Lattice Security Model

Overview

The Lattice package implements a complete role-based access control (RBAC) security model following the standard Dynamics 365 Finance & Operations security hierarchy:

Role > Duty > Privilege > Entry Point

The package ships with the following security artifacts:

Artifact Type	Count (model total)	Detailed in this document
Security Roles	4	4
Security Duties	21	16
Security Privileges	291	62
Service Operation Entry Points	182 operations across 30 services	127*
Entry points granted by privileges (service operations and menu items)	309	-
Data Entity Permissions	276 (entity grants across all privileges)	69 (3 monitoring entities; 66 cross-reference entity grants)

All custom service operations require the Invoke permission on their respective ServiceOperation entry points. Data entity access requires the Read permission (and Create, Update or Delete for writes) granted on the entity itself. That one grant also covers OData access; there is no separate adaptor permission.

Scope and currency notes:

• Roles: four predefined roles ship - MGCLatticeIntegrationAdministratorRole (full access), MGCLatticeIntegrationOperatorRole (posting + queries + monitoring, no high-risk operations), MGCLatticeIntegrationReadOnlyRole (queries + monitoring only), and MGCLatticeDatabaseAccessAdministrator (high-risk, unassigned by default). See Security Role, Additional Predefined Roles, and Database Access Administrator below.
• Duties: the seventeen duties detailed here are the integration service-operation duties, the four small duties that carry the batch and maintenance jobs, the per-operation logging setup, the file ingestion simulator, the inbound message inquiry, the dead-letter view without payloads, and the two cross-reference duties. Five further duties exist in the model: MGCLatticeDataEntitiesView and MGCLatticeDataEntitiesMaintain (the OData data-entity surface), MGCLatticeIntegrationOpsDuty (operations console), MGCLatticeSetupDuty (inbound-order policy, sales-origin dimensions, batch-event filters), and MGCLatticeDbAccessAdminDuty - the last of which is high-risk and documented in full below, not out of scope.
• Privileges: the sixty-two privileges tabled below are the service-operation, monitoring, file-ingest, metadata, status-query, test-console, statistics, and batch and maintenance privileges, the privileges of the logging-setup, simulator, inbound-inquiry and dead-letter view duties, and the sixteen cross-reference and external system privileges. The read-only module View privileges and high-risk carve-outs referenced by the duties are named in each duty section. The model contains 291 privileges in total; the data-entity View/Maintain privilege pairs that secure 112 of the data entities make up the bulk of the remainder and are not individually tabled here.
• Data entities are reachable through the shipped roles. MGCLatticeDataEntitiesView and MGCLatticeDataEntitiesMaintain secure 112 of the 149 Lattice data entities (the 33 cross-reference entities and the external system entity are secured by the two cross-reference duties, the file ingestion log and service call statistics entities by MGCLatticeIntegrationServiceMonitoringDuty, and the dead-letter entity by MGCLatticeIntegrationDeadLetterViewDuty without its payload fields and by the high-risk duty with them) and are granted to the shipped integration roles, so data entity access does not require composing a custom role. Every privilege and duty in the model is reached through the privilege→duty→role chain. Custom role composition remains supported.
  • No direct privileges: no role holds a privilege directly; every privilege reaches its roles through a duty. The batch and maintenance, logging-setup, simulator and inbound-inquiry privileges are carried by four duties (MGCLatticeBatchMaintenanceDuty, MGCLatticeServiceOperationLogConfigDuty, MGCLatticeFileIngestSimulatorDuty, MGCLatticeIntegrationInboundInquiryDuty).
  • Read vs write: CRUD grants match the writable set (103 writable entities: 102 full-CRUD grants, plus create, read and update on the recurring data job health entity, whose rows cannot be deleted). A further 24 privileges named *Maintain grant Read only by design: their target entity is IsReadOnly=Yes (posted transactions, ledger entries, settlements, trial balance).
  • Recurring data jobs: create, change and delete on the recurring data job and recurring data job client entities (MGCLatticeRecurringDataJobEntityMaintain, MGCLatticeRecurringDataJobClientEntityMaintain) are in the high-risk duty, so only the administrator role holds them. The job entity's Activate and Deactivate OData actions are granted by MGCLatticeRecurringDataJobEntityMaintain too. The recurring data job health thresholds and the health Refresh / RefreshAll actions (MGCLatticeRecurringJobHealthEntityMaintain) are in MGCLatticeDataEntitiesMaintain, and reading job health and messages (MGCLatticeRecurringJobHealthEntityView, MGCLatticeRecurringJobMessageEntityView) is in MGCLatticeDataEntitiesView.
  • Exports: MGCLatticeMigrationTemplateExportPrivilege (the data entity template, in MGCLatticeDataEntitiesView) and MGCLatticeWideEntityExcelExportPrivilege (the wide Excel export, in MGCLatticeDataEntitiesMaintain, so the operator and administrator roles) open the two export dialogs on the Data entities page. Both accept only data entities listed in Data management, and only when the user has read access to the entity in Data management, the same check Data management runs before an export.
• Read-only and supporting entities:
  • The administrator, operator and read-only roles can read seven read-only entities: the open sales and purchase order lines, the intercompany sales and purchase order lines, the service call log, async operation tracking and the service idempotency log.
  • MGCLatticeVendorDocumentAttachmentMaintain grants create, update and delete on the vendor document attachment entity to the administrator and operator roles.
  • The inbound order policy, sales origin dimension mapping, batch job event filter and APIM configurator privileges also grant create and delete, so the administrator can create and delete records on those pages.
  • The two workspace view privileges, MGCLatticeIntegrationOperationsView and MGCLatticeFileIngestOperationsView, list every part of their workspace. Each part also has its own entry point.
• Licensing interacts with this model. Lattice write operations also require a valid license and can return LicenseNotValid even when security permits the call. Security and licensing are independent gates: a correctly privileged caller can still be refused.
• Two services check more than their own privilege. MGCLatticeJournalPostingService posts a journal only for a caller who also holds the Lattice operation that posts that journal type (and, for a ledger journal, the operations its intercompany, fixed asset and project lines need), so it never widens what a role may post; see Journal posting: delegated rights. MGCLatticeExpenseReportService creates an expense report only for a worker the caller may file expenses for; see MGCLatticeExpenseReportService.
• * Service Operation Entry Points: this figure counts the nine module *ServiceMaintain privileges (mutating, non-high-risk operations). The read-only status queries (6 View privileges), the high-risk carve-outs (9 privileges, 20 operations), the Accounts receivable trade-agreement (3) and sales order capture (2) operations, the item cost calculation operations (2), the journal posting operations (10), the expense report operations (4), the DMF configuration operations (4), the DMF mapping operations (2) and the database access operations (2) are granted by separate privileges and are itemized in the Appendix. MGCLatticePriceInquiryService.resolveSalesPrice is granted by the read-only MGCLatticePriceInquiryServiceView privilege.

---

Security Role

MGCLatticeIntegrationAdministratorRole

Property	Value
AOT Name	MGCLatticeIntegrationAdministratorRole
Label	Integration administrator
Description	Full access to all Lattice custom integration service operations, monitoring, and metadata management.
Duties	19 (no privileges assigned directly)

This is the primary security role for the package. It grants full access to all mutating service operations across all modules, read-only status queries, the high-risk carve-out operations, all monitoring data entities, the service metadata explorer, the file ingestion framework, and APIM configuration.

Included Duties:

Duty	Purpose
MGCLatticeIntegrationServiceOperationsDuty	All mutating service operations across modules, plus DMF configuration capture and comparison and mapping validation (16 privileges)
MGCLatticeIntegrationServiceQueryDuty	Read-only status-query service operations, the sales price inquiry and the trade agreement entities (8 privileges)
MGCLatticeIntegrationServiceHighRiskDuty	High-risk operations carved out for segregation of duties, including maintaining recurring data jobs, refreshing data management field mappings and managing recurring integrations (16 privileges)
MGCLatticeIntegrationServiceMonitoringDuty	Monitoring pages, entities and metadata, including the integration operations workspace and recurring integration health (12 privileges)
MGCLatticeServiceMetadataExplorerDuty	Service metadata explorer and the service metadata refresh (2 privileges)
MGCLatticeFileIngestDuty	File ingestion maintenance, monitoring and the file ingestion operations workspace (3 privileges)
MGCLatticeApimConfiguratorDuty	Azure API Management configuration (1 privilege)
MGCLatticeDataEntitiesView	Read access to the Lattice data entities
MGCLatticeDataEntitiesMaintain	Create, update and delete on the writable Lattice data entities
MGCLatticeServiceTestConsoleDuty	Service test console (run operations in-process, save and replay requests)
MGCLatticeSetupDuty	Setup pages: inbound order policy, sales origin dimensions, batch job event filters
MGCLatticeODataEntityMetadataExplorerDuty	OData entity metadata explorer and its refresh
MGCLatticePostingPreviewDuty	Sales order and journal posting status queries
MGCLatticeIntegrationOpsDuty	Integration operations console access (the manage actions are in the high-risk duty)
MGCLatticeBatchMaintenanceDuty	Run and schedule the Lattice batch and maintenance jobs (15 privileges)
MGCLatticeServiceOperationLogConfigDuty	Per-operation service logging configuration (1 privilege)
MGCLatticeFileIngestSimulatorDuty	File ingestion simulator and sample payloads (1 privilege)
MGCLatticeIntegrationInboundInquiryDuty	Inbound message inquiry and payload download (1 privilege)
MGCLatticeCrossReferenceMaintainDuty	External systems setup and the cross-reference keys of every module: pages, FactBox and entities (8 privileges)

The role holds no privilege directly; each duty's section under Security Duties lists its privileges.

Note: This role carries every Lattice duty except MGCLatticeDbAccessAdminDuty, which is granted only by the high-risk MGCLatticeDatabaseAccessAdministrator role (below), MGCLatticeCrossReferenceViewDuty, whose read access MGCLatticeCrossReferenceMaintainDuty already includes, and MGCLatticeIntegrationDeadLetterViewDuty, which denies the payload fields the administrator reads through the high-risk duty. The jobs of MGCLatticeBatchMaintenanceDuty are on System administration > Periodic tasks under Lattice, Lattice data entities and Lattice business events.

Assignment guidance: Assign this role to service accounts (Microsoft Entra ID application registrations) that require full integration access, and to integration administrators who manage and monitor the integration platform. For restricted access scenarios, assign the narrower MGCLatticeIntegrationOperatorRole or MGCLatticeIntegrationReadOnlyRole (below), or create custom roles with specific duties or privileges as described in the Implementation Guide section below.

---

Additional Predefined Roles

Two further predefined roles implement a segregation-of-duties model alongside the administrator role. Neither includes the high-risk duty; both are intended for day-to-day operations and monitoring rather than administration.

A fourth role, MGCLatticeDatabaseAccessAdministrator, sits outside this progression entirely and is documented separately below - it is high-risk, unassigned by default, and grants database-level access that bypasses this security model.

