Add BCApps citations to Tier 1+2 knowledge files; add 2 new rules

- All 7 existing Tier 1/2 knowledge files now include a BCApps Reference section with concrete source links and observed patterns - New: bcpt-scenarios-must-be-app-specific — PerformanceTest apps must include app-domain BCPT scenarios, not only Microsoft generic samples - New: permission-sets-must-follow-least-privilege — View/Edit/Admin hierarchy with IncludedPermissionSets, mirroring BCApps BusFound pattern - api-page-key-fields-must-be-editable-on-insert clarified: SystemId as ODataKeyField + Editable=false is valid (auto-generated); rule applies to consumer-provided key fields only Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-08-09 02:41:37 +01:00 · 2026-06-23 17:48:37 +02:00 · 2026-06-23 17:48:37 +02:00 · 288f64df16
commit 288f64df16
parent e11c1fd16c
9 changed files with 365 additions and 355 deletions
--- a/custom/knowledge/architecture/permission-sets-must-follow-least-privilege.md
+++ b/custom/knowledge/architecture/permission-sets-must-follow-least-privilege.md
@ -0,0 +1,110 @@
+# CURABIS Architecture: Permission Sets Must Follow Least-Privilege Hierarchy
+
+## Core Rule
+
+Permission sets in CURABIS apps must be structured in access tiers following the least-privilege principle. Tiers must be **additive** — each tier includes the one below it via `IncludedPermissionSets`. No single permission set should bundle user-level and administrative access in a flat structure.
+
+## Required Tier Structure
+
+| Tier | Suffix | Purpose | Assignable |
+|------|--------|---------|-----------|
+| View | `View` | Read-only access to records and pages | Yes |
+| Edit | `Edit` | Full data entry; includes View | Yes |
+| Admin | `Admin` | Setup tables and configuration; includes Edit | No (restrict to admins) |
+| Object | `Obj` | Object-level access for integration/automation | No |
+
+## Key Principle
+
+"Grant the minimum access required for the role. An end user who enters data needs Edit, not Admin. An integration service needs Obj, not a named user set."
+
+## Implementation Pattern
+
+```al
+permissionset 50100 "PM365 - View"
+{
+    Access = Public;
+    Assignable = true;
+    Caption = 'Project Mgmt 365 - View';
+    Permissions =
+        tabledata "PM Project" = R,
+        tabledata "PM Project Task" = R,
+        page "PM Project List" = X,
+        page "PM Project Card" = X;
+}
+
+permissionset 50101 "PM365 - Edit"
+{
+    Access = Public;
+    Assignable = true;
+    Caption = 'Project Mgmt 365 - Edit';
+    IncludedPermissionSets = "PM365 - View";
+    Permissions =
+        tabledata "PM Project" = RIMD,
+        tabledata "PM Project Task" = RIMD,
+        codeunit "PM Project Management" = X;
+}
+
+permissionset 50102 "PM365 - Admin"
+{
+    Access = Public;
+    Assignable = false;
+    Caption = 'Project Mgmt 365 - Admin';
+    IncludedPermissionSets = "PM365 - Edit";
+    Permissions =
+        tabledata "PM Setup" = RIMD,
+        page "PM Setup" = X;
+}
+```
+
+## Relationship to CURABIS-ARCH-011
+
+This rule is a **companion to CURABIS-ARCH-011** (`exposed-objects-must-be-in-a-permission-set`):
+
+- **CURABIS-ARCH-011**: Every exposed object *must exist* in at least one permission set
+- **This rule**: Permission sets *themselves* must follow the hierarchical least-privilege structure
+
+Both must be satisfied simultaneously: it is not enough that objects appear in a permission set if that set grants excessive access.
+
+## Anti-Pattern
+
+```al
+// Violation: flat "full access" set bundles user and admin access
+permissionset 50100 "PM365 - Full Access"
+{
+    Assignable = true;
+    Permissions =
+        tabledata "PM Project" = RIMD,
+        tabledata "PM Setup" = RIMD,    // admin data mixed with user data
+        tabledata "PM Project Task" = RIMD,
+        codeunit "PM Post Codeunit" = X;
+}
+```
+
+## BCApps Reference
+
+BCApps Business Foundation defines exactly this tiered pattern:
+
+```al
+// BusFoundEdit.PermissionSet.al
+permissionset 4 "Bus. Found. - Edit"
+{
+    Access = Public;
+    Assignable = true;
+    Caption = 'Business Foundation - Edit';
+    IncludedPermissionSets = "Bus. Found. - View";
+}
+```
+
+Microsoft uses Admin, Edit, View, Obj, and Read tiers with `IncludedPermissionSets` throughout BCApps — never a single flat "full access" set.
+
+- **Source:** https://github.com/microsoft/BCApps/tree/main/src/Business%20Foundation/App/Permissions
+- **Files:** `BusFoundAdmin`, `BusFoundEdit`, `BusFoundView`, `BusFoundObj`, `BusFoundRead`
+- **Pattern:** Each tier inherits from the tier below via `IncludedPermissionSets`. Admin sets use `Assignable = false` to prevent accidental assignment to regular users.
+
+## Verification
+
+For each CURABIS app, confirm:
+1. A `View` set exists for read-only roles
+2. An `Edit` set exists and includes `View` via `IncludedPermissionSets`
+3. An `Admin` set exists for setup objects, marked `Assignable = false`
+4. No single flat set bundles both user-level and admin-level permissions