---
id: change/bcapps/9482
type: change
title: "#9482 Make service-invoked System Application facades callable by any user (Privacy Notice + Page Summary Provider)"
summary: Two System Application facade codeunits now declare inherent entitlements and permissions so any authenticated user can call them in low-permission sessions like web services, OData, Copilot, and agents, instead of requiring explicit Execute permission.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - codeunit page summary provider
  - codeunit privacy notice
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:11:56.576Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: 66823610bb2f65fde39296c0ac3f34facc5e1b01
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/9482
    title: "microsoft/BCApps#9482: Make service-invoked System Application facades callable by any user (Privacy Notice + Page Summary Provider)"
    date: "2026-07-21"
    commit: 66823610bb2f65fde39296c0ac3f34facc5e1b01
    t: null
    quote: This makes them callable by any authenticated user by declaring the inherent grants, matching their impls.
links:
  learn: []
  objects:
    - object/codeunit/2718
    - object/codeunit/1563
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 9482
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/9482
kind: pr
base_branch: main
major: "30"
merged_at: "2026-07-21T15:44:11Z"
author: onbuyuka
author_type: User
community_contribution: false
labels:
  - "AL: System Application"
  - "Team: Integrations"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 2
  additions: 4
  deletions: 0
  al: 2
apps:
  - System Application
objects_touched:
  - key: codeunit/2718
    page: codeunit/2718
    type: codeunit
    id: 2718
    name: Page Summary Provider
    app: System Application
    status: modified
  - key: codeunit/1563
    page: codeunit/1563
    type: codeunit
    id: 1563
    name: Privacy Notice
    app: System Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 641612
systems:
  - development
  - integration
quote: This makes them callable by any authenticated user by declaring the inherent grants, matching their impls.
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #9482 Make service-invoked System Application facades callable by any user (Privacy Notice + Page Summary Provider)

> Two System Application facade codeunits now declare inherent entitlements and permissions so any authenticated user can call them in low-permission sessions like web services, OData, Copilot, and agents, instead of requiring explicit Execute permission.

[Pull request](https://github.com/microsoft/BCApps/pull/9482) · merged into `main` (BC30) on 2026-07-21 by onbuyuka · 2 files (+4 -0), 2 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Privacy Notice and Page Summary Provider facades previously blocked non-SUPER users with NavPermissionException
- Root cause was facades missing InherentEntitlements and InherentPermissions declarations that their implementation codeunits had
- Adding inherent grants aligns facades with their delegate implementations and allows Copilot capabilities and agent tasks to function for all users
- Actual table access remains controlled by implementation codeunits' declared tabledata permissions
- Fixes permission denial for Entra tenant admins and other low-permission session users
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 2718 "Page Summary Provider"](../../objects/codeunit/2718.md), System Application: modified
- [Codeunit 1563 "Privacy Notice"](../../objects/codeunit/1563.md), System Application: modified

## Context

- Work items: AB#641612
- Labels: AL: System Application, Team: Integrations
- Systems: development, integration
- From the description: "This makes them callable by any authenticated user by declaring the inherent grants, matching their impls."

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).