---
id: change/bcapps/10346
type: change
title: "#10346 Fix activity log indirect permissions"
summary: The Expense Agent and Expense Management permission sets now grant indirect permissions on Expense Activity Log Entry to prevent SaaS entitlement failures when users create lifecycle activity entries, while keeping all writes code-mediated through the activity log manager.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - permissionset expense agent - data
  - permissionset expense mgmt. edit
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:08:09.911Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: 498733580e1273fc0d0cd7ddcbb59291a145425b
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/10346
    title: "microsoft/BCApps#10346: Fix activity log indirect permissions"
    date: "2026-08-20"
    commit: 498733580e1273fc0d0cd7ddcbb59291a145425b
    t: null
    quote: Fix SaaS entitlement failures when Expense Agent or Expense Management users create lifecycle activity entries.
links:
  learn: []
  objects:
    - object/permissionset/6953
    - object/permissionset/6906
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 10346
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/10346
kind: pr
base_branch: main
major: "30"
merged_at: "2026-08-20T14:27:46Z"
author: t-prda
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "Ownership: Manual"
  - "Team: Finance"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 4
  additions: 50
  deletions: 5
  al: 2
apps:
  - ExpenseAgent
objects_touched:
  - key: permissionset/6953
    page: permissionset/6953
    type: permissionset
    id: 6953
    name: Expense Agent - Data
    app: ExpenseAgent
    status: modified
  - key: permissionset/6906
    page: permissionset/6906
    type: permissionset
    id: 6906
    name: Expense Mgmt. Edit
    app: ExpenseAgent
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 647154
systems:
  - development
quote: Fix SaaS entitlement failures when Expense Agent or Expense Management users create lifecycle activity entries.
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #10346 Fix activity log indirect permissions

> The Expense Agent and Expense Management permission sets now grant indirect permissions on Expense Activity Log Entry to prevent SaaS entitlement failures when users create lifecycle activity entries, while keeping all writes code-mediated through the activity log manager.

[Pull request](https://github.com/microsoft/BCApps/pull/10346) · merged into `main` (BC30) on 2026-08-20 by t-prda · 4 files (+50 -5), 2 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Expense Mgmt. Edit receives indirect insert/modify/delete permission on Expense Activity Log Entry
- Expense Agent - Data receives direct read plus indirect insert/modify/delete permissions
- All activity writes remain code-mediated through Expense Activity Log Mgt., never direct
- Permission hierarchy automatically extends the fix to admin users and those with Expense Management roles
- Added regression tests verifying that both basic users and agents lack direct activity-log insert permission
- Behaviour changes for users or extensions.

## AL objects touched

- [Permission set 6953 "Expense Agent - Data"](../../objects/permissionset/6953.md), ExpenseAgent: modified
- [Permission set 6906 "Expense Mgmt. Edit"](../../objects/permissionset/6906.md), ExpenseAgent: modified

## Context

- Work items: AB#647154
- Labels: AL: Apps (W1), Ownership: Manual, Team: Finance
- Systems: development
- From the description: "Fix SaaS entitlement failures when Expense Agent or Expense Management users create lifecycle activity entries."

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).