Step-by-Step Guide to Secure Business Central Agent Implementations in AL
This post demonstrates how to secure AI agents in Business Central by implementing restrictive profiles, page customizations, and permission sets. It shows the security risks of overly permissive agent configurations and provides step-by-step AL code examples to limit what agents can see and do.
post Aardvark Labs
"We have to assume that if the Agent can do something the agent will do that thing. It is like Murphy's Law."
Key points
- Agents navigate pages like users do, so they should be restricted with profiles and permissions and trusted as little as possible
- The first version gave the agent the Business Manager profile plus several broad D365 permission sets, far more access than its task needed
- Page customizations that clear the layout and actions, a custom role center, and a profile limit which pages and fields the agent can see
- A custom permission set gives read-only access to Customer, Vendor and Employee Ledger Entry data and execute rights on the needed objects, and the setup codeunit now assigns this permission set and profile
- Agents still need testing to check they cannot be tricked into reading out-of-scope data or changing records
Quotes
- “We have to assume that if the Agent can do something the agent will do that thing. It is like Murphy’s Law.” (Justifies implementing least-privilege security design where agents get only minimum necessary permissions)
- “Even with all this effort, you must still test your agents. Can they be tricked into misbehaving? Can it access out of scope data?” (Emphasizes that security implementation must be verified through comprehensive testing to catch vulnerabilities)
AL objects mentioned
As named in the post. A name that matches one object page by exact type and name links to it; the others stay as named.
- codeunit “ARD_CashFlowAgentSetup”
- codeunit “ARD_CashFlowAgentMetadata”
- codeunit “ARD_CashFlowAgentKPILogging”
- codeunit “ARD_CashFlowAgentFactory”
- page “ARD_CashFlowAgentRoleCenter”
- page “ARD_Cash Flow Agent Setup”
- page “ARD_Cash Flow Agent KPI”
- page 22 “Customer List”
- page 27 “Vendor List”
- page 5237 “Employee Ledger Entries”
- table “ARD_CashFlowAgentKPI”
- table “ARD_CashflowAgentSetup”
- table 18 “Customer”
- table 23 “Vendor”
- table 5222 “Employee Ledger Entry”
- permissionset “ARD_CashFlowAgent”
Not found in BC28-30: codeunit “ARD_CashFlowAgentSetup”, codeunit “ARD_CashFlowAgentMetadata”, codeunit “ARD_CashFlowAgentKPILogging”, codeunit “ARD_CashFlowAgentFactory”, page “ARD_CashFlowAgentRoleCenter”, page “ARD_Cash Flow Agent Setup”, page “ARD_Cash Flow Agent KPI”, table “ARD_CashFlowAgentKPI”, table “ARD_CashflowAgentSetup”, permissionset “ARD_CashFlowAgent”.
Context
- Features: agent permissions, profile restrictions, page customizations, role centers, permission sets, data access scoping, least privilege access
Source: Aardvark Labs, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.