{
  "id": "d365-live-record-field-update-guard-agent",
  "name": "D365 Live Record Field Update Guard",
  "type": "agent",
  "provider": "microsoft",
  "harnesses": [
    "codex",
    "copilot",
    "claude-code",
    "cursor",
    "gemini",
    "kiro"
  ],
  "summary": "Mutating-runtime live-guard for updating named fields on a single Dataverse row identified by table + record GUID, via the Dataverse Web API PATCH (data plane). One record, named fields only. Requires explicit written human approval token referencing exact target, proposed change, and blast-radius. PREFLIGHT performs dry-run diff before any write. Fully reversible — prior field values captured; inverse PATCH is the rollback. Gate-only; never auto-dispatched. Phase B mutating-runtime.",
  "source_type": "original",
  "official_docs": [
    "https://learn.microsoft.com/power-apps/developer/data-platform/webapi/update-delete-entities-using-web-api",
    "https://learn.microsoft.com/power-apps/developer/data-platform/column-level-security",
    "https://learn.microsoft.com/power-apps/developer/data-platform/use-multi-tenant-server-server-authentication",
    "https://learn.microsoft.com/power-platform/admin/database-security",
    "https://learn.microsoft.com/power-apps/developer/data-platform/reference/entities/fieldsecurityprofile"
  ],
  "security_notes": "Mutating-runtime Phase B. Custom least-privilege write role with Write (prvWrite) on the one in-scope table only. System Administrator, System Customizer, Delete, bulk, wildcard, ownership changes, security-role/privilege edits, and Power Platform management SPN path are all explicitly denied. Requires written human approval token referencing exact target + proposed change + blast-radius. PREFLIGHT dry-run diff required before any write. Prior field values captured for ROLLBACK inverse PATCH. Output signed with idempotency key and audit-logged.",
  "last_verified": "2026-06-17",
  "path": "agents/microsoft/d365-live-record-field-update-guard-agent",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0",
  "execution_tier": "mutating-runtime",
  "oauth_scopes": [],
  "run_as_permissions": {
    "required": [
      "Custom Dataverse security role with Write (prvWrite) on ONLY the one in-scope table — record-level/owner-scoped where supported",
      "Read (prvRead) on the same table to capture prior field values for ROLLBACK",
      "Application user (SystemUser row) in the target Dataverse environment bound to the custom least-privilege write role — NOT System Administrator, NOT System Customizer",
      "Dataverse data-plane access via S2S application user (ApplicationId/AzureActiveDirectoryObjectId on SystemUser)"
    ],
    "denied": [
      "System Administrator",
      "System Customizer",
      "Delete privilege on any table (prvDelete)",
      "Bulk/multi-record write operations (any query targeting more than one record ID)",
      "Wildcard or all-records operations",
      "Ownership change operations (ownerid field reassignment)",
      "Security role or privilege edits (no write on role, roleprivileges, systemuserroles, teamroles)",
      "prvActOnBehalfOfAnotherUser",
      "Power Platform management SPN path (pac admin create-service-principal — cannot be least-privileged)",
      "Write on any table other than the single in-scope table"
    ]
  },
  "requires_credentials": ["DATAVERSE_CLIENT_ID", "DATAVERSE_ENV_URL"],
  "required_egress": ["*.dynamics.com", "login.microsoftonline.com"],
  "companion_skills": ["d365-live-record-field-update-guard"],
  "harness_variants": {
    "codex": "agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/codex.toml",
    "claude-code": "agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/claude-code.agent.md",
    "copilot": "agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/copilot.agent.md",
    "cursor": "agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/cursor.agent.md",
    "gemini": "agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/gemini.agent.md",
    "kiro-ide": "agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/kiro-ide.agent.md",
    "kiro-cli": "agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/kiro-cli.agent.json"
  }
}