MGCLatticeIntegrationOperatorRole

Property	Value
Label	Integration operator
Description	Standard integration operations: posting/mutating service operations plus read-only status queries and monitoring. Excludes high-risk operations (free text invoice cancellation, sales packing slip and product receipt cancellation, intercompany journal posting, journal and payment reversal, fixed asset disposal and transaction reversal, pending price activation), which are reserved for the administrator role.
Duties	MGCLatticeIntegrationServiceOperationsDuty, MGCLatticeIntegrationServiceQueryDuty, MGCLatticeIntegrationServiceMonitoringDuty, MGCLatticeDataEntitiesView, MGCLatticeDataEntitiesMaintain, MGCLatticePostingPreviewDuty, MGCLatticeFileIngestSimulatorDuty, MGCLatticeIntegrationInboundInquiryDuty, MGCLatticeCrossReferenceViewDuty, MGCLatticeIntegrationDeadLetterViewDuty
Direct privileges	None

MGCLatticeIntegrationReadOnlyRole

Property	Value
Label	Integration read-only
Description	Read-only access: status-query service operations plus monitoring of call logs, idempotency, async tracking, and service metadata. Cannot post or mutate any document.
Duties	MGCLatticeIntegrationServiceQueryDuty, MGCLatticeIntegrationServiceMonitoringDuty, MGCLatticeDataEntitiesView, MGCLatticeIntegrationInboundInquiryDuty, MGCLatticeCrossReferenceViewDuty, MGCLatticeIntegrationDeadLetterViewDuty
Direct privileges	None

Note: No predefined role holds a privilege directly, and every Lattice duty is held by at least one predefined role. The simulator and inbound-inquiry privileges reach these two roles through MGCLatticeFileIngestSimulatorDuty (operator) and MGCLatticeIntegrationInboundInquiryDuty (operator and read-only). MGCLatticePostingPreviewDuty is in the administrator and operator roles, MGCLatticeServiceTestConsoleDuty only in the administrator role, MGCLatticeSalesTradeAgreementServiceMaintain is in MGCLatticeIntegrationServiceOperationsDuty, and MGCLatticeServiceCallStatisticsView is in MGCLatticeIntegrationServiceMonitoringDuty.

MGCLatticeDatabaseAccessAdministrator - HIGH-RISK

Property	Value
AOT Name	MGCLatticeDatabaseAccessAdministrator
Label	Database access administrator
Duties	MGCLatticeDbAccessAdminDuty (single duty, deliberately segregated)
Privileges	via duty → MGCLatticeDbAccessAdminPrivilege
Assigned by default	No
Entry points	MGCLatticeDbAccessService (requestAccess, revokeAccess) in MGCLatticeDbAccessServiceGroup; the Database access grants page (MGCLatticeDbAccessGrantManager); the expiry sweep (MGCLatticeDbAccessExpiry)

This role ships in the product. Distribution of Lattice was ruled direct, not AppSource, so the just-in-time database access capability is not fenced out of the sellable package. It is documented here in full because buyers must understand what the role confers before granting it.

What it actually grants

A holder can call MGCLatticeDbAccessService.requestAccess over REST, or click Request access on the Database access grants page, and obtain db_owner on AxDB - full control of the application database. Concretely, a successful request:

1. Validates the caller and the supplied public IPv4 address.
2. Revokes every active grant the caller holds (one active grant per administrator). A grant that cannot be revoked at that moment stays active with its expiry moved to now, for the expiry sweep to revoke; it does not block the new grant.
3. Writes the new grant's audit row before its database user or firewall rule is created, so a failed or interrupted request leaves a row that the expiry sweep cleans up.
4. Creates a contained database user and adds it to the db_owner database role.
5. Opens a database firewall rule for the supplied IP address.
6. Stores the generated password on the audit row, encrypted with the platform encryption service.
7. Returns the generated password on the live response. The Database access grants page can show it again with Show password while the grant is active, to the person who requested the grant only; once the grant is past its expiry, Show password is refused.

Grant lifetime is clamped to 1-72 hours, defaulting to 24 when unspecified. MGCLatticeDbAccessExpiry is the batch that revokes grants at their deadline and marks them Expired. Each grant schedules a one-time run at its expiry, each run schedules the next one only while grants remain active, and no grant is issued unless the sweep is scheduled (see Recurring batch jobs). revokeAccess revokes all of the caller's active grants on demand, and Revoke on the page revokes the selected grant, including a grant another administrator requested. Revoking a grant also ends the user's open sessions before the user is dropped.

A revoke that fails - on request, on replacement, or while rolling back a failed request - does not mark the grant revoked, because the database user may still exist. The grant stays Active with its expiry moved to now, the administrator sees a warning, and the next expiry sweep retries the revoke and marks the grant Expired.

Why this is different from every other privilege in this document

Every other privilege in this model grants access within the F&O security model. This one grants access outside it. A db_owner connection is unconstrained by roles, duties, privileges, table permissions, XDS policies, or segregation-of-duties rules - it can read and modify any data in AxDB, including financial records and the security configuration itself.

Assume that granting this role is equivalent to issuing a database administrator credential, because operationally it is.

Controls that exist

These are genuine, and they are also the full extent of the mitigation:

Control	Detail
Privilege gate	The operation requires MGCLatticeDbAccessAdminPrivilege
Defense in depth	assertCallerAuthorized re-checks the caller's menu-item access in code before provisioning; an unauthorized requestAccess answers Success = false with ErrorCode AccessDenied and provisions nothing
License gate	requestAccess is refused (ErrorCode LicenseNotValid) on an adverse license verdict; revokeAccess is deliberately not gated, so removing access always remains possible
Single active grant	Requesting again revokes all of the caller's active grants first; one that cannot be revoked at that moment is left for the expiry sweep
Password hygiene	Stored only on the grant's audit row, encrypted with the platform encryption service; never written to telemetry or any persistent log. Returned on the request response (the page shows it only in the requesting administrator's infolog), and shown again only through Show password, which is refused once the grant is past its expiry
Own password only	Show password works only on a grant you requested yourself. Holding the role is not enough: a grant requested by another administrator is refused (ErrorCode AccessDenied) and nothing is decrypted. Revoke stays open to every holder of the role for every grant, because cutting off someone's access is a legitimate administrator action
Stored password lifetime	The stored password is cleared when the grant is revoked or expires
Failure safety	The audit row is written before the database user is created, and a failed request is rolled back. A rollback or revoke that fails leaves the grant Active and due now, so the expiry sweep retries it rather than the grant being marked revoked while the user remains
Time bound	Hard clamp of 1-72 hours plus an expiry batch, which also retries failed revokes. The batch must be scheduled
Audit	A row per grant recording who provisioned, when, and until when. Every save or decrypt of the stored password also writes a platform encryption audit row (SysEncryptionLog), and failures are recorded in telemetry with the grant's user name or record id only

Controls that do not exist

State plainly, so nobody assumes otherwise:

• No approval workflow. A single holder can self-provision; there is no second approver.
• No scope limiting. The grant is db_owner, not a narrower database role or a table subset.
• No activity capture. Audit rows record that a grant was issued and to whom. Nothing records what the grant holder did while connected - that visibility, if you need it, must come from SQL-side auditing.
• No IP validation beyond format. The caller supplies the address the firewall rule opens.

Guidance

1. Leave the role unassigned unless there is a specific operational need. It is not required for any integration, monitoring, evaluation, or trial activity.
2. Grant only to named human administrators - never to a service account, an integration identity, or an Entra ID application registration.
3. Keep it segregated from MGCLatticeIntegrationAdministratorRole, the operator role, and the read-only role. Do not fold it into a composite "admin" role.
4. Review the grant audit table as a security event stream, not as an operational log.
5. If your governance model cannot accommodate a self-service db_owner path, keep the role unassigned; the role is the control. MGCLatticeDbAccessServiceGroup contains only this service, so leaving it undeployed removes the REST path without affecting any other Lattice function, but the Database access grants page provisions grants through the same code and does not need the service group.
6. Check that the expiry sweep job (Revoke expired just-in-time database access grants) is waiting in Batch jobs. The first grant schedules it; grants are revoked only when it runs, and it is also what retries a revoke that failed.

---

Security Duties

AOT Name	Label	Description	Privileges
MGCLatticeIntegrationServiceOperationsDuty	Integration service operations	Grants invoke access to all mutating Lattice custom integration service operations across all modules, to DMF configuration capture and comparison, and to data management field mapping validation.	16
MGCLatticeIntegrationServiceQueryDuty	Integration service queries (read-only)	Grants invoke access to the read-only status-query operations across modules and to the sales price inquiry, and read access to the trade agreement entities; contains no posting or mutating operations.	8
MGCLatticeIntegrationServiceHighRiskDuty	Integration service high-risk operations	Grants invoke access to high-risk operations carved out for segregation of duties (FTI cancellation, sales packing slip cancellation, product receipt cancellation, intercompany journal posting, journal reversal, customer and vendor payment reversal, fixed asset disposal, fixed asset transaction reversal, pending price activation, DLQ replay / ops-console manage, DLQ payload edit and replay, applying a DMF configuration spec, refreshing data management field mappings), maintaining recurring data jobs and their authorized client applications, and managing recurring integrations from the recurring integration health pages.	16
MGCLatticeIntegrationServiceMonitoringDuty	Integration service monitoring	Grants read access to integration service metadata, call logs, idempotency logs, and async operation tracking, the monitoring pages, the integration operations workspace and recurring integration health.	12
MGCLatticeServiceMetadataExplorerDuty	Service metadata explorer access	Grants access to the service metadata explorer and to refreshing the service metadata.	2
MGCLatticeFileIngestDuty	Maintain file ingestion integration	Grants access to configure, run, monitor, and clean up the file ingestion framework, including the file ingestion operations workspace.	3
MGCLatticeApimConfiguratorDuty	APIM configurator	Grants access to configure the Azure API Management surface for the integration services.	1
MGCLatticeODataEntityMetadataExplorerDuty	OData entity metadata explorer access	Grants access to view OData entity metadata and refresh OData discovery data.	1
MGCLatticePostingPreviewDuty	View sales order and journal posting status	Grants invoke access to the read-only getSalesOrderStatus and getJournalStatus operations. Grants no posting rights.	1
MGCLatticeServiceTestConsoleDuty	Execute integration service tests	Grants access to the service test console to invoke operations in-process and save/replay named test requests.	1
MGCLatticeBatchMaintenanceDuty	Run Lattice batch and maintenance jobs	Runs and schedules the Lattice batch and maintenance jobs, such as log cleanup, reconciliation sweeps, catalog refresh and business event resends.	15
MGCLatticeServiceOperationLogConfigDuty	Maintain service operation logging	Maintains the per-operation service logging configuration.	1
MGCLatticeFileIngestSimulatorDuty	Use the file ingestion simulator	Runs the file ingestion simulator and maintains its sample payloads.	1
MGCLatticeIntegrationInboundInquiryDuty	Inquire into inbound integration messages	Views inbound integration messages and downloads their original payloads.	1
MGCLatticeIntegrationDeadLetterViewDuty	View integration dead letters without payloads	Reads the integration dead-letter entity with the original and edited payloads denied.	1
MGCLatticeCrossReferenceViewDuty	Inquire into cross references	View external systems and the keys they use for records in every module.	8
MGCLatticeCrossReferenceMaintainDuty	Maintain cross references	Set up external systems and maintain the keys they use for records in every module.	8

MGCLatticeIntegrationServiceOperationsDuty

Grants invoke access to all mutating custom service operations across all functional modules (read-only status queries and high-risk operations are granted separately - see the note below). This is the primary duty for integration execution.

