mirror of
https://github.com/microsoft/BCQuality.git
synced 2026-10-05 06:36:55 +01:00
53e2cf2fa4
* feat(community/agents): add AL agent quality guidance - add 20 agent knowledge rules with good and bad AL samples - clarify setup dialog shape, temporary persistence, permissions, profiles, instructions, capability registration, and interface wiring - add the community-owned AL agents review skill - make review fixture discovery layer-aware with custom, community, and Microsoft precedence - document layer-aware evaluation behavior * fix(community/agents): align setup and permission samples - mark agent setup pages as non-extensible where required - narrow the agent profile by hiding an unrelated sales-order field - define a dedicated read-only permission set for the sales review agent - assign AL-defined permission sets with system scope and the owning app ID - clarify the permission scope guidance for default access controls * Address agent review feedback
26 lines
1.2 KiB
Markdown
26 lines
1.2 KiB
Markdown
---
|
|
bc-version: [28..]
|
|
domain: agents
|
|
keywords: [setrequiresreview, agent-task-message-builder, approval, trusted-input, skip-review]
|
|
technologies: [al]
|
|
countries: [w1]
|
|
application-area: [all]
|
|
---
|
|
|
|
# Skip incoming message review only after the caller validated the payload
|
|
|
|
## Description
|
|
|
|
Incoming task messages default to requiring user approval before the agent runs. From 28.1, `Agent Task Message Builder.SetRequiresReview(false)` starts the agent immediately. That is safe only for inputs you already validated in AL (your page action, your posting subscriber). External email or partner payloads are not trusted by default. Analysis Warnings still force a review.
|
|
|
|
## Best Practice
|
|
|
|
Leave the default review-on for anything that originated outside your extension. Call `SetRequiresReview(false)` only on messages you constructed from already-authorized BC data.
|
|
|
|
See sample: `skip-incoming-review-only-for-trusted-input.good.al`.
|
|
|
|
## Anti Pattern
|
|
|
|
`SetRequiresReview(false)` on simulated email, incoming webhooks, or user-free text. Detection signal: `SetRequiresReview(false)` next to external content with no prior validation.
|
|
|
|
See sample: `skip-incoming-review-only-for-trusted-input.bad.al`.
|