Project / Delivered
Platform governance
A common and easily-missed gap: an application that enforces its access rules in its own interface, while sitting on a Dataverse backend where those same rules don't apply. Reach the data any other way – an Excel query, the API – and the app-layer permissions simply aren't in play. I came onto a third-party line-of-business application in exactly this state and rebuilt enforcement at the data layer, so access rules held regardless of how the data was reached.
- Status
- Delivered
- Group
- Client Work
- Stack
- Dataverse (Teams & security roles), Entra ID security groups, Power Apps (model-driven), Power Automate
- Repo
- Previous employer — private (Azure DevOps)
- Related writing
- Internal only (previous employer)
Architecture
- Moved enforcement from the app layer to the data layer. App-side rules can be bypassed by any other access path; Dataverse Team ownership and role assignments cannot. Mirrored the assignment logic onto Dataverse Teams so the same rules hold through Excel, the API, or anything else.
- Team-based ownership over individual owners. Records are owned by Teams, not users, so access is managed centrally and survives staff changes – one place to change, not per-record fixes.
- Automated the lifecycle, didn't just fix the snapshot. A flow provisions the matching Team when a new record is created, and a cleanup flow keeps new records on Team-based permissions rather than individual owners. The model stays correct without manual upkeep.
- Bulk migration by deliberate choice, not script. Stood up a throwaway "backend" model-driven app and used Dataverse's native Assign action to move existing records onto Teams – about 4 hours. Could have scripted it; chose the hands-on route so it doubled as a live check on the other mappings being built. Verification over raw speed.
Evidence
- Brought access enforcement down to the data layer, so rules held consistently rather than only inside the app.
- Self-maintaining model – new records are governed automatically via provisioning and cleanup flows.
- Existing estate migrated in ~4 hours, with the migration tool doubling as a mapping check.