Included Privileges:

Privilege	Module
MGCLatticeAccountsPayableServiceMaintain	Accounts Payable
MGCLatticeAccountsReceivableServiceMaintain	Accounts Receivable
MGCLatticeInventoryServiceMaintain	Inventory Management
MGCLatticeProductionServiceMaintain	Production Control
MGCLatticeGeneralLedgerServiceMaintain	General Ledger
MGCLatticeFixedAssetsServiceMaintain	Fixed Assets
MGCLatticeProjectServiceMaintain	Project Management
MGCLatticeWorkflowServiceMaintain	Workflow
MGCLatticeAsyncOperationServiceMaintain	Async Operations
MGCLatticeSalesTradeAgreementServiceMaintain	Accounts Receivable - sales trade agreements (setSalesPrice, setSalesPriceBatch)
MGCLatticeSalesOrderCaptureServiceMaintain	Accounts Receivable - sales order capture (createSalesOrder, createSalesOrderBatch)
MGCLatticeDmfConfigServiceView	Data management - read a DMF configuration as a spec and compare a spec with the environment (captureSpec, specFromPackageManifest, diffSpec)
MGCLatticeDmfMappingServiceView	Data management: check the field mappings of data projects (validateMappings); read-only
MGCLatticeInventoryCostCalculateMaintain	Inventory Management: calculate item costs into a costing version as pending prices (calculateItemCosts, calculateItemCostsBatch)
MGCLatticeJournalPostingMaintain	Journal posting - post existing ledger, inventory, project, production and trade agreement journals (postLedgerJournal, postInventoryJournal, postProjectJournal, postProductionJournal, postTradeAgreementJournal and their batch twins); the caller also needs the operation that posts each journal's type, see Journal posting: delegated rights
MGCLatticeExpenseReportServiceMaintain	Expense Management - create, submit and post expense reports (createExpenseReport, postExpenseReport and their batch twins); a report is created only for a worker the caller may file expenses for

Note: The read-only status-query operations (getPurchaseOrderStatus, getSalesOrderStatus, getJournalStatus, getProductionOrderStatus, getWorkflowStatus, getAsyncOperationStatus) and the high-risk operations (free text invoice cancellation, sales packing slip cancellation, product receipt cancellation, intercompany journal posting, journal reversal, customer and vendor payment reversal, fixed asset disposal, fixed asset transaction reversal, pending price activation) are granted by the View and High-risk privileges below, not by these module Maintain privileges. The module *ServiceMaintain privileges therefore grant mutating, non-high-risk operations only. MGCLatticeDmfConfigServiceView changes nothing, but it sits here rather than in the query duty because a captured spec, or a comparison, exposes an environment's integration configuration; the read-only role does not get it. Applying a spec is high-risk (below). MGCLatticeDmfMappingServiceView is read-only too and sits here for the same reason; refreshing mappings is high-risk. MGCLatticeInventoryCostCalculateMaintain is a privilege of its own rather than part of MGCLatticeInventoryServiceMaintain, and it is not high-risk: a cost calculation only records pending prices, and nothing is activated, revalued or posted until the high-risk activatePendingPrices runs. MGCLatticeJournalPostingMaintain is not high-risk either, because it posts nothing on its own: each journal is checked against the caller's rights to the operations that would post its content, the high-risk postIntercompanyJournal and postDisposal included. MGCLatticeExpenseReportServiceMaintain creates draft reports and posts only reports the expense report workflow approved; nothing is reversed or canceled.

MGCLatticeIntegrationServiceQueryDuty

Grants invoke access to the read-only status-query operations, via the per-module View privileges, plus the read-only sales price inquiry and read access to the trade agreement entities. The status-query operations are kept out of the module Maintain privileges so that read-only callers can be granted queries without any posting rights. Assigned to all three integration roles (administrator, operator, read-only); the high-risk MGCLatticeDatabaseAccessAdministrator role carries only its own duty.

Included Privileges:

Privilege	Module
MGCLatticeAccountsPayableServiceView	Accounts Payable (getPurchaseOrderStatus)
MGCLatticeAccountsReceivableServiceView	Accounts Receivable (getSalesOrderStatus)
MGCLatticeGeneralLedgerServiceView	General Ledger (getJournalStatus)
MGCLatticeProductionServiceView	Production Control (getProductionOrderStatus)
MGCLatticeWorkflowServiceView	Workflow (getWorkflowStatus)
MGCLatticeAsyncOperationServiceView	Async Operations (getAsyncOperationStatus)
MGCLatticePriceInquiryServiceView	Accounts Receivable - sales price inquiry (resolveSalesPrice)
MGCLatticeTradeAgreementEntityView	Trade agreement data entities (Read, 9 entities; also in the monitoring duty)

MGCLatticeIntegrationServiceHighRiskDuty

Grants invoke access to a small set of high-risk operations deliberately carved out of the module Maintain privileges for segregation of duties (operations that cancel, reverse or revalue what is already posted, or that post across legal entities or dispose of assets; 22 service operations in all), and maintenance of the recurring data jobs that move data in and out of the environment and of the field mappings their data projects use. Assigned only to MGCLatticeIntegrationAdministratorRole - the MGCLatticeIntegrationOperatorRole deliberately excludes it.

Included Privileges:

Privilege	High-risk capability
MGCLatticeAccountsReceivableFTICancelMaintain	Cancel free text invoices (cancelFreeTextInvoice, cancelFreeTextInvoiceBatch)
MGCLatticeAccountsReceivablePackingSlipCancelMaintain	Cancel posted sales packing slips (cancelSalesPackingSlip, cancelSalesPackingSlipBatch): reverses the delivery of a posted packing slip together with its inventory and ledger postings. Segregated from general accounts receivable maintenance
MGCLatticeAccountsPayableProductReceiptCancelMaintain	Cancel posted product receipts (cancelPurchaseProductReceipt, cancelPurchaseProductReceiptBatch): reverses a posted product receipt together with its inventory and ledger postings. Segregated from general accounts payable maintenance
MGCLatticeGeneralLedgerIntercompanyMaintain	Post intercompany journals (postIntercompanyJournal, postIntercompanyJournalBatch)
MGCLatticeGeneralLedgerJournalReverseMaintain	Reverse posted ledger journals (reverseJournal, reverseJournalBatch) with the standard transaction reversal, posting the reversing vouchers to the general ledger. Segregated from general ledger journal posting
MGCLatticePaymentReverseMaintain	Reverse posted customer and vendor payments (reverseCustomerPayment, reverseCustomerPaymentBatch, reverseVendorPayment, reverseVendorPaymentBatch): cancels or reverses the payment (canceling a customer payment posted to a bank account also reverses its settlements, so the invoices it paid are open again) and posts the reversing vouchers to the general ledger. Segregated from payment posting and settlement
MGCLatticeFixedAssetsDisposalMaintain	Post fixed asset disposals (postDisposal, postDisposalBatch)
MGCLatticeFixedAssetsReverseMaintain	Reverse posted fixed asset transactions (reverseAssetTransaction, reverseAssetTransactionBatch) with the standard fixed asset transaction reversal, posting the reversing vouchers to the general ledger. Segregated from fixed asset posting
MGCLatticeInventoryCostActivateMaintain	Activate the pending prices of a costing version (activatePendingPrices, activatePendingPricesBatch): makes new standard costs active, revalues on-hand inventory and posts the revaluation to the general ledger. Segregated from general inventory posting
MGCLatticeIntegrationOpsManagePrivilege	Operations-console manage actions, the DLQ auto-retry batch (re-post failed financial work), and closing open idempotency claims (Mark succeeded, Release claim)
MGCLatticeIntegrationDlqEditReplayMaintain	Edit a dead-lettered payload and replay it (the DLQ edit/replay page)
MGCLatticeDmfConfigServiceApply	Apply a DMF configuration spec (applySpec) - creates and updates data projects and recurring data jobs, starts and stops jobs, and with PruneMissing deletes project entity lines the spec no longer lists
MGCLatticeRecurringDataJobEntityMaintain	Create, change and delete recurring data jobs (MGCLatticeRecurringDataJobEntity), and invoke the entity's Activate and Deactivate actions
MGCLatticeRecurringDataJobClientEntityMaintain	Authorize client applications for recurring data jobs (MGCLatticeRecurringDataJobClientEntity)
MGCLatticeDmfMappingServiceMaintain	Refresh data management field mappings (refreshMappings): adds missing mappings to data project entities, removes mappings to fields that no longer exist and, on request, regenerates an entity's staging-to-target mapping, which every data project that uses the entity shares
MGCLatticeRecurringJobHealthMaintain	Manage recurring integrations from the recurring integration health pages: activate, deactivate and repair jobs, add, enable and disable their client applications, and edit each job's health thresholds

Integration operations console. MGCLatticeIntegrationOpsPrivilege (in MGCLatticeIntegrationOpsDuty) and MGCLatticeIntegrationOpsConsoleViewPrivilege (in the monitoring duty) open the console only. The console's manage actions (retry, hold, release and discard), the dead-letter auto-retry batch (MGCLatticeIntegrationDlqRetry) and fix-and-resubmit are granted only by MGCLatticeIntegrationOpsManagePrivilege in this duty (the fix-and-resubmit page also needs MGCLatticeIntegrationDlqEditReplayMaintain), and each action re-checks that access in code. Resubmit refuses a dead letter that is already reprocessed, discarded or requeued, so an old item whose idempotency claim was purged cannot be posted twice, and every manual action records the acting user on the row. View payload needs only access to the console.

Dead-letter payloads. A dead letter's payloads can be read in two places. View payload on the console shows the original payload to anyone who can open the console and records who viewed which item (DlqPayloadViewed, sent to Application Insights when telemetry is configured). Through the LatticeIntegrationDeadLetters entity (OData and Data management), only the administrator role reads OriginalPayload and EditedPayload: MGCLatticeIntegrationOpsManagePrivilege grants the entity with its payloads, while the operator and read-only roles get it through MGCLatticeIntegrationDeadLetterEntityView, which denies both payload fields with field-level grants. An entity read is not recorded by the View payload audit, so keep payload access through the entity to the administrator role. When you build a custom role, grant MGCLatticeIntegrationDeadLetterEntityView for dead letters without payloads; do not add it to a role that should read the payloads, because the explicit field deny can hide them even when another privilege allows them.

Service idempotency log. Mark succeeded (MGCLatticeIdempotencyClaimMarkSucceeded) and Release claim (MGCLatticeIdempotencyClaimRelease) are granted by MGCLatticeIntegrationOpsManagePrivilege. Releasing a claim lets the same request run again, so use it only when the original request committed nothing; marking it succeeded makes a repeat replay the recorded result instead of posting.

MGCLatticeIntegrationServiceMonitoringDuty

Grants read-only access to monitoring data entities and the service metadata explorer. Suitable for operations teams and support personnel who need visibility into integration activity without the ability to invoke service operations.

