Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-10-05 14:46:55 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
bcquality/microsoft/knowledge/security/internal-access-is-not-a-security-boundary.md
Jesper Schulz-Wedde 2b5550c346
Some checks failed
Validate knowledge index / validate-index (push) Has been cancelled
Details
Validate AL review fixtures / validate-review-fixtures (push) Has been cancelled
Details
Validate frontmatter and structure / validate (push) Has been cancelled
Details
Improve partner onboarding and documentation navigation (#174) 
Lead with a complete plugin quick start and add task-oriented usage, troubleshooting, customization, and contribution guides. Preserve the broader plugin framing, correct conflicting contract guidance, support Agents folder reviews, and align repository validation. Convert existing sample references to clickable links without changing knowledge rules.

Co-authored-by: Jesper Schulz-Wedde <jesper.schulzwedde@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-09-09 17:31:03 +02:00

1.6 KiB
Raw Blame History

bc-version domain keywords technologies countries application-area
all
security
access
internal
internalsvisibleto
recordref
codeunit-run
security-boundary
authorization
al
w1
all

Access Internal is API hygiene, not an authorization boundary

Description

Access = Internal controls compile-time symbol visibility. It does not prevent runtime access through mechanisms such as RecordRef, TransferFields, or Codeunit.Run, and internalsVisibleTo deliberately grants compile-time access to named companion apps. Microsoft explicitly documents that access modifiers cannot be used as a security boundary.

Best Practice

Use internal to keep implementation details out of the supported API, but enforce sensitive operations with permissions, entitlements, and explicit authorization checks appropriate to the operation. Treat internalsVisibleTo as a same-publisher development/testability relationship, not as a trust grant for secrets or elevated data access.

See sample: internal-access-is-not-a-security-boundary.good.al.

Anti Pattern

Placing privileged work in an internal codeunit and claiming that other extensions cannot invoke it, or exposing an app to a different publisher through internalsVisibleTo because internal is assumed to protect the underlying operation. The access modifier narrows supported callers; it does not authenticate runtime callers.

See sample: internal-access-is-not-a-security-boundary.bad.al.