BC Observatoryunofficial, made by waldo
code change · fixAdministration & Setupofficial - Microsoftreviewed - checked by Opus

#199 Fix indirect permission letters: `ri` is indirect read plus insert

A security best practice article now correctly explains that permission letters r, i, m, d each represent one permission (read, insert, modify, delete), and corrects its examples to avoid over-granting indirect permissions.

Open in Claude199.mdPull request #199

Pull request · merged into main on 2026-09-29 by Nikolaj1407 · 2 files (+7 -3), 2 AL · fix · tier official · reviewed (checked by Opus)

What changed

  • Permission tokens consist of individual letters: r (read), i (insert), m (modify), d (delete), with lowercase meaning indirect
  • The read-only ‘Report Runner’ example now correctly uses ‘r’ instead of ‘ri’, which would have also granted indirect insert
  • Best practice guidance and keywords updated to reflect the correct interpretation of permission letters
  • Added references to official Microsoft Learn documentation on permissions

AL objects touched

  • microsoft/knowledge/security/indirect-permissions-for-elevated-access.good.al: modified, not in the BC? snapshot
  • microsoft/knowledge/security/indirect-permissions-for-elevated-access.md: modified, not in the BC? snapshot

Context

  • Systems: administration, development
  • From the description: “so ri is indirect read plus indirect insert, ii repeats insert, and mi and di each add indirect insert”

Source: metadata of a merged pull request in microsoft/BCQuality (bcquality): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).