Included Privileges:

Privilege	Type
MGCLatticeServiceMetadataExplorerPrivilege	Menu item (Display)
MGCLatticeServiceCallLogEntityView	Data Entity (Read)
MGCLatticeServiceIdempotencyLogEntityView	Data Entity (Read)
MGCLatticeAsyncOperationTrackingEntityView	Data Entity (Read)
MGCLatticeIntegrationObservabilityView	Data Entity (Read, 2 entities: file ingestion log, service call statistics)
MGCLatticeTradeAgreementEntityView	Data Entity (Read, 9 entities)
MGCLatticeIntegrationOpsConsoleViewPrivilege	Menu item (Display)
MGCLatticeServiceCallStatisticsView	Menu item (Display)
MGCLatticeBusinessEventCatalogView	Menu item (Display)
MGCLatticeTableEntityCoverageView	Menu item (Display)
MGCLatticeIntegrationOperationsView	Menu item (Display) - the integration operations workspace, its list parts and count-tile targets, and the service call log, service idempotency log, business event log and inbound order policy state inquiries
MGCLatticeRecurringJobHealthView	Menu items (Display, Action): the recurring integration health and details pages (read-only), the three recurring job count tiles of the integration operations workspace, and Refresh health / Refresh all

MGCLatticeServiceMetadataExplorerDuty

Grants the service metadata explorer and the service metadata refresh (MGCLatticeServiceMetadataRefreshExecute), which rediscovers every service group, service and operation and replaces the service metadata catalog. Included only in MGCLatticeIntegrationAdministratorRole; the monitoring duty gives the other roles the explorer without the refresh.

Included Privileges:

Privilege
MGCLatticeServiceMetadataExplorerPrivilege
MGCLatticeServiceMetadataRefreshExecute

MGCLatticeFileIngestDuty

Grants full access to the file ingestion framework: configuring inbound connections, triggering and segmenting pulls, running cleanup, and monitoring ingested bundles. Assign this duty to integration administrators responsible for inbound file-based integrations. This duty is included in the MGCLatticeIntegrationAdministratorRole.

Included Privileges:

Privilege	Purpose
MGCLatticeFileIngestMaintain	Maintain connections (including the new-connection wizard) and run pull, segment, and cleanup operations
MGCLatticeFileIngestView	Read-only monitoring of ingested file bundles
MGCLatticeFileIngestOperationsView	Read-only access to the file ingestion operations workspace and its list parts

The file ingestion simulator and sample payloads are granted separately, by MGCLatticeFileIngestSimulatorDuty.

MGCLatticeODataEntityMetadataExplorerDuty

Grants access to the OData entity metadata explorer form and the ability to refresh OData discovery data. Suitable for developers and integration staff who need to inspect public OData data entity metadata.

Note: This duty is included in MGCLatticeIntegrationAdministratorRole. To give the explorer to other users, add the duty to their role.

Included Privileges:

Privilege
MGCLatticeODataEntityMetadataExplorerPrivilege

MGCLatticeApimConfiguratorDuty

Grants access to configure the Azure API Management (APIM) surface that fronts the integration services. Included in MGCLatticeIntegrationAdministratorRole.

Included Privileges:

Privilege
MGCLatticeApimConfiguratorPrivilege

MGCLatticePostingPreviewDuty

Grants invoke access to the read-only status queries getSalesOrderStatus and getJournalStatus. It grants no posting rights and does not run previews: a posting preview is a posting operation called with its preview flag, granted by that operation's privilege, and is recorded in the service call log with IsPreview = Yes. This duty is included in MGCLatticeIntegrationAdministratorRole and MGCLatticeIntegrationOperatorRole.

Included Privileges:

Privilege
MGCLatticePostingPreviewExecute

MGCLatticeServiceTestConsoleDuty

Grants access to the service test console to invoke integration service operations in-process and to save and replay named test requests. The console performs real operations against live data, so of the predefined roles only MGCLatticeIntegrationAdministratorRole includes this duty - grant it only to trusted administrators.

Included Privileges:

Privilege
MGCLatticeServiceTestConsoleExecute

MGCLatticeBatchMaintenanceDuty

Runs and schedules the Lattice batch and maintenance jobs: log cleanup, reconciliation sweeps, rollups and analyses, and business event resends. Included in MGCLatticeIntegrationAdministratorRole only. The jobs are on System administration > Periodic tasks, under Lattice, Lattice data entities and Lattice business events.

Included Privileges:

Privilege	Purpose
MGCLatticeServiceLogMaintenance	Run the service log cleanup batch (MGCLatticeServiceLogCleanup)
MGCLatticeServiceCallStatisticsRollupExecute	Run the service call statistics rollup batch (MGCLatticeServiceCallStatisticsRollup)
MGCLatticeBusinessEventCatalogRefreshExecute	Run the business event catalog refresh (MGCLatticeBusinessEventCatalogRefresh)
MGCLatticeTableEntityCoverageAnalyzeExecute	Run the table and entity coverage analysis (MGCLatticeTableEntityCoverageAnalyze)
MGCLatticeIdempotencyReconciliationSweepExecute	Run the idempotency reconciliation sweep batch (MGCLatticeIdempotencyReconciliationSweep)
MGCLatticeBusinessEventReconciliationSweepExecute	Run the business event reconciliation sweep batch (MGCLatticeBusinessEventReconciliationSweep)
MGCLatticeInboundOrderPolicyEvaluationBatchExecute	Run the inbound order policy evaluation batch (MGCLatticeInboundOrderPolicyEvaluationBatch)
MGCLatticeAsyncOperationProcessorExecute	Run and schedule the async operation processor (MGCLatticeAsyncOperationProcessor)
MGCLatticeWorkflowStalledAlertBatchExecute	Run and schedule the workflow stalled or failed alert (MGCLatticeWorkflowStalledAlertBatch)
MGCLatticeTradeAgreementPriceEffectivityBatchExecute	Run and schedule the sales price agreement effectivity batch (MGCLatticeTradeAgreementPriceEffectivityBatch)
MGCLatticeProcessAllCustomersExecute	Resend the Customer created event for every customer (MGCLatticeProcessAllCustomers)
MGCLatticeProcessAllItemsExecute	Resend the Released product created event for every released product (MGCLatticeProcessAllItems)
MGCLatticeProcessAllExternalItemsExecute	Resend the External item changed event for every external item (MGCLatticeProcessAllExternalItems)
MGCLatticeBusinessEventCoverageReportExecute	Run the business event coverage report (MGCLatticeBusinessEventCoverageReport)
MGCLatticeBusinessEventReferenceSeedExecute	Load the business event reference list (MGCLatticeBusinessEventReferenceSeed)

MGCLatticeServiceOperationLogConfigDuty

Maintains the per-operation service logging configuration (System administration > Setup > Lattice > Service operation logging configuration). Included in MGCLatticeIntegrationAdministratorRole only.

Included Privileges:

Privilege
MGCLatticeServiceOperationLogConfigMaintain

MGCLatticeFileIngestSimulatorDuty

Runs the file ingestion simulator and maintains its sample payloads. Included in MGCLatticeIntegrationAdministratorRole and MGCLatticeIntegrationOperatorRole.

Included Privileges:

Privilege
MGCLatticeFileIngestSimulatorPrivilege

MGCLatticeIntegrationInboundInquiryDuty

Views inbound integration messages and downloads their original payloads (Inbound message inquiry). Included in all three integration roles: administrator, operator and read-only.

Included Privileges:

Privilege
MGCLatticeIntegrationInboundInquiryPrivilege

MGCLatticeIntegrationDeadLetterViewDuty

Reads the LatticeIntegrationDeadLetters entity with OriginalPayload and EditedPayload denied by field-level grants, so the platform returns the dead letters without their payloads. Included in MGCLatticeIntegrationOperatorRole and MGCLatticeIntegrationReadOnlyRole. The administrator role reads the entity with its payloads through MGCLatticeIntegrationOpsManagePrivilege in the high-risk duty and does not hold this duty. See Dead-letter payloads under the integration operations console.

Included Privileges:

Privilege
MGCLatticeIntegrationDeadLetterEntityView

MGCLatticeCrossReferenceViewDuty

Views the external systems page and the cross-reference keys of every covered record kind: the per-module Cross references pages (read-only), the Cross references FactBox, and read access to the 33 cross-reference data entities. Included in MGCLatticeIntegrationOperatorRole and MGCLatticeIntegrationReadOnlyRole.

Included Privileges:

Privilege
MGCLatticeExternalSystemView
MGCLatticeCrossReferenceAccountsReceivableView
MGCLatticeCrossReferenceProcurementView
MGCLatticeCrossReferenceInventoryView
MGCLatticeCrossReferenceFixedAssetsView
MGCLatticeCrossReferenceProjectsView
MGCLatticeCrossReferenceGeneralLedgerView
MGCLatticeCrossReferenceProductionView

MGCLatticeCrossReferenceMaintainDuty

Sets up external systems (System administration > Setup > Lattice > External systems) and adds, changes and deletes cross-reference keys on the per-module Cross references pages and through the 33 cross-reference data entities. On the pages, editing is further limited to the external systems set up as editable on forms in the module's parameters. Included in MGCLatticeIntegrationAdministratorRole only.

Included Privileges:

Privilege
MGCLatticeExternalSystemMaintain
MGCLatticeCrossReferenceAccountsReceivableMaintain
MGCLatticeCrossReferenceProcurementMaintain
MGCLatticeCrossReferenceInventoryMaintain
MGCLatticeCrossReferenceFixedAssetsMaintain
MGCLatticeCrossReferenceProjectsMaintain
MGCLatticeCrossReferenceGeneralLedgerMaintain
MGCLatticeCrossReferenceProductionMaintain

The per-module privileges can also be assigned on their own, for example to give an accounts receivable clerk customer keys without general ledger keys.

