Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-06 17:36:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
bcquality/microsoft/knowledge/security/compose-permission-sets-with-included-sets.md
Jesper Schulz-Wedde bfda67a95a
Promote security knowledge from community to Microsoft layer (#49) 
* Promote security knowledge from community to Microsoft layer

Pure git-mv relocation of the SECURITY domain from the community layer to the Microsoft layer. No content changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address review feedback on security knowledge promotion

- do-not-grant-rights-beyond-a-users-entitlement.md: drop the See sample
  reference to a .good.al file that does not exist
- Remove the 'Contributions welcome' boilerplate line from
  compose-permission-sets, prefer-oauth2, and protect-sensitive-data
- protect-sensitive-data-in-temporary-tables: remove the pointless
  DeleteAll on the locally scoped temp buffer in the good sample and
  reword Best Practice to note local buffers are cleaned up automatically
- Drop guard-bulk-operations-with-istemporary from the promotion; it
  stays in the community layer pending a decision on whether it is security

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Remove Contributions welcome boilerplate from do-not-grant article for consistency

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Jesper Schulz-Wedde <jesper.schulzwedde@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-14 11:23:57 +02:00

1.6 KiB
Raw Blame History

bc-version domain keywords technologies countries application-area
all
security
permissionset
includedpermissionsets
assignable
composition
role
al
w1
all

Compose permission sets with IncludedPermissionSets

Description

The IncludedPermissionSets property lets one AL permission set reference another, composing rights out of smaller building blocks. Combined with Assignable = false on the building blocks, an extension can ship focused per-module units (a table-data cluster, an API-access cluster) and assemble role-shaped sets that include them. Adding an object updates one building block, and every role-shaped set that includes it inherits the change automatically — instead of drifting apart across duplicated definitions.

Best Practice

Break permission grants into small, focused building blocks, one per cohesive concern. Mark the building blocks Assignable = false so administrators do not accidentally assign a fragment. Build role-shaped, Assignable = true sets that reference the relevant building blocks through IncludedPermissionSets. When the extension grows, the structure absorbs the growth without duplicated edits.

See sample: compose-permission-sets-with-included-sets.good.al.

Anti Pattern

Declaring several role-shaped permission sets that each re-enumerate the same object lists. Adding a new table means touching every set by hand; the sets drift apart over time, and subtle authorization bugs appear where one role was updated and a sibling role was not.

See sample: compose-permission-sets-with-included-sets.bad.al.