id: auth-touch
name: Authentication / Authorization Touch
tags: [backend, security, code-review, pr-time]
audience: dev
summary: Fires on any change to authentication, token handling, or RBAC. Always requires a second pair of eyes — no auth change ships without human review.
description: |
  Fires on any change to authentication flows (Cognito), token handling
  (JWT), or role-based access control. Always requires human review —
  no developer or AI session ships an auth change without a second pair
  of eyes.

triggered_by:
  - file_change: "**/auth/**"
  - file_change: "**/cognito/**"
  - file_change: "**/rbac/**"
  - file_change: "**/permissions/**"
  - file_change: "**/*.jwt.*"
  - file_change: "**/*-auth.ts"
  - file_change: "**/*-auth.php"
  - event: auth.touched

risk:
  score: 8
  blast_radius: high
  reason: "Auth bugs are silent in development and devastating in production. Bypasses, privilege escalation, and session-fixation all live in this code path."

required_agents:
  - auth-security
  - code-reviewer

required_gates:
  - id: auth_review
    description: "Auth-security agent inspects diff for OWASP top 10 categories, input sanitization, token lifetime, and privilege boundaries"

human_approval_required:
  - always: true