mirror of https://github.com/microsoft/BCQuality.git synced 2026-10-05 06:36:55 +01:00

Nikolaj Jakobi Nøttrup f31552f5db Fix indirect permission letters in indirect-permissions-for-elevated-access

Each letter of a permission value is one permission, so `ri` is indirect
read plus indirect insert. The good sample granted a read-only
"Report Runner" role indirect insert on G/L Entry. Use `r` in the sample,
name the lowercase letters in Best Practice, replace the ri/ii/mi/di
keywords and cite the Microsoft Learn pages that define the letters.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-26 22:47:23 +02:00

2.7 KiB

Raw Blame History

bc-version

domain

keywords

technologies

countries

application-area

all

security

permissionset

indirect-permissions

lowercase

code-mediated

all

Use indirect permissions when access must be code-mediated

Description

In a permissionset, uppercase letters (R, I, M, D) grant direct permissions: the assignee can read, insert, modify, or delete the table data through any UI or API surface. Lowercase letters (r, i, m, d) grant indirect permissions: the operation is allowed only when it is invoked from AL code that itself holds the corresponding direct permission. Indirect permissions let a role consume privileged tables through controlled procedures (a report, a posting routine) without giving users a way to read or change those tables outside the intended code path.

Best Practice

Use indirect permissions (the lowercase letters r, i, m, d) when a role needs access to a sensitive table only through a specific codeunit or report — for example, a "Report Runner" role that reads G/L Entry only via published reports, granted tabledata "G/L Entry" = r. Each letter is one permission: ri grants indirect read and indirect insert, so grant only the letters the role needs. Pair the indirect grant with the codeunit or report that mediates access; that object's own permissions (or InherentPermissions) supply the direct rights. Document why indirect permissions are required in the permission set or in the consuming object's comments. See sample: indirect-permissions-for-elevated-access.good.al.

Anti Pattern

Granting RIMD on a sensitive table when the role only needs to view it through a report — for example tabledata "G/L Entry" = RIMD on a "Report Runner" role. Users assigned that role can now query and modify ledger entries directly through any client that respects the permission, bypassing the report entirely. Reviewers should look for uppercase grants on system-of-record tables (G/L Entry, ledger entries, posted documents) where the consuming code path is clearly read-through-report or read-through-API. See sample: indirect-permissions-for-elevated-access.bad.al.

References

Permissions property and Permissions on database objects define one letter per permission: R/r read, I/i insert, M/m modify, D/d delete, uppercase for direct and lowercase for indirect.

2.7 KiB Raw Blame History