---

Security Privileges

Summary

AOT Name	Label	Type	Entry Points / Entities
MGCLatticeAccountsPayableServiceMaintain	Accounts payable integration service operations	ServiceOperation (Invoke)	28 entry points
MGCLatticeAccountsReceivableServiceMaintain	Accounts receivable integration service operations	ServiceOperation (Invoke)	14 entry points
MGCLatticeInventoryServiceMaintain	Inventory integration service operations	ServiceOperation (Invoke)	18 entry points
MGCLatticeProductionServiceMaintain	Production integration service operations	ServiceOperation (Invoke)	16 entry points
MGCLatticeGeneralLedgerServiceMaintain	General ledger integration service operations	ServiceOperation (Invoke)	20 entry points
MGCLatticeFixedAssetsServiceMaintain	Fixed assets integration service operations	ServiceOperation (Invoke)	10 entry points
MGCLatticeProjectServiceMaintain	Project integration service operations	ServiceOperation (Invoke)	10 entry points
MGCLatticeWorkflowServiceMaintain	Workflow integration service operations	ServiceOperation (Invoke)	10 entry points
MGCLatticeAsyncOperationServiceMaintain	Async operation integration service operations	ServiceOperation (Invoke)	1 entry point
MGCLatticeSalesTradeAgreementServiceMaintain	Maintain sales trade agreements via service	ServiceOperation (Invoke)	2 entry points
MGCLatticeInventoryCostCalculateMaintain	Inventory cost - calculate item costs	ServiceOperation (Invoke)	2 entry points
MGCLatticeJournalPostingMaintain	Journal posting - post existing journals	ServiceOperation (Invoke)	10 entry points
MGCLatticeExpenseReportServiceMaintain	Expense reports - create and post	ServiceOperation (Invoke)	4 entry points
MGCLatticeSalesOrderCaptureServiceMaintain	Sales order capture integration service operations	ServiceOperation (Invoke)	2 entry points
MGCLatticePostingPreviewExecute	Invoke sales order and journal status queries	ServiceOperation (Invoke)	2 entry points (read-only status queries)
MGCLatticeServiceMetadataExplorerPrivilege	View service metadata explorer	MenuItemDisplay (Read)	2 entry points (the explorer and the metadata refresh log)
MGCLatticeServiceMetadataRefreshExecute	Refresh service metadata	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeFileIngestMaintain	Maintain file ingestion	2 MenuItemDisplay (full CRUD) + wizard MenuItemDisplay (Create + Read) + 3 MenuItemAction (Read + Invoke) + MenuItemDisplay (Read)	7 entry points
MGCLatticeFileIngestView	View file ingestion	MenuItemDisplay (Read)	1 entry point
MGCLatticeODataEntityMetadataExplorerPrivilege	OData entity metadata explorer access	MenuItemDisplay (Read) + MenuItemAction (Read + Invoke + Delete)	2 entry points
MGCLatticeServiceTestConsoleExecute	Execute service tests	MenuItemDisplay (full CRUD)	1 entry point
MGCLatticeServiceCallStatisticsView	View service call statistics	MenuItemDisplay (Read)	1 entry point
MGCLatticeIntegrationOperationsView	View integration operations	MenuItemDisplay (Read)	16 entry points (workspace, 4 inquiries, 6 count-tile items, 5 list parts)
MGCLatticeRecurringJobHealthView	View recurring integration health	5 MenuItemDisplay (Read) + 2 MenuItemAction (Read + Invoke)	7 entry points (health and details pages, 3 count-tile items, Refresh health, Refresh all)
MGCLatticeIdempotencyReconciliationSweepExecute	Run the idempotency reconciliation sweep	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeBusinessEventReconciliationSweepExecute	Run the business event reconciliation sweep	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeInboundOrderPolicyEvaluationBatchExecute	Run the inbound order policy evaluation	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeAsyncOperationProcessorExecute	Run the async operation processor	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeWorkflowStalledAlertBatchExecute	Run the workflow stalled or failed alert	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeTradeAgreementPriceEffectivityBatchExecute	Run the sales price agreement effectivity batch	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeProcessAllCustomersExecute	Resend customer business events	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeProcessAllItemsExecute	Resend released product business events	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeProcessAllExternalItemsExecute	Resend external item business events	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeBusinessEventCoverageReportExecute	Run the business event coverage report	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeBusinessEventReferenceSeedExecute	Load the business event reference list	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeServiceLogMaintenance	Maintain integration logs	MenuItemAction (Read + Invoke)	1 entry point
MGCLatticeServiceCallStatisticsRollupExecute	Run the service call statistics rollup	MenuItemAction (Read + Invoke + Delete)	1 entry point
MGCLatticeBusinessEventCatalogRefreshExecute	Refresh the business event catalog	MenuItemAction (Read + Update)	1 entry point
MGCLatticeTableEntityCoverageAnalyzeExecute	Run the table/entity coverage analysis	MenuItemAction (Delete)	1 entry point
MGCLatticeServiceOperationLogConfigMaintain	Maintain service operation logging configuration	MenuItemDisplay (full CRUD)	1 entry point
MGCLatticeFileIngestSimulatorPrivilege	Run file ingestion simulator	MenuItemDisplay (Read) + MenuItemDisplay (full CRUD, sample payloads)	2 entry points
MGCLatticeIntegrationInboundInquiryPrivilege	View inbound message inquiry	MenuItemDisplay (Read) + MenuItemAction (Read + Invoke, payload download)	2 entry points
MGCLatticeServiceCallLogEntityView	View Service Call Log Entity	Data Entity (Read)	1 entity
MGCLatticeServiceIdempotencyLogEntityView	View Service Idempotency Log Entity	Data Entity (Read)	1 entity
MGCLatticeAsyncOperationTrackingEntityView	View Async Operation Tracking Entity	Data Entity (Read)	1 entity
MGCLatticeExternalSystemView	View external systems	MenuItemDisplay (Read)	1 entry point
MGCLatticeExternalSystemMaintain	Maintain external systems	MenuItemDisplay (full CRUD)	1 entry point
MGCLatticeCrossReferenceAccountsReceivableView	View Accounts receivable cross references	MenuItemDisplay (Read) ×2 + Data Entity (Read)	2 entry points (Cross references page, FactBox), 11 entities
MGCLatticeCrossReferenceAccountsReceivableMaintain	Maintain Accounts receivable cross references	MenuItemDisplay (full CRUD) + MenuItemDisplay (Read, FactBox) + Data Entity (full CRUD)	2 entry points, 11 entities
MGCLatticeCrossReferenceProcurementView	View procurement cross references	MenuItemDisplay (Read) ×2 + Data Entity (Read)	2 entry points, 7 entities
MGCLatticeCrossReferenceProcurementMaintain	Maintain procurement cross references	MenuItemDisplay (full CRUD) + MenuItemDisplay (Read, FactBox) + Data Entity (full CRUD)	2 entry points, 7 entities
MGCLatticeCrossReferenceInventoryView	View inventory cross references	MenuItemDisplay (Read) ×2 + Data Entity (Read)	2 entry points, 5 entities
MGCLatticeCrossReferenceInventoryMaintain	Maintain inventory cross references	MenuItemDisplay (full CRUD) + MenuItemDisplay (Read, FactBox) + Data Entity (full CRUD)	2 entry points, 5 entities
MGCLatticeCrossReferenceFixedAssetsView	View fixed asset cross references	MenuItemDisplay (Read) ×2 + Data Entity (Read)	2 entry points, 1 entity
MGCLatticeCrossReferenceFixedAssetsMaintain	Maintain fixed asset cross references	MenuItemDisplay (full CRUD) + MenuItemDisplay (Read, FactBox) + Data Entity (full CRUD)	2 entry points, 1 entity
MGCLatticeCrossReferenceProjectsView	View project cross references	MenuItemDisplay (Read) ×2 + Data Entity (Read)	2 entry points, 2 entities
MGCLatticeCrossReferenceProjectsMaintain	Maintain project cross references	MenuItemDisplay (full CRUD) + MenuItemDisplay (Read, FactBox) + Data Entity (full CRUD)	2 entry points, 2 entities
MGCLatticeCrossReferenceGeneralLedgerView	View general ledger cross references	MenuItemDisplay (Read) ×2 + Data Entity (Read)	2 entry points, 2 entities
MGCLatticeCrossReferenceGeneralLedgerMaintain	Maintain general ledger cross references	MenuItemDisplay (full CRUD) + MenuItemDisplay (Read, FactBox) + Data Entity (full CRUD)	2 entry points, 2 entities
MGCLatticeCrossReferenceProductionView	View production cross references	MenuItemDisplay (Read) ×2 + Data Entity (Read)	2 entry points, 5 entities
MGCLatticeCrossReferenceProductionMaintain	Maintain production cross references	MenuItemDisplay (full CRUD) + MenuItemDisplay (Read, FactBox) + Data Entity (full CRUD)	2 entry points, 5 entities

The cross-reference privileges cover these entities. Accounts receivable: customer, sales order and line, return order and line, sales quotation and line, free text invoice and line, sales agreement and line. Procurement: vendor, purchase order and line, purchase requisition and line, purchase agreement and line. Inventory: released product, product variant, batch, transfer order and line. Fixed assets: fixed asset. Projects: project, project contract. General ledger: journal and journal line. Production: production order, BOM, BOM version, route, route version.

---

Service Operation Entry Points

All service operation entry points grant the Invoke permission. Each service exposes both single-record and batch variants of its operations.

Privileges: each service's Privilege line names the privilege that grants its operations. The read-only status queries are granted by the module View privileges (MGCLatticeIntegrationServiceQueryDuty) and the high-risk operations by dedicated privileges (MGCLatticeIntegrationServiceHighRiskDuty); the line names them where they apply. The per-privilege entry-point counts are in the Appendix.

Accounts Payable

MGCLatticePurchaseOrderPostingService

Operation	Description
confirmPurchaseOrder	Confirm a purchase order
postPurchasePackingSlip	Post a purchase packing slip (product receipt)
invoicePurchaseOrder	Invoice a purchase order
cancelPurchaseProductReceipt	Cancel a posted product receipt
postPurchasePrepaymentInvoice	Post a vendor prepayment invoice for a purchase order
getPurchaseOrderStatus	Retrieve purchase order status
confirmPurchaseOrderBatch	Confirm purchase orders in batch
postPurchasePackingSlipBatch	Post purchase packing slips in batch
invoicePurchaseOrderBatch	Invoice purchase orders in batch
cancelPurchaseProductReceiptBatch	Cancel posted product receipts in batch
postPurchasePrepaymentInvoiceBatch	Post vendor prepayment invoices in batch

Privilege: MGCLatticeAccountsPayableServiceMaintain; cancelPurchaseProductReceipt and cancelPurchaseProductReceiptBatch: MGCLatticeAccountsPayableProductReceiptCancelMaintain (high-risk); getPurchaseOrderStatus: MGCLatticeAccountsPayableServiceView

MGCLatticePurchaseReturnService

Operation	Description
createPurchaseReturn	Create a purchase return order
shipPurchaseReturn	Ship a purchase return order
creditPurchaseReturn	Credit a purchase return order
createPurchaseReturnBatch	Create purchase return orders in batch
shipPurchaseReturnBatch	Ship purchase return orders in batch
creditPurchaseReturnBatch	Credit purchase return orders in batch

Privilege: MGCLatticeAccountsPayableServiceMaintain

MGCLatticeVendorInvoiceJournalService

Operation	Description
postInvoiceRegisterJournal	Post a vendor invoice register journal
postInvoiceApprovalJournal	Post a vendor invoice approval journal
postInvoiceRegisterJournalBatch	Post vendor invoice register journals in batch
postInvoiceApprovalJournalBatch	Post vendor invoice approval journals in batch

Privilege: MGCLatticeAccountsPayableServiceMaintain

MGCLatticeVendorInvoiceService

Operation	Description
postPendingVendorInvoice	Post a pending vendor invoice
postPendingVendorInvoiceBatch	Post pending vendor invoices in batch

Privilege: MGCLatticeAccountsPayableServiceMaintain

MGCLatticeVendorPaymentProposalService

Operation	Description
generatePaymentProposal	Generate a vendor payment proposal
generateVendorPayments	Generate the payments (checks) of a vendor payment journal, optionally posting it
generatePaymentProposalBatch	Generate vendor payment proposals in batch
generateVendorPaymentsBatch	Generate vendor payments in batch

Privilege: MGCLatticeAccountsPayableServiceMaintain

MGCLatticePurchaseRequisitionService

Operation	Description
submitPurchaseRequisition	Submit a purchase requisition
convertPurchaseRequisitionToOrder	Convert an approved requisition to a purchase order
submitPurchaseRequisitionBatch	Submit purchase requisitions in batch
convertPurchaseRequisitionToOrderBatch	Convert requisitions to purchase orders in batch

Privilege: MGCLatticeAccountsPayableServiceMaintain

---

Accounts Receivable

MGCLatticeSalesOrderPostingService

Operation	Description
confirmSalesOrder	Confirm a sales order
postSalesPackingSlip	Post a sales packing slip
invoiceSalesOrder	Invoice a sales order
cancelSalesPackingSlip	Cancel a posted sales packing slip
getSalesOrderStatus	Retrieve sales order status
confirmSalesOrderBatch	Confirm sales orders in batch
postSalesPackingSlipBatch	Post sales packing slips in batch
invoiceSalesOrderBatch	Invoice sales orders in batch
cancelSalesPackingSlipBatch	Cancel posted sales packing slips in batch

