---
id: change/bcquality/199
type: change
title: "#199 Fix indirect permission letters: `ri` is indirect read plus insert"
summary: A security best practice article now correctly explains that permission letters r, i, m, d each represent one permission (read, insert, modify, delete), and corrects its examples to avoid over-granting indirect permissions.
tier: official
language: en
tags:
  - fix
  - main
system: administration
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:03:57.446Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: 130d5de6c4bd72d2158240fe431862b6434c735a
evidence:
  - kind: code
    url: https://github.com/microsoft/BCQuality/pull/199
    title: "microsoft/BCQuality#199: Fix indirect permission letters: `ri` is indirect read plus insert"
    date: "2026-09-29"
    commit: 130d5de6c4bd72d2158240fe431862b6434c735a
    t: null
    quote: so `ri` is indirect read **plus indirect insert**, `ii` repeats insert, and `mi` and `di` each add indirect insert
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 199
repo: microsoft/BCQuality
source_id: bcquality-prs
url: https://github.com/microsoft/BCQuality/pull/199
kind: pr
base_branch: main
major: null
merged_at: "2026-09-29T10:49:56Z"
author: Nikolaj1407
author_type: User
community_contribution: false
labels: []
change_class: code
change_kind: fix
behavior_change: false
breaking: false
files:
  count: 2
  additions: 7
  deletions: 3
  al: 2
apps: []
objects_touched: []
objects_unjoined:
  - path: microsoft/knowledge/security/indirect-permissions-for-elevated-access.good.al
    status: modified
    reason: not-in-snapshot
  - path: microsoft/knowledge/security/indirect-permissions-for-elevated-access.md
    status: modified
    reason: not-in-snapshot
obsoletions: []
backports: []
fixes_issues: []
work_items: []
systems:
  - administration
  - development
quote: so `ri` is indirect read **plus indirect insert**, `ii` repeats insert, and `mi` and `di` each add indirect insert
joined_against:
  major: null
  commit: null
---

# #199 Fix indirect permission letters: `ri` is indirect read plus insert

> A security best practice article now correctly explains that permission letters r, i, m, d each represent one permission (read, insert, modify, delete), and corrects its examples to avoid over-granting indirect permissions.

[Pull request](https://github.com/microsoft/BCQuality/pull/199) · merged into `main` on 2026-09-29 by Nikolaj1407 · 2 files (+7 -3), 2 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Permission tokens consist of individual letters: r (read), i (insert), m (modify), d (delete), with lowercase meaning indirect
- The read-only 'Report Runner' example now correctly uses 'r' instead of 'ri', which would have also granted indirect insert
- Best practice guidance and keywords updated to reflect the correct interpretation of permission letters
- Added references to official Microsoft Learn documentation on permissions

## AL objects touched

- `microsoft/knowledge/security/indirect-permissions-for-elevated-access.good.al`: modified, not in the BC? snapshot
- `microsoft/knowledge/security/indirect-permissions-for-elevated-access.md`: modified, not in the BC? snapshot

## Context

- Systems: administration, development
- From the description: "so `ri` is indirect read **plus indirect insert**, `ii` repeats insert, and `mi` and `di` each add indirect insert"

Source: metadata of a merged pull request in microsoft/BCQuality (bcquality): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).