security-roles

Security Roles — Dataverse Roles and Privilege Sets

This skill handles Dataverse security role inspection, creation, and updates as reviewable, code-first desired state rather than ad hoc portal clicks. It lists and inspects roles (including their privilege sets and business unit), creates custom roles — optionally seeded by copying a baseline role — and applies privilege-set and metadata deltas through structured JSON specs. It is solution-aware: when a role belongs to your app or managed delivery path, the change stays scoped to the owning unmanaged solution. It is intentionally generic about environment URL, business unit, publisher prefix, and solution name — discover those per task.

When to use this

• The user wants to create a custom role, or copy an existing role and adjust it.
• The user wants to inspect or list roles, confirm whether a role is system-generated, or read its current privilege set before editing.
• A privilege set needs to change (add, remove, or replace privileges, adjust depth, or apply a record filter).
• Role metadata needs updating (name, description, applies-to, core-table permission summary, inheritance mode, auto-assign).
• You need to confirm the minimum privileges a model-driven app or solution feature requires before granting access.

Route here from the powerplatform-core orchestrator. For broader solution packaging, versioning, or promotion of the owning solution, use the solution-alm-delivery sibling skill.

Helpers

The helpers live in the plugin's scripts/ directory at the plugin root, not in this skill folder. Resolve the plugin root and invoke them like:

• python "$CLAUDE_PLUGIN_ROOT/scripts/inspect_security_role.py" --spec <spec.json> (Claude Code)
• python "$CODEX_PLUGIN_ROOT/scripts/inspect_security_role.py" --spec <spec.json> (also exposed as $PLUGIN_ROOT)
• Installed standalone / unsure: the scripts/ folder sits beside this skill bundle — invoke by its path within the install.

Helper	Purpose
inspect_security_role.py	List solution-scoped or business-unit roles, or inspect one role in detail, through the shared SDK helper. Drive it with a --spec whose mode is list or inspect; set includePrivileges to pull the current privilege set. Use this before editing when the business unit, system-generated status, or current privileges are unclear.
create_security_role.py	Create a custom role from a --spec. Use copyFromRoleName/copyFromRoleId to seed from a baseline, then layer additionalPrivileges; supplying privileges replaces the baseline with that full desired set. Set solutionUniqueName to add the role to the owning unmanaged solution.
update_security_role.py	Update role metadata and privilege sets from a --spec. Select by roleId or by name plus a business-unit selector; apply additionalPrivileges, removePrivileges, or a full privileges replacement, plus metadata fields like newName, description, appliesTo, and inheritanceMode.