# What Is the Three-Axis Routing Matrix in Reverse-Skill?

> Understand the three-axis routing matrix in Reverse-Skill. Discover how this 3D access control system coordinates Skill, Role, and Case axes for efficient request routing. Learn more now.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-01

---

**The three-axis routing matrix is a three-dimensional access control system defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) that coordinates Skill, Role, and Case axes to route requests to the correct skill module in the Reverse-Skill framework.**

The `zhaoxuya520/reverse-skill` repository implements a sophisticated request dispatching mechanism through its **three-axis routing matrix**. This matrix, documented in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), ensures that every incoming request is validated against three independent dimensions before execution. By cross-referencing the functional skill area, user permissions, and specific investigation context, the framework maintains strict isolation between different security research operations.

## The Three Axes Explained

### Skill Axis

The **Skill** axis identifies the functional area of the request, such as *reverse-engineering*, *pwn-chain*, or *api-security*. According to the source code, this value is extracted from the `skill` identifier supplied in the request payload and mapped to entry points via [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md).

### Role Axis

The **Role** axis defines the operator's permission set (e.g., *analyst*, *pentester*, or *researcher*). The framework derives this from the user's profile defined in [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md), which explicitly lists which skills each role may execute.

### Case Axis

The **Case** axis represents the concrete investigation or engagement, corresponding to a specific `work/<case>/scope.md` folder. Determined from the `case-id` field, this axis ensures skills operate only within authorized investigation boundaries after validation by `skills/scripts/case-init.ps1`.

## Routing Execution Flow

The matrix operates through a four-stage pipeline that validates each axis before dispatch:

1. **Master Routing Lookup** – [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) provides the first-level mapping from skill names to entry point scripts.
2. **Case Initialization** – `skills/scripts/case-init.ps1` validates the case exists and loads its [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), authorizing the investigation context.
3. **Role Mapping** – The system checks [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) to confirm the user's role permits the requested skill.
4. **Final Dispatch** – Using the validated coordinates (Skill × Role × Case), the router selects the exact **SKILL.md** implementation to execute.

## Implementation Examples

Below are minimal code snippets illustrating how the three-axis routing matrix is consulted at runtime.

**PowerShell implementation:**

```powershell

# Load the master routing table

$master = Import-PowerShellDataFile "skills/MASTER-ROUTING.md"

# Resolve the skill entry point

$skillPath = $master[$request.skill]

# Initialise the case (auth check)

& "skills/scripts/case-init.ps1" -CaseId $request.caseId

# Verify role permissions

$roleMap = Import-PowerShellDataFile "skills/ops/role-map.md"
if (-not $roleMap[$request.role].Contains($request.skill)) {
    throw "Role not permitted for this skill"
}

# Dispatch to the concrete skill implementation

& $skillPath -Input $request.payload

```

**Python equivalent:**

```python
import yaml, json, os

# Load routing data

master = yaml.safe_load(open("skills/MASTER-ROUTING.md"))
skill_path = master[request["skill"]]

# Validate case context

assert os.path.isdir(f"work/{request['case_id']}")

# Check role permissions

role_map = yaml.safe_load(open("skills/ops/role-map.md"))
assert request["skill"] in role_map[request["role"]]

# Execute skill

os.system(f"powershell -File {skill_path} -Input '{json.dumps(request)}'")

```

## Benefits of the Three-Axis Design

The three-axis routing matrix guarantees three critical operational properties:

- **Isolation** – A skill can only execute against cases the operator is explicitly authorized to access, preventing cross-contamination between investigations.
- **Extensibility** – Adding new skills, roles, or cases expands the matrix without modifying existing routing logic, supporting plugin-style architecture.
- **Traceability** – Every execution path logs the three coordinates (Skill, Role, Case), enabling comprehensive audit trails and post-mortem analysis.

## Summary

- The **three-axis routing matrix** coordinates Skill, Role, and Case dimensions to control access in the Reverse-Skill framework.
- **Skill** determines the functional module via [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md), **Role** enforces permissions via [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md), and **Case** validates the investigation context through `skills/scripts/case-init.ps1`.
- The routing pipeline executes in four stages: Master Routing lookup, Case initialization, Role validation, and final dispatch to the skill implementation.
- This architecture provides strict isolation between investigations while maintaining extensibility and comprehensive audit logging.

## Frequently Asked Questions

### What file contains the three-axis routing matrix definition?

The matrix is documented in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) within the `zhaoxuya520/reverse-skill` repository. Visual diagrams and reference materials are also available in [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md).

### How does the Role axis restrict access to skills?

The Role axis reads permission mappings from [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md), which defines which skills each role (analyst, pentester, researcher) may execute. The routing system validates the requester's role against this mapping before dispatching to the skill handler.

### Can new skills be added without modifying existing routing code?

Yes. The matrix supports extensibility through [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md). Adding a new skill requires only updating the master routing table, creating the corresponding skill directory, and optionally updating role permissions in [`role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/role-map.md), without touching the core routing logic.

### What happens if a case is not initialized before routing?

The `skills/scripts/case-init.ps1` script validates the `case-id` and loads the corresponding `work/<case>/scope.md` before execution proceeds. If the case does not exist or the operator lacks authorization for that specific investigation, the routing halts before reaching the skill implementation.