skill-permissions

Skill: AL Permission Management

Purpose

Generate and manage permission sets for AL Business Central extensions following the principle of least privilege: role-based permission design, AL vs XML formats, permission set extensions, and security validation.

When to Load

This skill should be loaded when:

• A new extension needs its permission sets generated
• Permission errors surface at runtime ("You do not have permission to…")
• Role-based access control is being designed for an extension
• A security or compliance review requires permission documentation
• Permission set extensions need to be created for base-app objects

Core Patterns

Pattern 1: AL Permission Set Object (Preferred)

Write the permissionset object as AL code with Write/Edit (in VS Code, AL: Generate permission set scaffolds one for a human to start from), then refine:

permissionset 50100 "Contoso Sales"
{
    Assignable = true;
    Caption = 'Contoso Sales Permissions';

    Permissions =
        // Tables — object-level execute
        table "Contoso Sales Setup" = X,
        table "Contoso Discount Rule" = X,
        // Table data — RIMD granularity
        tabledata "Contoso Sales Setup" = R,          // read-only for most users
        tabledata "Contoso Discount Rule" = RIMD,     // full CRUD
        // Executable objects
        codeunit "Contoso Sales Management" = X,
        page "Contoso Sales Setup Card" = X,
        page "Contoso Discount Rules List" = X,
        report "Contoso Sales Summary" = X,
        xmlport "Contoso Sales Import" = X;
}

Permission letters for tabledata:

Letter	Meaning	Grant when…
R	Read	User needs to view data
I	Insert	User needs to create records
M	Modify	User needs to edit existing records
D	Delete	User needs to remove records (grant sparingly)

For non-tabledata objects (table, codeunit, page, report, xmlport, query):

• X = Execute / Run
• 0 = No permission (omit the line instead)