Privilege: MGCLatticeAccountsReceivableServiceMaintain; cancelSalesPackingSlip and cancelSalesPackingSlipBatch: MGCLatticeAccountsReceivablePackingSlipCancelMaintain (high-risk); getSalesOrderStatus: MGCLatticeAccountsReceivableServiceView (also MGCLatticePostingPreviewExecute)

MGCLatticeSalesOrderCaptureService

Operation	Description
createSalesOrder	Create a sales order with its lines
createSalesOrderBatch	Create sales orders in batch

Privilege: MGCLatticeSalesOrderCaptureServiceMaintain

MGCLatticeFreeTextInvoiceService

Operation	Description
postFreeTextInvoice	Post a free text invoice
cancelFreeTextInvoice	Cancel a free text invoice
postFreeTextInvoiceBatch	Post free text invoices in batch
cancelFreeTextInvoiceBatch	Cancel free text invoices in batch

Privilege: MGCLatticeAccountsReceivableServiceMaintain; cancelFreeTextInvoice and cancelFreeTextInvoiceBatch: MGCLatticeAccountsReceivableFTICancelMaintain (high-risk)

MGCLatticeSalesReturnService

Operation	Description
createSalesReturn	Create a sales return order
receiveSalesReturn	Receive a sales return order
creditSalesReturn	Credit a sales return order
createSalesReturnBatch	Create sales return orders in batch
receiveSalesReturnBatch	Receive sales return orders in batch
creditSalesReturnBatch	Credit sales return orders in batch

Privilege: MGCLatticeAccountsReceivableServiceMaintain

MGCLatticeSalesTradeAgreementService

Creates and posts sales-price trade agreements with clean forward-only supersession. Part of the Accounts receivable service group.

Operation	Description
setSalesPrice	Create/post a sales-price trade agreement
setSalesPriceBatch	Create/post sales-price trade agreements in batch

Privilege: MGCLatticeSalesTradeAgreementServiceMaintain

MGCLatticePriceInquiryService

Read-only sales price inquiry. Resolves the effective sales price for a customer, item, date, and quantity. Part of the Accounts receivable service group. Read-only and fully attributable via the service call log.

Operation	Description
resolveSalesPrice	Resolve the effective sales price (read-only, commits nothing)

Privilege: MGCLatticePriceInquiryServiceView - grants Invoke on the MGCLatticePriceInquiryService_resolveSalesPrice entry point (read-only effective-price inquiry). It is part of MGCLatticeIntegrationServiceQueryDuty, so all three integration roles hold it.

---

Inventory Management

MGCLatticeInventoryJournalPostingService

Operation	Description
postMovementJournal	Post an inventory movement journal
postAdjustmentJournal	Post an inventory adjustment journal
postCountingJournal	Post an inventory counting journal
postTransferJournal	Post an inventory transfer journal
postBOMJournal	Post a BOM journal
postTagCountingJournal	Post a tag counting journal
postOwnershipChangeJournal	Post a consignment inventory ownership change journal
postMovementJournalBatch	Post inventory movement journals in batch
postAdjustmentJournalBatch	Post inventory adjustment journals in batch
postCountingJournalBatch	Post inventory counting journals in batch
postTransferJournalBatch	Post inventory transfer journals in batch
postBOMJournalBatch	Post BOM journals in batch
postTagCountingJournalBatch	Post tag counting journals in batch
postOwnershipChangeJournalBatch	Post ownership change journals in batch

Privilege: MGCLatticeInventoryServiceMaintain

MGCLatticeTransferOrderPostingService

Operation	Description
shipTransferOrder	Ship a transfer order
receiveTransferOrder	Receive a transfer order
shipTransferOrderBatch	Ship transfer orders in batch
receiveTransferOrderBatch	Receive transfer orders in batch

Privilege: MGCLatticeInventoryServiceMaintain

MGCLatticeInventoryCostService

Operation	Description
activatePendingPrices	Activate the pending prices of a costing version (new standard costs)
calculateItemCosts	Calculate item costs in a costing version and record them as pending prices
activatePendingPricesBatch	Activate the pending prices of several costing versions or legal entities in batch
calculateItemCostsBatch	Calculate item costs in batch

Privilege: activatePendingPrices and activatePendingPricesBatch: MGCLatticeInventoryCostActivateMaintain (high-risk), label "Inventory cost - activate pending prices (high-risk)", entry points MGCLatticeInventoryCostService_activatePendingPrices and MGCLatticeInventoryCostService_activatePendingPricesBatch (ServiceOperation, Invoke). Activating a standard cost revalues on-hand inventory and posts the revaluation to the general ledger, so the privilege is in MGCLatticeIntegrationServiceHighRiskDuty (administrator role only), not in MGCLatticeInventoryServiceMaintain.

calculateItemCosts and calculateItemCostsBatch: MGCLatticeInventoryCostCalculateMaintain, label "Inventory cost - calculate item costs", in MGCLatticeIntegrationServiceOperationsDuty (administrator and operator roles). A calculation only records pending prices in the costing version; nothing is activated, revalued or posted, so the privilege is not high-risk.

---

Production Control

MGCLatticeProductionOrderPostingService

Operation	Description
estimateProductionOrder	Estimate a production order
scheduleProductionOrder	Schedule a production order
releaseProductionOrder	Release a production order
startProductionOrder	Start a production order
postPickList	Post a production pick list
postRouteCard	Post a production route card
reportAsFinished	Report a production order as finished
endProductionOrder	End a production order
getProductionOrderStatus	Retrieve production order status
estimateProductionOrderBatch	Estimate production orders in batch
scheduleProductionOrderBatch	Schedule production orders in batch
releaseProductionOrderBatch	Release production orders in batch
startProductionOrderBatch	Start production orders in batch
postPickListBatch	Post production pick lists in batch
postRouteCardBatch	Post production route cards in batch
reportAsFinishedBatch	Report production orders as finished in batch
endProductionOrderBatch	End production orders in batch

Privilege: MGCLatticeProductionServiceMaintain; getProductionOrderStatus: MGCLatticeProductionServiceView

---

General Ledger

MGCLatticeGeneralLedgerJournalService

Operation	Description
postGeneralJournal	Post a general journal
postIntercompanyJournal	Post an intercompany journal
getJournalStatus	Retrieve journal posting status
reverseJournal	Reverse a posted ledger journal, or one of its vouchers
postGeneralJournalBatch	Post general journals in batch
postIntercompanyJournalBatch	Post intercompany journals in batch
reverseJournalBatch	Reverse posted ledger journals in batch

Privilege: MGCLatticeGeneralLedgerServiceMaintain; postIntercompanyJournal and postIntercompanyJournalBatch: MGCLatticeGeneralLedgerIntercompanyMaintain (high-risk); reverseJournal and reverseJournalBatch: MGCLatticeGeneralLedgerJournalReverseMaintain (high-risk); getJournalStatus: MGCLatticeGeneralLedgerServiceView (also MGCLatticePostingPreviewExecute)

MGCLatticePaymentJournalService

Operation	Description
postCustomerPaymentJournal	Post a customer payment journal
postVendorPaymentJournal	Post a vendor payment journal
settleCustomerTransactions	Settle customer open transactions
settleVendorTransactions	Settle vendor open transactions
reverseCustomerPayment	Reverse a posted customer payment
reverseVendorPayment	Reverse a posted vendor payment
postCustomerPaymentJournalBatch	Post customer payment journals in batch
postVendorPaymentJournalBatch	Post vendor payment journals in batch
settleCustomerTransactionsBatch	Settle customer transactions in batch
settleVendorTransactionsBatch	Settle vendor transactions in batch
reverseCustomerPaymentBatch	Reverse posted customer payments in batch
reverseVendorPaymentBatch	Reverse posted vendor payments in batch

Privilege: MGCLatticeGeneralLedgerServiceMaintain; reverseCustomerPayment, reverseVendorPayment and their batch operations: MGCLatticePaymentReverseMaintain (high-risk)

MGCLatticeBudgetRegisterService

Operation	Description
postBudgetEntry	Post a budget register entry
postBudgetTransfer	Post a budget transfer
postBudgetEntryBatch	Post budget register entries in batch
postBudgetTransferBatch	Post budget transfers in batch

Privilege: MGCLatticeGeneralLedgerServiceMaintain

MGCLatticeCurrencyRevaluationService

Operation	Description
runCustomerRevaluation	Run customer foreign currency revaluation
runVendorRevaluation	Run vendor foreign currency revaluation
runLedgerRevaluation	Run ledger foreign currency revaluation
runCustomerRevaluationBatch	Run customer foreign currency revaluation in batch
runVendorRevaluationBatch	Run vendor foreign currency revaluation in batch
runLedgerRevaluationBatch	Run ledger foreign currency revaluation in batch

Privilege: MGCLatticeGeneralLedgerServiceMaintain

---

Fixed Assets

MGCLatticeFixedAssetService

Operation	Description
postAcquisition	Post a fixed asset acquisition
runDepreciationProposal	Run a fixed asset depreciation proposal
postDisposal	Post a fixed asset disposal
postAssetTransaction	Post fixed asset transactions after acquisition (adjustments, depreciation, revaluation, write-ups and write-downs)
transferAsset	Transfer a fixed asset to new financial dimensions or a new location
splitAsset	Split a fixed asset book into a new or existing asset
reverseAssetTransaction	Reverse a posted fixed asset transaction
postAcquisitionBatch	Post fixed asset acquisitions in batch
runDepreciationProposalBatch	Run fixed asset depreciation proposals in batch
postDisposalBatch	Post fixed asset disposals in batch
postAssetTransactionBatch	Post fixed asset transactions in batch
transferAssetBatch	Transfer fixed assets in batch
splitAssetBatch	Split fixed assets in batch
reverseAssetTransactionBatch	Reverse posted fixed asset transactions in batch

Privilege: MGCLatticeFixedAssetsServiceMaintain; postDisposal and postDisposalBatch: MGCLatticeFixedAssetsDisposalMaintain (high-risk); reverseAssetTransaction and reverseAssetTransactionBatch: MGCLatticeFixedAssetsReverseMaintain (high-risk), label "Fixed assets - reverse transactions (high-risk)"

---

Project Management and Accounting

MGCLatticeProjectJournalService

Operation	Description
postHourJournal	Post a project hour journal
postExpenseJournal	Post a project expense journal
postItemJournal	Post a project item journal
postFeeJournal	Post a project fee journal
postHourJournalBatch	Post project hour journals in batch
postExpenseJournalBatch	Post project expense journals in batch
postItemJournalBatch	Post project item journals in batch
postFeeJournalBatch	Post project fee journals in batch

Privilege: MGCLatticeProjectServiceMaintain

MGCLatticeProjectInvoiceService

Operation	Description
createInvoiceProposal	Create a project invoice proposal and optionally post it
createInvoiceProposalBatch	Create project invoice proposals in batch

Privilege: MGCLatticeProjectServiceMaintain

---

Expense Management

MGCLatticeExpenseReportService

Creates expense reports from expense tools, optionally submitting them to the expense report workflow, and posts the reports the workflow approved. The only service of MGCLatticeExpenseServiceGroup.

