#10346 Fix activity log indirect permissions
The Expense Agent and Expense Management permission sets now grant indirect permissions on Expense Activity Log Entry to prevent SaaS entitlement failures when users create lifecycle activity entries, while keeping all writes code-mediated through the activity log manager.
- 4files
- 2AL files
- 2objects
Pull request · merged into main (BC30) on 2026-08-20 by t-prda · 4 files (+50 -5), 2 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Expense Mgmt. Edit receives indirect insert/modify/delete permission on Expense Activity Log Entry
- Expense Agent - Data receives direct read plus indirect insert/modify/delete permissions
- All activity writes remain code-mediated through Expense Activity Log Mgt., never direct
- Permission hierarchy automatically extends the fix to admin users and those with Expense Management roles
- Added regression tests verifying that both basic users and agents lack direct activity-log insert permission
- Behaviour changes for users or extensions.
AL objects touched
- Permission set 6953 “Expense Agent - Data”, ExpenseAgent: modified
- Permission set 6906 “Expense Mgmt. Edit”, ExpenseAgent: modified
Context
- Work items: AB#647154
- Labels: AL: Apps (W1), Ownership: Manual, Team: Finance
- Systems: development
- From the description: “Fix SaaS entitlement failures when Expense Agent or Expense Management users create lifecycle activity entries.”
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).