admin
Admin panel - RBAC, config, admin tools. Use when building admin UI.
When & Why to Use This Skill
This Claude skill streamlines the development of secure, robust admin panels by providing a standardized framework for RBAC, configuration management, and administrative tools. It leverages a modern tech stack (Next.js, tRPC, Drizzle) and enforces critical security non-negotiables like audit logging and multi-factor authentication to minimize operational risks and prevent human error in internal platforms.
Use Cases
- Rapidly bootstrapping a production-ready admin UI with integrated Role-Based Access Control (RBAC) and security guardrails.
- Implementing secure super-admin initialization and privilege management for enterprise-grade web applications.
- Designing auditable administrative workflows for sensitive operations involving financial data, access control, or system secrets.
- Automating repetitive administrative tasks while ensuring all actions are logged and verified through step-up authentication.
| name | admin |
|---|---|
| description | Admin panel - RBAC, config, admin tools. Use when building admin UI. |
Admin Guideline
Tech Stack
- Framework: Next.js (with Turbopack)
- API: tRPC
- Database: Neon (Postgres)
- ORM: Drizzle
- Components: Radix UI
- Styling: Tailwind CSS
Non-Negotiables
- Admin bootstrap via INITIAL_SUPERADMIN_EMAIL only (one-time, non-reentrant)
- All privilege grants must be audited (who/when/why)
- Actions affecting money/access/security require step-up verification
- Secrets must never be exposed through admin UI
- Only super_admin can promote to admin or access system config
Context
The admin platform is where operational power lives — and where operational mistakes happen. A well-designed admin reduces human error while giving operators tools to resolve issues quickly.
MFA requirements for admin roles are enforced via account-security.
Driving Questions
- Is bootstrap using INITIAL_SUPERADMIN_EMAIL correctly?
- Can an admin accidentally cause serious damage?
- How would we detect admin access misuse?
- What repetitive admin tasks should be automated?
- Where is audit logging missing?