), admin (manage members/invitations/settings), member (basic access).
const { data } = await authClient.organization.hasPermission({
permission: 'member:write'
});
if (data?.hasPermission) {
// User can manage members
}Use checkRolePermission({ role, permissions }) for client-side UI rendering (static only). For dynamic access control, use the hasPermission endpoint.
import { organization } from 'better-auth/plugins';
export const auth = betterAuth({
plugins: [
organization({
teams: {
enabled: true
}
})
]
});const { data } = await authClient.organization.createTeam({
name: 'Engineering'
});Use addTeamMember({ teamId, userId }) (member must be in org first) and removeTeamMember({ teamId, userId }) (stays in org).
Set active team with setActiveTeam({ teamId }).
organization({
teams: {
maximumTeams: 20, // Max teams per org
maximumMembersPerTeam: 50, // Max members per team
allowRemovingAllTeams: false // Prevent removing last team
}
});import { organization } from 'better-auth/plugins';
import { dynamicAccessControl } from '@better-auth/organization/addons';
export const auth = betterAuth({
plugins: [
organization({
dynamicAccessControl: {
enabled: true
}
})
]
});await authClient.organization.createRole({
role: 'moderator',
permission: {
member: ['read'],
invitation: ['read']
}
});Use updateRole({ roleId, permission }) and deleteRole({ roleId }). Pre-defined roles (owner, admin, member) cannot be deleted. Roles assigned to members cannot be deleted until reassigned.
Execute custom logic at various points in the organization lifecycle:
organization({
hooks: {
organization: {
beforeCreate: async ({ data, user }) => {
// Validate or modify data before creation
return {
data: {
...data,
metadata: { ...data.metadata, createdBy: user.id }
}
};
},
afterCreate: async ({ organization, member }) => {
// Post-creation logic (e.g., send welcome email, create default resources)
await createDefaultResources(organization.id);
},
beforeDelete: async ({ organization }) => {
// Cleanup before deletion
await archiveOrganizationData(organization.id);
}
},
member: {
afterCreate: async ({ member, organization }) => {
await notifyAdmins(organization.id, `New member joined`);
}
},
invitation: {
afterCreate: async ({ invitation, organization, inviter }) => {
await logInvitation(invitation);
}
}
}
});Customize table names, field names, and add additional fields:
organization({
schema: {
organization: {
modelName: 'workspace', // Rename table
fields: {
name: 'workspaceName' // Rename fields
},
additionalFields: {
billingId: {
type: 'string',
required: false
}
}
},
member: {
additionalFields: {
department: {
type: 'string',
required: false
},
title: {
type: 'string',
required: false
}
}
}
}
});Always ensure ownership transfer before removing the current owner:
// Transfer ownership first
await authClient.organization.updateMemberRole({
memberId: 'new-owner-member-id',
role: 'owner'
});
// Then the previous owner can be demoted or removedDeleting an organization removes all associated data (members, invitations, teams). Prevent accidental deletion:
organization({
disableOrganizationDeletion: true // Disable via config
});Or implement soft delete via hooks:
organization({
hooks: {
organization: {
beforeDelete: async ({ organization }) => {
// Archive instead of delete
await archiveOrganization(organization.id);
throw new Error('Organization archived, not deleted');
}
}
}
});import { betterAuth } from 'better-auth';
import { organization } from 'better-auth/plugins';
import { sendEmail } from './email';
export const auth = betterAuth({
plugins: [
organization({
// Organization limits
allowUserToCreateOrganization: true,
organizationLimit: 10,
membershipLimit: 100,
creatorRole: 'owner',
// Slugs
defaultOrganizationIdField: 'slug',
// Invitations
invitationExpiresIn: 60 * 60 * 24 * 7, // 7 days
invitationLimit: 50,
sendInvitationEmail: async (data) => {
await sendEmail({
to: data.email,
subject: `Join ${data.organization.name}`,
html: `<a href="https://app.com/invite/${data.invitation.id}">Accept</a>`
});
},
// Hooks
hooks: {
organization: {
afterCreate: async ({ organization }) => {
console.log(`Organization ${organization.name} created`);
}
}
}
})
]
});© ever-works, AGPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in .agents/skills/organization-best-practices of ever-works/ever-works.
Open the folder on GitHubat commit 330f7b9
We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in ever-works/ever-works, which our catalogue first saw on October 7, 2026.
