Permissions

This page explains the permission model in Erik's ToolBox, including the Business Central SUPER role requirement for administrator functions and the ToolBox-specific user management system with its three access levels.

Permission Model Overview

Erik's ToolBox uses a two-layer permission model:

Business Central permissions - The standard Business Central SUPER permission set controls access to administrative ToolBox pages.
ToolBox user access levels - A built-in user management system within the ToolBox controls what individual users can do when running scripts and working with data.

Both layers work together. A user must satisfy the Business Central permission requirements to access certain pages, and their ToolBox access level determines what operations they can perform within those pages.

Business Central SUPER Role Requirement

Several ToolBox pages require the SUPER permission set in Business Central. The following table lists the pages and their requirements:

Page	SUPER Required	Notes
Erik's ToolBox (main menu)	Partial	The page opens for all users, but most menu items are enabled only for SUPER users
Interactive Code	Yes	Requires SUPER to access
Batch Processing	Yes	Requires SUPER to access
Object Inspector	Yes	Requires SUPER to access
Remote Packages	Yes	Requires SUPER to access
Data in GitHub	Yes	Requires SUPER to access
ToolBox Setup	Yes	An error is shown if a non-SUPER user tries to open it
Run Programs	No	Available to all users, but filtered based on assigned permission sets

The SUPER requirement ensures that powerful data manipulation tools are restricted to administrators. The ToolBox verifies this by checking the Access Control table for a record where the user's security ID has the Role ID set to SUPER.

How the Run Programs Page Works Without SUPER

The Run Programs page is the exception to the SUPER requirement. It is designed to allow non-administrator users to execute pre-built scripts. When a non-SUPER user opens the Run Programs page:

The system reads the user's assigned Business Central permission sets from the Access Control table.
The program list is filtered to only show programs where the PublicPermissionSet field matches one of the user's assigned permission sets.
The program must also have the AvailableForPublicUsage flag enabled.
This means administrators can selectively assign scripts to users based on their existing Business Central permission sets.

ToolBox User Management

In addition to the Business Central permission layer, the ToolBox has its own user management system. This system controls what operations a user can perform when running scripts, particularly around data modification.

Access Levels

The ToolBox defines three access levels:

Access Level	Internal Value	Description
ReadOnly	0	The user can view data and run scripts that only read data. No insert, modify, or delete operations are allowed.
WriteNormalTables	1	The user can read and write to standard Business Central tables. Protected system tables remain read-only.
GodMode	2	Full access to all tables, including protected and system tables. Can also manage other ToolBox users.

Access Level Details

ReadOnly

You can run scripts that query data and produce output.
Any attempt to insert, modify, or delete records will result in an error.
This is the default level assigned to new users when they are added to the ToolBox.
Suitable for users who need to run reports or data queries without the risk of accidental changes.

WriteNormalTables

Includes all ReadOnly capabilities.
You can run scripts that insert, modify, or delete records in standard tables.
You cannot modify protected system tables.
This is the level automatically assigned when a user accesses the Run Programs page and is not found in the ToolBox user list.
Suitable for power users who need to run data processing scripts.

GodMode

Includes all WriteNormalTables capabilities.
You can read from and write to any table in the system, including protected and system tables.
You can add, modify, and remove other users from the ToolBox user list.
All GodMode operations on protected tables are logged in the audit trail.
When a GodMode user modifies a protected table for the first time in a session, a warning confirmation is shown.
Suitable for system administrators who need unrestricted access.

First User Initialization

When the ToolBox Users page is opened for the first time, the system automatically creates the first user entry:

The system checks if the ToolBox user table (ToolBox Users) is empty.
If the table is empty, the current user is automatically added with the GodMode access level.
This ensures that the first administrator always has full control over user management.

This initialization happens in the OnOpenPage trigger of the ToolBox Users page. After the first user is created, all subsequent users must be added manually by a GodMode user.

The ToolBox Users Page

The ToolBox Users page is where you manage ToolBox users and their access levels. To access it:

Open the ToolBox Setup page.
Choose the Users action in the action bar.

