Business Central Permission Sets & Security in AL: Practical Guide
Security in Business Central is built around users, permission sets and controlled access to application objects and data. This guide explains the core concepts developers should understand when designing and testing AL extensions.
1. Why permissions matter
An AL extension can compile correctly and still fail at runtime if the user does not have the required permissions. Security therefore needs to be considered alongside application design.
2. Permission set basics
A permission set groups permissions that determine what a user can do with application objects and data. Access should be granted according to the user's actual responsibilities.
3. Typical permission types
| Permission | Purpose |
|---|---|
| Read | Read data or object content |
| Insert | Create records |
| Modify | Change records |
| Delete | Remove records |
| Execute | Run executable application objects where applicable |
4. Permission set extensions
When building an extension, a permission set extension can be used to add the permissions required by the extension to an existing permission set design.
Use the exact permission-set name and syntax supported by the Business Central version targeted by your project.
5. Least privilege
Grant only the access required for the business task. Avoid treating broad permissions as a shortcut for diagnosing every authorization problem.
6. Development vs production testing
- Test with a user that represents the real role.
- Verify positive access scenarios.
- Verify that restricted actions are actually blocked.
- Document why an extension requires each important permission.
7. Common permission errors
Authorization failures can come from missing table data permissions, missing object permissions, or a mismatch between the user's assigned permission sets and the operation being performed.
8. Security checklist for AL developers
- Review required permissions before deployment.
- Use least privilege.
- Test with realistic user roles.
- Do not expose sensitive configuration unnecessarily.
- Separate application functionality from authorization assumptions.
9. Interview questions
- What is a permission set?
- What is a permission set extension?
- What does least privilege mean?
- How would you troubleshoot a permission error?
- Why should developers test with non-admin users?
Conclusion
Understanding Business Central security helps developers build extensions that work correctly for the intended users without unnecessarily broad access.