bc-al-permissions

BC AL Permission Architecture

When to Use

Always use after:

• Creating new tables, pages, or codeunits
• Adding new table extensions or page extensions
• Reviewing permission coverage

Also use when:

• User asks about role assignments or access control
• Debugging permission errors
• Planning new features that affect access control

3-Tier Model

Each business module has 3 permission sets in src/module_level_permissions/<Module>/PermissionSets/:

Read   — read-only, base set
Edit   — includes Read, adds write
Admin  — includes Edit, adds setup/config

Inclusion chain: Admin includes Edit includes Read.

All 3 are Assignable = true.

10 Business Modules

Module	Scope
Sales	Customers, sales orders, quotes, invoices
Purchase	Vendors, purchase orders, quotes
Warehouse	Locations, inventory, warehouse documents
Finance	GL, journals, receivables, payables
Production	BOM, assembly, manufacturing
Quality	QC inspections, testing
Logistics	Shipping, transport
AfterSales	Service orders, warranty
System	Setup tables, configuration
All	Cross-module read access

Permission Set Naming

File: <PREFIX><Module><Level>.PermissionSet.al Object name: "<PREFIX><MODULE><LEVEL>" (UPPERCASE) Caption: "<PREFIX> <Module> - <Level>"

Example:

permissionset 52901 "HQHUSALESEDIT"
{
    Assignable = true;
    Caption = 'HQHU Sales - Edit';
    IncludedPermissionSets = "HQHUSALESREAD";
}

Component Permission Set Extensions

Every new table/page needs permission extensions in src/components/<Component>/PermissionSetExtensions/.

Create two extensions per object:

1. Edit extension — extends the module's Edit permission set, grants full CRUD
2. Read extension — extends the module's Read permission set, grants read-only

File naming: <PREFIX><ObjectName><Level>.PermissionSetExt.al Object naming: "<PREFIX> <ObjectName> <Level> Ext"

Which Module to Extend?

Component Type	Module
Customer/Sales related	Sales
Vendor/Purchase related	Purchase
Item/Inventory related	Warehouse
GL/Finance related	Finance
Production/Assembly	Production
Quality control	Quality
Shipping/Transport	Logistics
Service/Warranty	AfterSales
Setup/Config	System

Checklist for New Object Permissions

1. Identify which module the object belongs to
2. Create PermissionSetExtensions/ folder in component if missing
3. Create Edit extension with full CRUD permissions
4. Create Read extension with read-only permissions
5. Use next available permission set extension IDs