Prove a transferred employee lost the old branch view
Format: Company perspective.
A new branch role is not proof that an old branch permission disappeared.
Microsoft says Dataverse users get the access rights of each role assigned to them. The rights add up. [S06] That is how this platform works, not a claim about every system. Test the move. Do not trust a new role label alone.
Hypothetical example: an employee moves from Pine to Lake. The person in charge of access approves the Lake role. They say to remove Pine access too. A coordinator sees Lake in the profile and marks the move done. No one has checked the Pine role yet.
Use an authorized test card:
| Test | Expected evidence |
|---|---|
| Allowed access | The employee can open an approved Lake test record needed for the new role |
| Blocked view | The employee cannot open a restricted Pine test record in the normal view or through a known direct link |
| Blocked export | Approved test export paths leave out restricted Pine records |
| Shared-role check | Any retained central access has an explicit business owner and scope |
| Read-back | Access owner records effective roles, test time, results, and unresolved exceptions |
Use test records you may use and an approved test account or supervised session. Do not browse unrelated staff data. Add any relevant old session to the agreed test plan. A fresh login alone does not test an old session.
If a test shows a record that should be blocked, keep the review open. The access owner must check the gap. A pass proves only what was tested. It is not a security certificate or proof that every access path is safe.
Core Agentic can discuss a custom checklist for access changes in your shared system. Book a Demo to discuss testing what a transferred employee can and cannot see.
Sources
These sources describe the named provider or framework. They do not establish a Core Agentic integration, customer result or certification.