--- id: post/aardvarklabs-blog/3348 type: post title: Step-by-Step Guide to Secure Business Central Agent Implementations in AL summary: This post demonstrates how to secure AI agents in Business Central by implementing restrictive profiles, page customizations, and permission sets. It shows the security risks of overly permissive agent configurations and provides step-by-step AL code examples to limit what agents can see and do. tier: community language: en tags: - agent security - permissions - profiles - al development - access control - least privilege system: copilot review: state: reviewed by: opus at: "2026-10-08T01:55:36.135Z" flags: [] generated: at: "2026-10-08T01:26:53.141Z" pipeline: 0.2.0 prompts: extract-post: 1 input_hash: b9a00cec4a2dc5f0b8400a9702bca3c01101bc9f6e71d78187840e2361c2764d evidence: - kind: blog url: https://aardvarklabs.blog/2026/04/10/step-by-step-guide-to-secure-business-central-agent-implementations-in-al/ title: Step-by-Step Guide to Secure Business Central Agent Implementations in AL date: "2026-04-10" commit: null t: null quote: null - kind: blog url: https://aardvarklabs.blog/2026/04/10/step-by-step-guide-to-secure-business-central-agent-implementations-in-al/ title: Step-by-Step Guide to Secure Business Central Agent Implementations in AL date: "2026-04-10" commit: null t: null quote: We have to assume that if the Agent can do something the agent will do that thing. It is like Murphy's Law. - kind: blog url: https://aardvarklabs.blog/2026/04/10/step-by-step-guide-to-secure-business-central-agent-implementations-in-al/ title: Step-by-Step Guide to Secure Business Central Agent Implementations in AL date: "2026-04-10" commit: null t: null quote: Even with all this effort, you must still test your agents. Can they be tricked into misbehaving? Can it access out of scope data? links: learn: [] objects: - object/page/22 - object/page/27 - object/page/5237 - object/table/18 - object/table/23 - object/table/5222 features: [] topics: [] localizations: [] videos: [] posts: [] guidelines: [] post_id: "3348" source_id: aardvarklabs-blog source_name: Aardvark Labs url: https://aardvarklabs.blog/2026/04/10/step-by-step-guide-to-secure-business-central-agent-implementations-in-al/ published_at: "2026-04-10T12:00:00.000Z" author: Marcel Chabot full_text: false words: 1856 quotes: - text: We have to assume that if the Agent can do something the agent will do that thing. It is like Murphy's Law. why_it_matters: Justifies implementing least-privilege security design where agents get only minimum necessary permissions - text: Even with all this effort, you must still test your agents. Can they be tricked into misbehaving? Can it access out of scope data? why_it_matters: Emphasizes that security implementation must be verified through comprehensive testing to catch vulnerabilities code_objects_mentioned: - codeunit ARD_CashFlowAgentSetup - codeunit ARD_CashFlowAgentMetadata - codeunit ARD_CashFlowAgentKPILogging - codeunit ARD_CashFlowAgentFactory - page ARD_CashFlowAgentRoleCenter - page ARD_Cash Flow Agent Setup - page ARD_Cash Flow Agent KPI - page Customer List - page Vendor List - page Employee Ledger Entries - table ARD_CashFlowAgentKPI - table ARD_CashflowAgentSetup - table Customer - table Vendor - table Employee Ledger Entry - permissionset ARD_CashFlowAgent systems: - copilot - administration - development versions_mentioned: [] preview: embeddable: true frame_url: https://aardvarklabs.blog/2026/04/10/step-by-step-guide-to-secure-business-central-agent-implementations-in-al/embed/ image: https://aardvarklabs.blog/wp-content/uploads/2026/03/aardvark-labs-69cc8a13da8fe.png image_alt: Humanoid robot in a suit reviewing a folder labeled CONFIDENTIAL in an office. image_w: 1024 image_h: 1024 site_name: Aardvark Labs favicon: https://aardvarklabs.blog/wp-content/uploads/2024/04/design-1.png?w=32 probed_at: "2026-10-07T11:50:47.473Z" --- # Step-by-Step Guide to Secure Business Central Agent Implementations in AL [Read the post](https://aardvarklabs.blog/2026/04/10/step-by-step-guide-to-secure-business-central-agent-implementations-in-al/) · Aardvark Labs (Marcel Chabot) · 2026-04-10 · 1856 words · tier community · reviewed (checked by Opus) > This post demonstrates how to secure AI agents in Business Central by implementing restrictive profiles, page customizations, and permission sets. It shows the security risks of overly permissive agent configurations and provides step-by-step AL code examples to limit what agents can see and do. ## Key points - Agents navigate pages like users do, so they should be restricted with profiles and permissions and trusted as little as possible - The first version gave the agent the Business Manager profile plus several broad D365 permission sets, far more access than its task needed - Page customizations that clear the layout and actions, a custom role center, and a profile limit which pages and fields the agent can see - A custom permission set gives read-only access to Customer, Vendor and Employee Ledger Entry data and execute rights on the needed objects, and the setup codeunit now assigns this permission set and profile - Agents still need testing to check they cannot be tricked into reading out-of-scope data or changing records ## Quotes - "We have to assume that if the Agent can do something the agent will do that thing. It is like Murphy's Law." (Justifies implementing least-privilege security design where agents get only minimum necessary permissions) - "Even with all this effort, you must still test your agents. Can they be tricked into misbehaving? Can it access out of scope data?" (Emphasizes that security implementation must be verified through comprehensive testing to catch vulnerabilities) ## AL objects mentioned As named in the post. A name that matches one object page by exact type and name links to it; the others stay as named. - codeunit "ARD_CashFlowAgentSetup" - codeunit "ARD_CashFlowAgentMetadata" - codeunit "ARD_CashFlowAgentKPILogging" - codeunit "ARD_CashFlowAgentFactory" - page "ARD_CashFlowAgentRoleCenter" - page "ARD_Cash Flow Agent Setup" - page "ARD_Cash Flow Agent KPI" - [page 22 "Customer List"](../../objects/page/22.md) - [page 27 "Vendor List"](../../objects/page/27.md) - [page 5237 "Employee Ledger Entries"](../../objects/page/5237.md) - table "ARD_CashFlowAgentKPI" - table "ARD_CashflowAgentSetup" - [table 18 "Customer"](../../objects/table/18.md) - [table 23 "Vendor"](../../objects/table/23.md) - [table 5222 "Employee Ledger Entry"](../../objects/table/5222.md) - permissionset "ARD_CashFlowAgent" Not found in BC28-30: codeunit "ARD_CashFlowAgentSetup", codeunit "ARD_CashFlowAgentMetadata", codeunit "ARD_CashFlowAgentKPILogging", codeunit "ARD_CashFlowAgentFactory", page "ARD_CashFlowAgentRoleCenter", page "ARD_Cash Flow Agent Setup", page "ARD_Cash Flow Agent KPI", table "ARD_CashFlowAgentKPI", table "ARD_CashflowAgentSetup", permissionset "ARD_CashFlowAgent". ## Context - Features: agent permissions, profile restrictions, page customizations, role centers, permission sets, data access scoping, least privilege access Source: Aardvark Labs, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.