mirror of
https://github.com/microsoft/BCQuality.git
synced 2026-08-06 17:36:53 +01:00
bfda67a95a
* Promote security knowledge from community to Microsoft layer Pure git-mv relocation of the SECURITY domain from the community layer to the Microsoft layer. No content changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address review feedback on security knowledge promotion - do-not-grant-rights-beyond-a-users-entitlement.md: drop the See sample reference to a .good.al file that does not exist - Remove the 'Contributions welcome' boilerplate line from compose-permission-sets, prefer-oauth2, and protect-sensitive-data - protect-sensitive-data-in-temporary-tables: remove the pointless DeleteAll on the locally scoped temp buffer in the good sample and reword Best Practice to note local buffers are cleaned up automatically - Drop guard-bulk-operations-with-istemporary from the promotion; it stays in the community layer pending a decision on whether it is security Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove Contributions welcome boilerplate from do-not-grant article for consistency Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Jesper Schulz-Wedde <jesper.schulzwedde@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
34 lines
971 B
AL
34 lines
971 B
AL
// Building blocks: focused per-concern, marked Assignable = false so administrators
|
|
// do not accidentally assign a fragment.
|
|
permissionset 50100 "Sales Tables - Read"
|
|
{
|
|
Assignable = false;
|
|
Permissions =
|
|
tabledata Customer = R,
|
|
tabledata "Sales Header" = R,
|
|
tabledata "Sales Line" = R;
|
|
}
|
|
|
|
permissionset 50101 "Sales Tables - Edit"
|
|
{
|
|
Assignable = false;
|
|
IncludedPermissionSets = "Sales Tables - Read";
|
|
Permissions =
|
|
tabledata Customer = IM,
|
|
tabledata "Sales Header" = IMD,
|
|
tabledata "Sales Line" = IMD;
|
|
}
|
|
|
|
// Role-shaped, Assignable = true, composed from building blocks.
|
|
// Adding a new Sales table means editing one building block; both roles inherit the change.
|
|
permissionset 50110 "Sales Order Processor"
|
|
{
|
|
Assignable = true;
|
|
IncludedPermissionSets = "Sales Tables - Edit";
|
|
}
|
|
|
|
permissionset 50111 "Sales Viewer"
|
|
{
|
|
Assignable = true;
|
|
IncludedPermissionSets = "Sales Tables - Read";
|
|
}
|