{
  "id": "d365-live-security-role-guard",
  "name": "D365 Live Security Role Guard",
  "type": "skill",
  "provider": "microsoft",
  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
  "summary": "Live read-only Dataverse security posture discovery — security roles, team/BU assignments, application users, System Administrator spread, SoD-relevant privilege combinations — with least-privilege role design proposals and rollback plan. Phase A read-only-runtime. Data-plane only via custom read-only security role; never the Power Platform management SPN path.",
  "source_type": "original",
  "official_docs": [
    "https://learn.microsoft.com/power-apps/developer/data-platform/use-multi-tenant-server-server-authentication",
    "https://learn.microsoft.com/power-platform/admin/database-security",
    "https://learn.microsoft.com/power-apps/developer/data-platform/build-web-applications-server-server-s2s-authentication",
    "https://learn.microsoft.com/power-platform/admin/powerplatform-api-create-service-principal",
    "https://learn.microsoft.com/azure/azure-sovereign-clouds/public/access-controls-dataverse-power-platform"
  ],
  "security_notes": "Operates on the Dataverse data plane via a custom read-only security role. System Administrator and System Customizer are explicitly denied. The Power Platform management SPN path is explicitly forbidden (cannot be least-privileged). Phase A only — no mutation.",
  "last_verified": "2026-06-17",
  "path": "skills/microsoft/d365-live-security-role-guard",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0",
  "companion_agents": ["d365-live-security-role-guard-agent"]
}