Complete AL review knowledge readiness

Fill telemetry and Query coverage, strengthen thin review domains, correct audited content defects, and add deterministic cheap-model evaluation and reference-integrity safeguards.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9825b012-e653-496a-9310-c1f4b6f8ac27

microsoft/knowledge/security/internal-access-is-not-a-security-boundary.good.al

@@ -0,0 +1,39 @@
+table 50468 "Sensitive Setup"
+{
+    DataClassification = CustomerContent;
+
+    fields
+    {
+        field(1; "Primary Key"; Code[10]) { }
+    }
+}
+
+codeunit 50469 "Setup Authorization"
+{
+    procedure CanManageSetup(): Boolean
+    var
+        SensitiveSetup: Record "Sensitive Setup";
+    begin
+        exit(SensitiveSetup.WritePermission());
+    end;
+}
+
+codeunit 50470 "Protected Setup Action"
+{
+    Access = Internal;
+
+    trigger OnRun()
+    begin
+        if not SetupAuthorization.CanManageSetup() then
+            Error(NotAuthorizedErr);
+        UpdateSensitiveSetup();
+    end;
+
+    local procedure UpdateSensitiveSetup()
+    begin
+    end;
+
+    var
+        SetupAuthorization: Codeunit "Setup Authorization";
+        NotAuthorizedErr: Label 'You are not authorized to manage this setup.';
+}