---
id: video/i0gBrA1tx50
type: video
title: "What’s new: ALGraph (2026 release wave 2)"
summary: AL Graph, a tool in the AL tools package that builds call graphs of AL code, is shown in a 2026 release wave 2 video. It covers querying callers, exporting to DGML and SARIF, and auditing the non-debuggable to debuggable boundary for security.
tier: official
language: en
tags:
  - al graph
  - call graphs
  - code auditing
  - security analysis
  - debuggable boundaries
  - query language
  - dgml format
  - sarif format
  - dependencies
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-07T22:44:21.493Z"
  flags: []
generated:
  at: "2026-10-09T00:29:02.995Z"
  pipeline: 0.2.0
  prompts:
    extract-video: 1
    summarize-video: 2
  input_hash: 97abb025ad56814a3ef949ffa8ba369b6e20590c5661959c7a01c4916de8e117
evidence:
  - kind: video
    url: https://www.youtube.com/watch?v=i0gBrA1tx50&t=30s
    title: "What’s new: ALGraph (2026 release wave 2)"
    date: "2026-10-01T00:00:00Z"
    commit: null
    t: 30
    quote: it is a tool that is focused around constructing call graphs. Um, so if you've ever wanted to know, like, you know, the structure
  - kind: video
    url: https://www.youtube.com/watch?v=i0gBrA1tx50&t=58s
    title: "What’s new: ALGraph (2026 release wave 2)"
    date: "2026-10-01T00:00:00Z"
    commit: null
    t: 58
    quote: It basically allows you to do auditing of your code base. So, for example, if you've ever wanted to know where in your code
  - kind: video
    url: https://www.youtube.com/watch?v=i0gBrA1tx50&t=70s
    title: "What’s new: ALGraph (2026 release wave 2)"
    date: "2026-10-01T00:00:00Z"
    commit: null
    t: 70
    quote: if you want to do security auditing, one big one um, that we're quite focused on is the non-debuggable to debuggable boundary. Um, because,
  - kind: video
    url: https://www.youtube.com/watch?v=i0gBrA1tx50&t=98s
    title: "What’s new: ALGraph (2026 release wave 2)"
    date: "2026-10-01T00:00:00Z"
    commit: null
    t: 98
    quote: you can actually uh, construct fairly complex queries. So, if you have your own sensitive objects, for example, you can say, Okay, give me
  - kind: video
    url: https://www.youtube.com/watch?v=i0gBrA1tx50&t=150s
    title: "What’s new: ALGraph (2026 release wave 2)"
    date: "2026-10-01T00:00:00Z"
    commit: null
    t: 150
    quote: this is a one-time thing. It's basically building the representation of the different uh caller-callee relationships in your app.
  - kind: video
    url: https://www.youtube.com/watch?v=i0gBrA1tx50&t=264s
    title: "What’s new: ALGraph (2026 release wave 2)"
    date: "2026-10-01T00:00:00Z"
    commit: null
    t: 264
    quote: this query language that all the different operations you can do this is all well documented on our um MS Learn website.
links:
  learn: []
  objects: []
  features:
    - feature/573336
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
video_id: i0gBrA1tx50
channel: yt-microsoft
source_name: Microsoft Dynamics 365 Business Central (YouTube)
url: https://www.youtube.com/watch?v=i0gBrA1tx50
published_at: "2026-10-01T00:00:00Z"
duration_s: 391
captions: full
audience:
  - developer
  - administrator
  - partner
chapters:
  - t: 0
    title: Introduction to AL Graph
  - t: 45
    title: "Use cases: code auditing and security"
  - t: 84
    title: Query language and export formats
  - t: 139
    title: Building the meta model
  - t: 184
    title: Querying HTTP client callers
  - t: 253
    title: Auditing non-debuggable to debuggable boundaries
  - t: 348
    title: Security implications and closing
features:
  - name: AL Graph
    status: ga
    t: 5
    verified: false
    status_source: roadmap
    roadmap_ids:
      - "573336"
  - name: AL Graph query language
    status: ga
    t: 98
    verified: false
    status_source: roadmap
    roadmap_ids:
      - "573336"
  - name: AL Graph DGML export
    status: ga
    t: 116
    verified: false
    status_source: roadmap
    roadmap_ids:
      - "573336"
  - name: AL Graph SARIF export
    status: ga
    t: 116
    verified: false
    status_source: roadmap
    roadmap_ids:
      - "573336"
  - name: AL Graph meta model extraction
    status: ga
    t: 139
    verified: false
    status_source: roadmap
    roadmap_ids:
      - "573336"
  - name: HTTP client caller auditing
    status: ga
    t: 184
    verified: false
    status_source: roadmap
    roadmap_ids:
      - "573336"
  - name: Non-debuggable to debuggable boundary audit
    status: ga
    t: 253
    verified: false
    status_source: roadmap
    roadmap_ids:
      - "573336"
objects_mentioned:
  - other HTTP client
quotes:
  - t: 30
    text: it is a tool that is focused around constructing call graphs. Um, so if you've ever wanted to know, like, you know, the structure
    check: exact
  - t: 58
    text: It basically allows you to do auditing of your code base. So, for example, if you've ever wanted to know where in your code
    check: exact
  - t: 70
    text: if you want to do security auditing, one big one um, that we're quite focused on is the non-debuggable to debuggable boundary. Um, because,
    check: exact
  - t: 98
    text: you can actually uh, construct fairly complex queries. So, if you have your own sensitive objects, for example, you can say, Okay, give me
    check: exact
  - t: 150
    text: this is a one-time thing. It's basically building the representation of the different uh caller-callee relationships in your app.
    check: exact
  - t: 264
    text: this query language that all the different operations you can do this is all well documented on our um MS Learn website.
    check: exact
---

# What’s new: ALGraph (2026 release wave 2)

> AL Graph, a tool in the AL tools package that builds call graphs of AL code, is shown in a 2026 release wave 2 video. It covers querying callers, exporting to DGML and SARIF, and auditing the non-debuggable to debuggable boundary for security.

