Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-06 17:36:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
bcquality/microsoft/knowledge/security/compose-permission-sets-with-included-sets.md
Jesper Schulz-Wedde 2350e10966 Address review feedback on security knowledge promotion 
- do-not-grant-rights-beyond-a-users-entitlement.md: drop the See sample
  reference to a .good.al file that does not exist
- Remove the 'Contributions welcome' boilerplate line from
  compose-permission-sets, prefer-oauth2, and protect-sensitive-data
- protect-sensitive-data-in-temporary-tables: remove the pointless
  DeleteAll on the locally scoped temp buffer in the good sample and
  reword Best Practice to note local buffers are cleaned up automatically
- Drop guard-bulk-operations-with-istemporary from the promotion; it
  stays in the community layer pending a decision on whether it is security

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-07-10 12:27:31 +02:00

1.6 KiB
Raw Blame History

bc-version domain keywords technologies countries application-area
all
security
permissionset
includedpermissionsets
assignable
composition
role
al
w1
all

Compose permission sets with IncludedPermissionSets

Description

The IncludedPermissionSets property lets one AL permission set reference another, composing rights out of smaller building blocks. Combined with Assignable = false on the building blocks, an extension can ship focused per-module units (a table-data cluster, an API-access cluster) and assemble role-shaped sets that include them. Adding an object updates one building block, and every role-shaped set that includes it inherits the change automatically — instead of drifting apart across duplicated definitions.

Best Practice

Break permission grants into small, focused building blocks, one per cohesive concern. Mark the building blocks Assignable = false so administrators do not accidentally assign a fragment. Build role-shaped, Assignable = true sets that reference the relevant building blocks through IncludedPermissionSets. When the extension grows, the structure absorbs the growth without duplicated edits.

See sample: compose-permission-sets-with-included-sets.good.al.

Anti Pattern

Declaring several role-shaped permission sets that each re-enumerate the same object lists. Adding a new table means touching every set by hand; the sets drift apart over time, and subtle authorization bugs appear where one role was updated and a sibling role was not.

See sample: compose-permission-sets-with-included-sets.bad.al.