#9482 Make service-invoked System Application facades callable by any user (Privacy Notice + Page Summary Provider)
Two System Application facade codeunits now declare inherent entitlements and permissions so any authenticated user can call them in low-permission sessions like web services, OData, Copilot, and agents, instead of requiring explicit Execute permission.
- 2files
- 2AL files
- 2objects
Pull request · merged into main (BC30) on 2026-07-21 by onbuyuka · 2 files (+4 -0), 2 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Privacy Notice and Page Summary Provider facades previously blocked non-SUPER users with NavPermissionException
- Root cause was facades missing InherentEntitlements and InherentPermissions declarations that their implementation codeunits had
- Adding inherent grants aligns facades with their delegate implementations and allows Copilot capabilities and agent tasks to function for all users
- Actual table access remains controlled by implementation codeunits’ declared tabledata permissions
- Fixes permission denial for Entra tenant admins and other low-permission session users
- Behaviour changes for users or extensions.
AL objects touched
- Codeunit 2718 “Page Summary Provider”, System Application: modified
- Codeunit 1563 “Privacy Notice”, System Application: modified
Context
- Work items: AB#641612
- Labels: AL: System Application, Team: Integrations
- Systems: development, integration
- From the description: “This makes them callable by any authenticated user by declaring the inherent grants, matching their impls.”
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).