Operation	Description
createExpenseReport	Create an expense report with its lines for a worker, optionally submitting it to workflow
postExpenseReport	Post an approved expense report
createExpenseReportBatch	Create expense reports in batch
postExpenseReportBatch	Post approved expense reports in batch

Privilege: MGCLatticeExpenseReportServiceMaintain, label "Expense reports - create and post", in MGCLatticeIntegrationServiceOperationsDuty (administrator and operator roles). It is not high-risk: it creates draft reports and posts only reports the expense report workflow approved.

Filing for a worker. Besides the privilege, createExpenseReport applies the rule of the Expense reports page: a report can be created only for a worker the caller may file expenses for, that is the worker's own user, a current delegate of the worker, or a user with the expense administrator, expense agent or system administrator role. Anyone else is refused with AccessDenied, and nothing is created. A request without WorkerPersonnelNumber creates the report for the calling user's own worker. The Lattice roles include none of those expense roles, so a service account that files reports for other workers needs one of them, or delegate rights for each worker, in addition to its Lattice role. The work items of the approval are approved with the workflow service's operations (MGCLatticeWorkflowServiceMaintain).

---

Journal Posting

MGCLatticeJournalPostingService

Posts a journal that already exists in the legal entity (entered on its page, imported through data management or created through the standard journal entities) with the standard posting the journal page's Post runs. The only service of MGCLatticeJournalPostingServiceGroup.

Operation	Description
postLedgerJournal	Post an existing ledger journal
postInventoryJournal	Post an existing inventory journal
postProjectJournal	Post an existing project hour or fee journal
postProductionJournal	Post an existing production journal
postTradeAgreementJournal	Post an existing trade agreement journal
postLedgerJournalBatch	Post existing ledger journals in batch
postInventoryJournalBatch	Post existing inventory journals in batch
postProjectJournalBatch	Post existing project journals in batch
postProductionJournalBatch	Post existing production journals in batch
postTradeAgreementJournalBatch	Post existing trade agreement journals in batch

Privilege: MGCLatticeJournalPostingMaintain, label "Journal posting - post existing journals", in MGCLatticeIntegrationServiceOperationsDuty (administrator and operator roles). The privilege alone posts nothing; see the next section.

Journal posting: delegated rights

Posting a journal through this service needs, besides MGCLatticeJournalPostingMaintain, every Lattice operation that would post the journal's content: the operation of its journal type and, for a ledger journal, the operations its lines need. The service asks the platform's own service operation check (the one the platform makes before it invokes an operation through its endpoint) for the calling user, on every request, synchronous, batch item or async. When any operation is missing, the request is refused with AccessDenied, the message names every missing operation, and nothing is posted. Posting an existing journal therefore never lets a caller do more than the operations it holds would: an identity that may post inventory journals cannot post a general journal through this service, and one that may post general journals cannot post an intercompany line or a fixed asset disposal without the high-risk operations.

By journal type:

Journal type	Operation the caller must also hold
General journal	MGCLatticeGeneralLedgerJournalService.postGeneralJournal
Customer payment journal	MGCLatticePaymentJournalService.postCustomerPaymentJournal
Vendor payment journal	MGCLatticePaymentJournalService.postVendorPaymentJournal
Invoice register, vendor invoice journal	MGCLatticeVendorInvoiceJournalService.postInvoiceRegisterJournal
Invoice approval journal	MGCLatticeVendorInvoiceJournalService.postInvoiceApprovalJournal
Project expense journal (ledger journal of type Cost)	MGCLatticeProjectJournalService.postExpenseJournal
Fixed asset journal	Decided by its lines (below)
Inventory movement / adjustment / counting / transfer / BOM / tag counting / ownership change journal	MGCLatticeInventoryJournalPostingService.postMovementJournal / postAdjustmentJournal / postCountingJournal / postTransferJournal / postBOMJournal / postTagCountingJournal / postOwnershipChangeJournal
Project item journal (inventory journal of type Project)	MGCLatticeProjectJournalService.postItemJournal
Fixed asset inventory journal (inventory journal of type Fixed asset)	MGCLatticeFixedAssetService.postAcquisition
Project hour / fee journal	MGCLatticeProjectJournalService.postHourJournal / postFeeJournal
Picking list / route card and job card / report as finished journal	MGCLatticeProductionOrderPostingService.postPickList / postRouteCard / reportAsFinished
Trade agreement journal	MGCLatticeSalesTradeAgreementService.setSalesPrice

And, line by line, in a ledger journal of any type:

Line	Operation the caller must also hold
Intercompany line: its account company or offset company is another legal entity, as the standard posting decides it	MGCLatticeGeneralLedgerJournalService.postIntercompanyJournal (high-risk)
Fixed asset line (every line of a fixed asset journal; in any other journal, a line whose account or offset type is Fixed assets) with transaction type Acquisition	MGCLatticeFixedAssetService.postAcquisition
Fixed asset line with transaction type Disposal - sale or Disposal - scrap	MGCLatticeFixedAssetService.postDisposal (high-risk)
Fixed asset line with any other transaction type (acquisition adjustment, depreciation, revaluation, write-up or write-down adjustment, ...)	MGCLatticeFixedAssetService.postAssetTransaction
Project line (account or offset type Project)	MGCLatticeProjectJournalService.postExpenseJournal

Customer, vendor and bank lines of a general journal need nothing beyond postGeneralJournal. For example, a general journal with an intercompany line and a fixed asset disposal line needs postGeneralJournal, postIntercompanyJournal and postDisposal. Journal types no Lattice operation posts (allocation, elimination, periodic, budget, project beginning balance, ...) are refused with ValidationFailed.

What this means for roles:

• Operator role: posts every existing journal whose content needs no high-risk operation. A journal with an intercompany line or a fixed asset disposal line is refused (AccessDenied) and needs the administrator role.
• Custom roles: add MGCLatticeJournalPostingMaintain together with the privileges that grant the operations above, for example MGCLatticeGeneralLedgerServiceMaintain for general journals, plus MGCLatticeGeneralLedgerIntercompanyMaintain when they carry intercompany lines, or MGCLatticeInventoryServiceMaintain for inventory journals.

---

Workflow

MGCLatticeWorkflowActionService

Operation	Description
submitToWorkflow	Submit a document to workflow
approveWorkItem	Approve a workflow work item
rejectWorkItem	Reject a workflow work item
delegateWorkItem	Delegate a workflow work item
recallWorkflow	Recall a submitted workflow - only its originator, or a caller granted the workflow history's Cancel (WorkflowStatusCancel); anyone else gets AccessDenied
getWorkflowStatus	Retrieve workflow status
submitToWorkflowBatch	Submit documents to workflow in batch
approveWorkItemBatch	Approve workflow work items in batch
rejectWorkItemBatch	Reject workflow work items in batch
delegateWorkItemBatch	Delegate workflow work items in batch
recallWorkflowBatch	Recall submitted workflows in batch

Privilege: MGCLatticeWorkflowServiceMaintain; getWorkflowStatus: MGCLatticeWorkflowServiceView

---

Async Operations

MGCLatticeAsyncOperationService

Operation	Description
submitAsyncOperation	Submit an operation for asynchronous execution
getAsyncOperationStatus	Poll the status of an asynchronous operation

Privilege: MGCLatticeAsyncOperationServiceMaintain; getAsyncOperationStatus: MGCLatticeAsyncOperationServiceView

Access to the target operation. Submitting an async operation requires access to the target service operation as well as to submitAsyncOperation; the privilege needed is the one that grants the target for a direct call. Without it the submission fails with "You do not have access to the service operation …". Before an operation runs, the processor checks again that the user who submitted it still has that access; if not, the operation is set to Failed and parked in the dead-letter queue. Replaying a dead-letter item requires the replaying user (or the owner of the retry batch job) to have access to the target operation.

Target operation	Privilege required (besides MGCLatticeAsyncOperationServiceMaintain)
MGCLatticeFixedAssetService.postAcquisition, runDepreciationProposal, postAssetTransaction	MGCLatticeFixedAssetsServiceMaintain
MGCLatticeFixedAssetService.postDisposal	MGCLatticeFixedAssetsDisposalMaintain (high-risk)
MGCLatticeInventoryCostService.activatePendingPrices	MGCLatticeInventoryCostActivateMaintain (high-risk)
MGCLatticeInventoryCostService.calculateItemCosts	MGCLatticeInventoryCostCalculateMaintain
MGCLatticeGeneralLedgerJournalService.postGeneralJournal	MGCLatticeGeneralLedgerServiceMaintain
MGCLatticeGeneralLedgerJournalService.postIntercompanyJournal	MGCLatticeGeneralLedgerIntercompanyMaintain (high-risk)
MGCLatticeGeneralLedgerJournalService.reverseJournal	MGCLatticeGeneralLedgerJournalReverseMaintain (high-risk)
MGCLatticeCurrencyRevaluationService.runCustomerRevaluation, runVendorRevaluation, runLedgerRevaluation	MGCLatticeGeneralLedgerServiceMaintain
MGCLatticeBudgetRegisterService.postBudgetEntry, postBudgetTransfer	MGCLatticeGeneralLedgerServiceMaintain
MGCLatticeJournalPostingService.postLedgerJournal, postInventoryJournal, postProjectJournal, postProductionJournal, postTradeAgreementJournal	MGCLatticeJournalPostingMaintain, and, when the operation runs, the operations the journal needs (delegated rights)

The operator role can therefore submit every async operation except fixed asset disposals, intercompany journals, journal reversals and pending price activations, which need the administrator role; an existing journal that has an intercompany line or a fixed asset disposal line is refused for it when the operation runs.

The rights are always checked for the user who submitted the operation, not for the user the operation runs as. The process automation sweep may run a queued operation under its own owner, so both the processor's check of the target operation and the journal posting service's delegated rights check use the submitting user.

---

Data Management

MGCLatticeDmfConfigService

Operation	Description
captureSpec	Read an environment's data projects and recurring data jobs as a specification
specFromPackageManifest	Turn a data package's manifest into a specification
diffSpec	Compare a specification with the environment, without changing it
applySpec	Make an environment match a specification

Privilege: MGCLatticeDmfConfigServiceView (captureSpec, specFromPackageManifest, diffSpec, in MGCLatticeIntegrationServiceOperationsDuty); applySpec: MGCLatticeDmfConfigServiceApply (high-risk)

MGCLatticeDmfMappingService

Operation	Description
validateMappings	Check the field mappings of data projects; read-only
refreshMappings	Add missing field mappings, remove mappings to fields that no longer exist and, on request, regenerate a stale staging-to-target mapping

Privilege: MGCLatticeDmfMappingServiceView (validateMappings, in MGCLatticeIntegrationServiceOperationsDuty); refreshMappings: MGCLatticeDmfMappingServiceMaintain (high-risk)

---

Database Access

MGCLatticeDbAccessService

Operation	Description
requestAccess	Request time-bound db_owner access to AxDB
revokeAccess	Revoke the caller's active grants (request contract MGCLatticeDbAccessRevokeRequestContract)

Privilege: MGCLatticeDbAccessAdminPrivilege, in MGCLatticeDbAccessAdminDuty (the high-risk MGCLatticeDatabaseAccessAdministrator role only; see Database Access Administrator above)

---

Service Metadata Explorer

MGCLatticeServiceMetadataExplorer (MenuItemDisplay)

Permission	Access
Read	Allow

MGCLatticeServiceMetadataRefresh (MenuItemAction)

Permission	Access
Read	Allow
Invoke	Allow
Delete	Allow

Privileges: MGCLatticeServiceMetadataExplorerPrivilege grants the explorer (MGCLatticeServiceMetadataExplorer); MGCLatticeServiceMetadataRefreshExecute grants the refresh (MGCLatticeServiceMetadataRefresh). The explorer shows Refresh metadata only to users who hold the refresh privilege, which only MGCLatticeServiceMetadataExplorerDuty (administrator role) carries.