[Watch on YouTube](https://www.youtube.com/watch?v=i0gBrA1tx50) · Microsoft Dynamics 365 Business Central (YouTube) · 2026-10-01 · 6:31 · tier official · reviewed (checked by Opus)

## Overview

The video introduces AL Graph, a tool in the AL tools package that constructs call graphs. These graphs show caller-callee relationships, external integration points and dependencies, and can be used for code auditing and security analysis.

The demo builds a meta model of an app once, stores it as JSON and queries it repeatedly. It then runs two audits: finding all callers of the HTTP client and tracing call paths that reach HTTP requests, and finding callees of non-debuggable methods to see where debugging could expose secrets. Query syntax is documented on MS Learn.

## Key points

- AL Graph builds call graphs to show caller-callee relationships, external integration points, dependencies and possible security issues.
- The meta model is built once with the 'extract whole' method, stored as JSON and then queried many times.
- The query language can build complex queries, such as callers of an object, methods that interact with tables, or paths from your own sensitive objects. Syntax is documented on MS Learn.
- Query results can be exported as DGML for human analysis of call relationships, or as SARIF, which is flat and meant to be easy for agents to consume.
- An HTTP client caller query lists all callers and the call paths that can reach HTTP requests, which helps audit external integrations.
- The non-debuggable to debuggable boundary audit finds callees of non-debuggable methods. A breakpoint in a debuggable method reached from non-debuggable code can leak secrets.

## Chapters

- [0:00](https://www.youtube.com/watch?v=i0gBrA1tx50&t=0s) Introduction to AL Graph
- [0:45](https://www.youtube.com/watch?v=i0gBrA1tx50&t=45s) Use cases: code auditing and security
- [1:24](https://www.youtube.com/watch?v=i0gBrA1tx50&t=84s) Query language and export formats
- [2:19](https://www.youtube.com/watch?v=i0gBrA1tx50&t=139s) Building the meta model
- [3:04](https://www.youtube.com/watch?v=i0gBrA1tx50&t=184s) Querying HTTP client callers
- [4:13](https://www.youtube.com/watch?v=i0gBrA1tx50&t=253s) Auditing non-debuggable to debuggable boundaries
- [5:48](https://www.youtube.com/watch?v=i0gBrA1tx50&t=348s) Security implications and closing

## Features

| Feature | Status | At |
|---|---|---|
| AL Graph | generally available (roadmap [Audit AL app accessibility and debugging boundaries](../features/573336.md)), demoed | [0:05](https://www.youtube.com/watch?v=i0gBrA1tx50&t=5s) |
| AL Graph query language | generally available (roadmap [Audit AL app accessibility and debugging boundaries](../features/573336.md)), demoed | [1:38](https://www.youtube.com/watch?v=i0gBrA1tx50&t=98s) |
| AL Graph DGML export | generally available (roadmap [Audit AL app accessibility and debugging boundaries](../features/573336.md)), demoed | [1:56](https://www.youtube.com/watch?v=i0gBrA1tx50&t=116s) |
| AL Graph SARIF export | generally available (roadmap [Audit AL app accessibility and debugging boundaries](../features/573336.md)) | [1:56](https://www.youtube.com/watch?v=i0gBrA1tx50&t=116s) |
| AL Graph meta model extraction | generally available (roadmap [Audit AL app accessibility and debugging boundaries](../features/573336.md)), demoed | [2:19](https://www.youtube.com/watch?v=i0gBrA1tx50&t=139s) |
| HTTP client caller auditing | generally available (roadmap [Audit AL app accessibility and debugging boundaries](../features/573336.md)), demoed | [3:04](https://www.youtube.com/watch?v=i0gBrA1tx50&t=184s) |
| Non-debuggable to debuggable boundary audit | generally available (roadmap [Audit AL app accessibility and debugging boundaries](../features/573336.md)), demoed | [4:13](https://www.youtube.com/watch?v=i0gBrA1tx50&t=253s) |

A status with a roadmap link comes from the Microsoft 365 roadmap feature this part of the video covers (matched by Haiku; links Opus dropped are not used); other statuses need a status word in the video itself.

## AL objects mentioned

As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.

- other "HTTP client" at [3:26](https://www.youtube.com/watch?v=i0gBrA1tx50&t=206s)

## Quotes

- [0:30](https://www.youtube.com/watch?v=i0gBrA1tx50&t=30s) "it is a tool that is focused around constructing call graphs. Um, so if you've ever wanted to know, like, you know, the structure"
- [0:58](https://www.youtube.com/watch?v=i0gBrA1tx50&t=58s) "It basically allows you to do auditing of your code base. So, for example, if you've ever wanted to know where in your code"
- [1:10](https://www.youtube.com/watch?v=i0gBrA1tx50&t=70s) "if you want to do security auditing, one big one um, that we're quite focused on is the non-debuggable to debuggable boundary. Um, because,"
- [1:38](https://www.youtube.com/watch?v=i0gBrA1tx50&t=98s) "you can actually uh, construct fairly complex queries. So, if you have your own sensitive objects, for example, you can say, Okay, give me"
- [2:30](https://www.youtube.com/watch?v=i0gBrA1tx50&t=150s) "this is a one-time thing. It's basically building the representation of the different uh caller-callee relationships in your app."
- [4:24](https://www.youtube.com/watch?v=i0gBrA1tx50&t=264s) "this query language that all the different operations you can do this is all well documented on our um MS Learn website."

Presenters (as heard): Thaddeus.