Organization Best Practices next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Organization Best Practices this skillever-works/ever-works | 162 | 2 repos | ~2.6k | Automated safety check: Pass | AGPL-3.0 | |
| Abp Authorizationabpframework/abp | 14k | — | ~1.3k | Automated safety check: Pass | LGPL-3.0 | |
| Django Access Reviewgetsentry/skills | 1k | 3 repos | ~2.6k | Automated safety check: Notes | Apache-2.0 | |
| Supercheck Security Authsupercheck-io/supercheck | 215 | — | ~1.2k | Automated safety check: Pass | AGPL-3.0 | |
| Backend AI Guidelablup/backend.ai-webui | 133 | 1 repos | ~1.8k | Automated safety check: Pass | LGPL-3.0 | |
| Arandu Shared Modules Guidearandu-io/arandu | 281 | — | ~1.8k | Automated safety check: Pass | MIT |
abpframework/abp
ABP permission system - PermissionDefinitionProvider, [Authorize] attribute, CheckPolicyAsync, IsGrantedAsync, ICurrentUser, IPermissionManager, multi-tenancy side.
getsentry/skills
Django access control and IDOR security review. An agent skill from getsentry/skills.
supercheck-io/supercheck
Work on Supercheck authentication, RBAC, tenant isolation, sessions, API and trigger keys, invitations, project membership, project variables, OAuth, super-admin behavior, SSRF, or…
lablup/backend.ai-webui
Expert guide for Backend.AI distributed computing platform. An agent skill from lablup/backend.ai-webui.
arandu-io/arandu
Decides whether a feature belongs in the application or in one of five shared Arandu modules before adding permissions, wallets, tags, Markdown rendering or API docs.
topoteretes/cognee
A skill your agent uses when working with cognee's users, permissions, and multi-tenancy — creating users, tenants and roles, sharing datasets (read/write/delete/share grants), acting as a specific…
ever-works/ever-works
Build production-ready Node.js backend services with Express/Fastify, implementing middleware patterns, error handling, authentication, database integration, and API design best practices.
ever-works/ever-works
Audit and improve web accessibility following WCAG 2.2 guidelines.
ever-works/ever-works
Provides comprehensive Tailwind CSS utility-first styling patterns including responsive design, layout utilities, flexbox, grid, spacing, typography, colors, and modern CSS best practices.
ever-works/ever-works
Optimize for search engine visibility and ranking. An agent skill from ever-works/ever-works.
ever-works/ever-works
Build production-ready Express.js servers with middleware, authentication, routing, and database integration.
ever-works/ever-works
Production-tested setup for Tailwind CSS v4 with shadcn/ui, Vite, and React.
Works with
Categories
Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Organization Best Practices is an agent skill from ever-works/ever-works. Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin.
Organization Best Practices fits situations like: users need org setup; team management; the Better Auth organization plugin.
Run `npx skills add ever-works/ever-works --skill organization-best-practices -a claude-code`. Or copy the skill folder (.agents/skills/organization-best-practices in ever-works/ever-works) into .claude/skills/organization-best-practices in your project. Claude Code loads it when a task matches its description.
Run `npx skills add ever-works/ever-works --skill organization-best-practices -a codex`. Or copy the skill folder (.agents/skills/organization-best-practices in ever-works/ever-works) into .agents/skills/organization-best-practices in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ever-works/ever-works --skill organization-best-practices -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/organization-best-practices, .gemini/skills/organization-best-practices, .github/skills/organization-best-practices and .opencode/skills/organization-best-practices in your project.
Going by SKILL.md and its folder, Organization Best Practices needs the command-line tools its instructions call (npx). Our summary lists: Node.js.
SKILL.md contains no URLs. Its commands use npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Organization Best Practices is published under the AGPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.6k tokens (SKILL.md is roughly 10k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Organization Best Practices: Abp Authorization (abpframework/abp, 14k stars), Django Access Review (getsentry/skills, 1k stars), Supercheck Security Auth (supercheck-io/supercheck, 215 stars) and Backend AI Guide (lablup/backend.ai-webui, 133 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
ever-works (a GitHub organization) maintains it in ever-works/ever-works, which has 162 GitHub stars. The repository holds 14 skills in this directory. The repository was last updated on October 10, 2026.
Source: ever-works/ever-works on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.