Page Layout

The user list displays the following columns:

Column	Description
Login ID	The Business Central user name (populated automatically from the User table)
Name	The user's full name (populated automatically from the User table)
Access Level	The assigned access level: Read Only, Write in normal tables, or GodMode
Audit Trail	A count of audit trail entries for this user (click to view details)

Adding a New User

On the ToolBox Users page, choose the Add User action.
You must have GodMode access to add users. If you do not, the error "You do not have permission to add users" is shown.
A lookup page showing all Business Central users appears.
Select the user you want to add and choose OK.
The user is added with the ReadOnly access level by default.
Change the Access Level field to the desired level.

Modifying a User's Access Level

On the ToolBox Users page, locate the user in the list.
Change the Access Level field to the desired value.
Only GodMode users can modify other users' access levels. If you attempt to modify a user without GodMode access, the error "You do not have permission to modify users" is shown.

Deleting a User

Select the user in the list and press Delete or use the standard delete action.
Only GodMode users can delete other users. If you attempt to delete without GodMode access, the error "You do not have permission to delete users" is shown.
Deleting a user from the ToolBox user list does not affect their Business Central user account.

Restoring GodMode Warnings

The ToolBox Users page includes a Restore GodMode warnings action. When a GodMode user accesses a protected table, a warning dialog appears the first time for each table. After acknowledging the warning, it does not appear again during the session. Use this action to reset the warnings for all tables, so they appear again on the next access.

How Access Level Affects Script Execution

When a script is executed, the ToolBox checks the current user's access level and enforces restrictions accordingly:

Operation	ReadOnly	WriteNormalTables	GodMode
Read records (FindFirst, FindSet, Get, etc.)	Allowed	Allowed	Allowed
Insert records in normal tables	Blocked	Allowed	Allowed
Modify records in normal tables	Blocked	Allowed	Allowed
Delete records in normal tables	Blocked	Allowed	Allowed
Insert/Modify/Delete in protected tables	Blocked	Blocked	Allowed
Manage ToolBox users	Blocked	Blocked	Allowed

Unregistered License Behavior

If the ToolBox is not registered (no valid license) and the environment is not a SaaS sandbox, the access level is automatically downgraded to ReadOnly regardless of the user's configured level. This means:

In a SaaS sandbox, the configured access level is always honored.
In a production or on-premises environment without a license, all users are restricted to read-only access.

Permission Checks by Feature

The following table summarizes where permission checks occur across the ToolBox features:

Feature	Check Type	Requirement
ToolBox main page	Business Central	Menu items enabled only for SUPER users (except Run Programs)
Interactive Code	Business Central	SUPER required to open
Batch Processing	Business Central	SUPER required to open
Object Inspector	Business Central	SUPER required to open
Remote Packages	Business Central	SUPER required to open
Data in GitHub	Business Central	SUPER required to open
ToolBox Setup	Business Central	SUPER required; error on open if not SUPER
Run Programs	Hybrid	Open for all; program list filtered by permission set; access level checked on execution
Script execution	ToolBox access level	Checked when script attempts data modifications
User management	ToolBox access level	GodMode required for add/modify/delete

Data Storage and Scope

The ToolBox user table (ToolBox Users) has the property DataPerCompany = false. This means:

User records are shared across all companies in the same environment.
You only need to set up users once per environment, not once per company.
A user with GodMode access in one company has GodMode access in all companies within that environment.

Tips and Best Practices

Keep the number of GodMode users to a minimum. Only system administrators who need to modify protected tables or manage users should have GodMode access.
Use the ReadOnly access level for users who only need to run queries and generate reports.
Review the audit trail regularly to monitor GodMode operations on protected tables.
When setting up a new environment, the first user to open the ToolBox Users page is automatically granted GodMode. Plan accordingly to ensure this is the intended administrator.
Remember that the SUPER permission set in Business Central is separate from the ToolBox GodMode access level. A user can be SUPER in Business Central but ReadOnly in the ToolBox, and vice versa.
The Erik's ToolBox permission set includes the objects of the AL AI Services app (AI Providers, AI Conversations, and the agent panel), so ToolBox users can use the agents without an extra permission set. Because it also grants read access to the AI Provider table, which holds the provider access keys, assign it only to users who may know those keys. The programs and statements an agent runs use the user's own Business Central permissions and ToolBox access level.