Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-08 18:31:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Promote security knowledge from community to Microsoft layer

Browse source 
Pure git-mv relocation of the SECURITY domain from the community layer to the Microsoft layer. No content changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Jesper Schulz-Wedde 2026-06-25 14:03:22 +02:00
parent 3769d2fbf4
commit 347984ac74
16 changed files with 0 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
microsoft/knowledge/security/do-not-grant-rights-beyond-a-users-entitlement.md Normal file
View file

@ -0,0 +1,26 @@
---
bc-version: [all]
domain: security
keywords: [entitlement, permissionset, license, clipping, sandbox-drift]
technologies: [al]
countries: [w1]
application-area: [all]
---
# Do not grant rights beyond a user's entitlement
> Contributions welcome — open a PR to refine or extend this article.
## Description
Entitlements are license-level caps on what a user can access, derived automatically from the BC license tier. Permission sets are application-level grants administered on top of the entitlement. A permission set can only grant within the entitlement's boundaries; grants beyond those boundaries are silently clipped at runtime. This means a permission set authored and validated in a developer sandbox (with a broad license) can appear to work correctly there and fail silently in a customer tenant where users hold a narrower entitlement.
## Best Practice
When designing a permission set that ships with an extension, consult the entitlement model for the target user population before finalizing the grants. Every object and tabledata right the set expects to grant should be reachable within the intended entitlement tier; if it is not, the set needs to be scoped to licenses that permit it, or the feature needs a different access path.
See sample: `do-not-grant-rights-beyond-a-users-entitlement.good.al`.
## Anti Pattern
Authoring permission sets in a sandbox with full-license context and shipping them without verifying which entitlement tier customer users actually hold. The sets look complete in test; on a real customer they silently lose rights at runtime and the symptom is "the feature does not work for some users" with no obvious authorization error.