fix(community/agents): align setup and permission samples

- mark agent setup pages as non-extensible where required
- narrow the agent profile by hiding an unrelated sales-order field
- define a dedicated read-only permission set for the sales review agent
- assign AL-defined permission sets with system scope and the owning app ID
- clarify the permission scope guidance for default access controls

community/knowledge/agents/agent-profile-narrows-visible-ui.good.al

@@ -8,6 +8,14 @@ profile "SALES REVIEW AGENT"
 
 pagecustomization "Sales Review Agent Sales Ord." customizes "Sales Order"
 {
+    layout
+    {
+        modify("Payment Terms Code")
+        {
+            Visible = false;
+        }
+    }
+
     actions
     {
         modify(Post)

community/knowledge/agents/agent-setup-page-is-configuration-dialog.good.al

@@ -4,6 +4,7 @@ page 50100 "Sales Review Agent Setup"
     Caption = 'Set up Sales Review Agent';
     SourceTable = "Sales Review Agent Setup";
     SourceTableTemporary = true;
+    Extensible = false;
 
     layout
     {

community/knowledge/agents/agent-setup-page-is-configuration-dialog.md

@@ -16,6 +16,7 @@ Instance setup is not a Card or StandardDialog. The toolkit expects `PageType =
 ## Best Practice
 
 Declare `PageType = ConfigurationDialog`, host `part(...; "Agent Setup Part")`, and put agent-specific fields in another group. Keep system OK/Cancel. Use a temporary source record and defer persistence until Update, as described in `agent-setup-source-table-is-temporary.md`.
+The Extensible property of the page must be set to false.
 
 See sample: `agent-setup-page-is-configuration-dialog.good.al`.
 

community/knowledge/agents/agent-setup-source-table-is-temporary.good.al

@@ -3,6 +3,7 @@ page 50100 "Sales Review Agent Setup"
     PageType = ConfigurationDialog;
     SourceTable = "Sales Review Agent Setup";
     SourceTableTemporary = true;
+    Extensible = false;
 
     layout
     {

community/knowledge/agents/do-not-create-agents-in-install-upgrade-or-background.good.al

@@ -4,6 +4,7 @@ page 50100 "Sales Review Agent Setup"
     ApplicationArea = All;
     SourceTable = "Sales Review Agent Setup";
     SourceTableTemporary = true;
+    Extensible = false;
 
     layout
     {

community/knowledge/agents/get-default-access-controls-least-privilege.good.al

@@ -1,3 +1,12 @@
+permissionset 50100 "SALES REVIEW AGENT"
+{
+    Assignable = true;
+    Caption = 'Sales Review Agent';
+    Permissions =
+        tabledata "Sales Header" = R,
+        tabledata "Sales Line" = R;
+}
+
 codeunit 50100 "Sales Review Agent Factory"
 {
     procedure GetDefaultAccessControls(var TempAccessControlBuffer: Record "Access Control Buffer" temporary)
@@ -8,7 +17,7 @@ codeunit 50100 "Sales Review Agent Factory"
         NavApp.GetCurrentModuleInfo(CurrentModuleInfo);
         Clear(TempAccessControlBuffer);
         TempAccessControlBuffer."Company Name" := CopyStr(CompanyName(), 1, MaxStrLen(TempAccessControlBuffer."Company Name"));
-        TempAccessControlBuffer.Scope := TempAccessControlBuffer.Scope::Tenant;
+        TempAccessControlBuffer.Scope := TempAccessControlBuffer.Scope::System;
         TempAccessControlBuffer."App ID" := CurrentModuleInfo.Id;
         TempAccessControlBuffer."Role ID" := RoleIdTok;
         TempAccessControlBuffer.Insert();

community/knowledge/agents/get-default-access-controls-least-privilege.md

@@ -15,7 +15,7 @@ application-area: [all]
 
 ## Best Practice
 
-Insert only the permission sets the agent needs, with the correct Scope and App ID. Recreate any BC-only sets as AL permissionset objects first. Prefer a dedicated permission set over a full-user role.
+Insert only the permission sets the agent needs. For an AL `permissionset` object, use `Scope::System` and the ID of the app that defines it. Recreate permission sets that exist only as user-defined configuration in Business Central as AL objects first. Prefer a dedicated permission set over a full-user role.
 
 See sample: `get-default-access-controls-least-privilege.good.al`.