Non-debuggable boundary audit

A query finds debuggable callees of non-debuggable methods, where a breakpoint could leak content.

Area: Developer tools. Status: GA. Developer relevance: high. Airtime: 2 min across 1 video, demoed.

Status evidence

Nothing said about status; launch event convention: generally available unless stated otherwise.

Where they talk about it

What's new: ALGraph: 4:24 to 5:58, demo at 4:53 (called "Non-debuggable to debuggable boundary audit" there)

Quotes

4:24 "this query language that all the different operations you can do this is all well documented on our um MS Learn website." - Points developers to MS Learn for the query syntax.
4:53 "You generate the graph once and then you query it multiple times." - Repeats that the graph is reusable, so each query is cheap after the first extraction.
5:48 "So, even though like the main procedure is non-debuggable and this is a local procedure, you're still leaking information this way." - Shows the non-obvious leak the tool finds, even when the entry procedure is non-debuggable.
5:58 "we are using this quite heavily internally as well to strengthen our security posture." - States that the team uses the tool internally for security work.

Caveats mentioned

The demo example is simplified

Prerequisites mentioned

A generated meta model

Documented features match

Audit AL app accessibility and debugging boundaries - high confidence (llm). Docs say: General availability, roadmap id 573336. Debugging boundaries

Docs checked on 2026-10-02: the match is against Microsoft's what's new pages for the wave as they were on that date. Microsoft keeps filling the documentation, so "no documented item" can go stale. The wider product documentation on learn.microsoft.com was searched for this feature on the same date; the feature's data lists an article when one was found.

Tags: al, security, debugging, auditing

Generated by pipeline step 06. Source: YouTube auto-captions of the launch event videos, see the deep links. Not official.