InherentPermissions and permission sets in AL
Every time a user touches data, Business Central checks permissions. Two AL tools control this: permission sets, which you assign to users, and the InherentPermissions property on objects.
The permission letters
| Letter | Meaning |
|---|---|
R | Read |
I | Insert |
M | Modify |
D | Delete |
X | Execute |
Permission sets
A permissionset object groups permissions so you can assign them to users or user groups. Ship one with every extension that adds tables:
permissionset 50100 "ISSUE - EDIT"
{
Assignable = true;
Permissions =
tabledata Issue = RIMD,
table Issue = X,
page "Issue List" = X;
}InherentPermissions
InherentPermissions is set on the object itself. It grants those permissions whenever the object is used, on top of whatever the user has.
table 50100 Issue
{
InherentPermissions = R;
}It grants only the letters you list. R means read. It doesn’t let users insert, modify or post.
There’s a matching InherentEntitlements property for licensing entitlements.
When to use which
- Permission set: the normal way to give users access to your feature.
- InherentPermissions: narrow cases where an object must always have a specific kind of access, for example a setup table that every page reads.
Exam traps
Read the letters carefully. If the scenario needs posting, inserting or deleting,
Ralone never solves it.
Learn more: InherentPermissions property and Permission set object.
Practice questions
Pick an answer to check it. Questions are original and written for practice.
1. Which letters can you use in the InherentPermissions property?
Show answer
Answer: A.Permissions are written as letters. R read, I insert, M modify, D delete, and X execute.
2. You set InherentPermissions = R on a table. Users also need to post documents that insert and modify records in it. Is this enough?
Show answer
Answer: B.Inherent permissions grant exactly the letters you list. Posting needs insert and modify as well, so R alone isn't enough.
3. Your extension adds new tables, and users need access to them. Following least privilege, what should you ship with the extension?
Show answer
Answer: B.The standard approach is a dedicated permission set with the minimum rights. InherentPermissions is for narrow cases where an object must always have specific access.