---

File Ingestion

The file ingestion framework pulls inbound files from external sources (Azure Blob storage, Azure File share, SFTP) and processes them as bundles. Access is split between a maintenance privilege (configuration and execution) and a view privilege (monitoring).

MGCLatticeFileIngestConnection (MenuItemDisplay)

Permission	Access
Create	Allow
Read	Allow
Update	Allow
Delete	Allow

MGCLatticeFileIngestConnectionEnabled (MenuItemDisplay)

The Active connections tile target on the file ingestion operations workspace.

Permission	Access
Create	Allow
Read	Allow
Update	Allow
Delete	Allow

MGCLatticeFileIngestConnectionWizard (MenuItemDisplay)

The New file ingestion connection wizard, which creates a connection with its secret.

Permission	Access
Create	Allow
Read	Allow

MGCLatticeFileIngestPull (MenuItemAction)

Permission	Access
Read	Allow
Invoke	Allow

MGCLatticeFileIngestSegmentController (MenuItemAction)

Permission	Access
Read	Allow
Invoke	Allow

MGCLatticeFileIngestCleanup (MenuItemAction)

Permission	Access
Read	Allow
Invoke	Allow

MGCLatticeLiquidTester (MenuItemDisplay)

Permission	Access
Read	Allow

Privilege: MGCLatticeFileIngestMaintain

MGCLatticeFileIngestBundleInquiry (MenuItemDisplay)

Permission	Access
Read	Allow

Privilege: MGCLatticeFileIngestView

Security note - connection credentials: The MGCLatticeFileIngestConnection table holds each connection's secret (Azure connection strings, shared access signatures (SAS), account keys, or SFTP passwords and keys). A secret entered on the connection page is stored in the AuthSecret field, encrypted with the platform encryption service (the mechanism the platform uses for the email SMTP password). The key belongs to the environment, so every AOS and batch server can decrypt it. The AuthSecretKvRef field holds only an Azure Key Vault secret reference, which is not a secret. The connection page never displays a stored secret, and every save or decrypt writes a platform encryption audit row (SysEncryptionLog). Apply least-privilege credential scoping:

• Use a scoped SAS token restricted to the specific inbound container/folder, with only the permissions the framework requires.
• For SFTP, provision a dedicated key granted read + delete on the inbound folder only - no broader filesystem access. The framework deletes source files after a successful pull, so delete permission on the inbound folder is required, but write/create access elsewhere is not.
• Rotate these credentials on a defined schedule and store master copies in Azure Key Vault rather than in shared documents or source control, or keep the secret only in Key Vault and store a reference on the connection (Key Vault secrets). MGCLatticeFileIngestMaintain does not let a user read a stored secret, but it does let them replace or clear it and run the connection with it, so restrict it to trusted integration administrators only; use MGCLatticeFileIngestView for monitoring-only staff.

---

OData Entity Metadata Explorer

The OData entity metadata explorer lets users inspect public OData data entity metadata and refresh the discovery cache.

MGCLatticeODataEntityMetadataExplorer (MenuItemDisplay)

Permission	Access
Read	Allow

MGCLatticeODataMetadataRefresh (MenuItemAction)

Permission	Access
Read	Allow
Invoke	Allow
Delete	Allow

Privilege: MGCLatticeODataEntityMetadataExplorerPrivilege

---

Posting Preview

MGCLatticePostingPreviewExecute grants invoke access to the read-only status queries getSalesOrderStatus and getJournalStatus. It grants no posting rights and does not run previews: a posting preview is a posting operation called with its preview flag, granted by that operation's privilege. The privilege commits nothing.

MGCLatticeSalesOrderPostingService.getSalesOrderStatus (ServiceOperation)

Permission	Access
Invoke	Allow

MGCLatticeGeneralLedgerJournalService.getJournalStatus (ServiceOperation)

Permission	Access
Invoke	Allow

Privilege: MGCLatticePostingPreviewExecute (mirrors the entry points granted by MGCLatticeAccountsReceivableServiceView and MGCLatticeGeneralLedgerServiceView)

Duty: MGCLatticePostingPreviewDuty - included in MGCLatticeIntegrationAdministratorRole and MGCLatticeIntegrationOperatorRole.

Attribution: Preview runs of posting operations are recorded in the service call log with IsPreview = Yes, so what-if executions are distinguishable from committed postings for audit and SLA reporting.

---

Service Test Console

The service test console lets an administrator invoke integration service operations in-process and save/replay named test requests, from a form under System administration. It performs real operations against live data. Holding the console duty is not enough to run an operation: the console runs only operations of Lattice services, and only when the user also holds a privilege that grants the service operation, exactly as a call through the service endpoint requires. File ingestion invokes operations through the same runner, so the account that runs the ingestion batch needs those privileges too.

MGCLatticeServiceTestConsole (MenuItemDisplay)

Permission	Access
Create	Allow
Read	Allow
Update	Allow
Delete	Allow

Privilege: MGCLatticeServiceTestConsoleExecute

Duty: MGCLatticeServiceTestConsoleDuty - included in MGCLatticeIntegrationAdministratorRole only; grant it only to trusted administrators.

---

Service Call Statistics

The service call statistics inquiry surfaces aggregated call metrics (rolled up from the service call log) under System administration, together with the batch that recomputes the rollup.

MGCLatticeServiceCallStatistics (MenuItemDisplay)

Permission	Access
Read	Allow

Privilege: MGCLatticeServiceCallStatisticsView (in MGCLatticeIntegrationServiceMonitoringDuty)

MGCLatticeServiceCallStatisticsRollup (MenuItemAction)

Permission	Access
Read	Allow
Invoke	Allow
Delete	Allow

Privilege: MGCLatticeServiceCallStatisticsRollupExecute (in MGCLatticeBatchMaintenanceDuty), so viewing the statistics does not also confer running the rollup.

---

Monitoring Privileges (Data Entity Access)

The monitoring privileges grant read-only access to OData-exposed data entities used for operational monitoring, SLA reporting, and troubleshooting. These privileges enable external systems (such as Power BI, Azure Logic Apps, or custom dashboards) to query integration activity data via OData without requiring service operation invoke rights. All three are in MGCLatticeIntegrationServiceMonitoringDuty, so the administrator, operator and read-only roles hold them.

Each privilege grants Read on its entity, and that grant covers OData access; there is no separate adaptor permission.

MGCLatticeServiceCallLogEntityView

Property	Value
Label	View Service Call Log Entity
Description	Grants read access to the service call log entity for operational monitoring and SLA reporting.
Entity	MGCLatticeServiceCallLogEntity
Entity Read	Allow

Use this entity to monitor all inbound service calls, including timestamps, caller identity, operation invoked, execution duration, and success/failure status. This data supports SLA compliance reporting and integration health dashboards.

MGCLatticeServiceIdempotencyLogEntityView

Property	Value
Label	View Service Idempotency Log Entity
Description	Grants read access to the service idempotency log entity for tracking processed requests and duplicate prevention.
Entity	MGCLatticeServiceIdempotencyLogEntity
Entity Read	Allow

Use this entity to inspect idempotency keys, detect duplicate request submissions, and audit request deduplication behavior. This is critical for ensuring exactly-once processing semantics across integration boundaries.

MGCLatticeAsyncOperationTrackingEntityView

Property	Value
Label	View Async Operation Tracking Entity
Description	Grants read access to the async operation tracking entity for monitoring asynchronous operation status and results.
Entity	MGCLatticeAsyncOperationTrackingEntity
Entity Read	Allow

Use this entity to track the lifecycle of asynchronous operations, including submission time, current status, completion time, and result payloads. This supports integration orchestration patterns where callers submit operations and poll for completion.

---

Implementation Guide

Assigning the Role to an Interactive User

1. Navigate to System administration > Users > Users.
2. Select the target user record.
3. Select Assign roles on the Action Pane.
4. In the role assignment dialog, search for Integration administrator.
5. Select the role and confirm the assignment.
6. The user will have access upon their next session.

Assigning the Role to a Microsoft Entra ID Application Registration

Service-to-service integrations authenticate via Microsoft Entra ID application registrations rather than interactive user accounts. To grant access:

1. Navigate to System administration > Setup > Microsoft Entra ID applications.
2. Select New to register the application.
3. Enter the application (client) ID of the Microsoft Entra ID application registration in Client Id.
4. Enter a descriptive Name (e.g., "ERP Integration - Production").
5. Set the User ID to a designated service account user.
6. Assign the Integration administrator role to the service account user (see above).

The service account user specified in the Microsoft Entra ID applications record determines the security context under which all service operations execute. All role, duty, and privilege checks apply to this user.

Principle of Least Privilege

The MGCLatticeIntegrationAdministratorRole grants full access to all service operations and monitoring entities. For production deployments, consider creating restricted roles that include only the duties or privileges required by each integration.

Example: Creating a role for an integration that only needs Accounts Payable and General Ledger access.

1. Navigate to System administration > Security > Security configuration.
2. On the Roles tab, select Create new.
3. Provide a name (e.g., MGCLatticeAPGLIntegrationRole) and description.
4. Add the following privileges directly to the role:
   • MGCLatticeAccountsPayableServiceMaintain
   • MGCLatticeGeneralLedgerServiceMaintain
5. Optionally add monitoring privileges:
   • MGCLatticeServiceCallLogEntityView
   • MGCLatticeServiceIdempotencyLogEntityView
6. Publish the security changes: on the Unpublished objects tab, select Publish all.
7. Assign this custom role to the service account user instead of the full MGCLatticeIntegrationAdministratorRole.

Example: Creating a monitoring-only role for operations staff.

1. Create a new security role (e.g., MGCLatticeIntegrationMonitorRole).
2. Add the MGCLatticeIntegrationServiceMonitoringDuty duty to the role.
3. Assign this role to operations and support staff who need read access to integration logs and status data without the ability to invoke any service operations.

Creating a Custom Duty

For scenarios where the predefined duties do not match your access requirements:

1. Navigate to System administration > Security > Security configuration.
2. On the Duties tab, select Create new.
3. Provide a name and description.
4. Add the specific privileges from the table in the Security Privileges section above.
5. Reference this duty from your custom security role.

---

Security Architecture Diagram

MGCLatticeIntegrationAdministratorRole   (full access; every duty except MGCLatticeDbAccessAdminDuty)
|
+-- MGCLatticeIntegrationServiceOperationsDuty  -> 9 module *ServiceMaintain privileges (mutating, non-high-risk)
|                                                  + SalesTradeAgreementServiceMaintain + SalesOrderCaptureServiceMaintain
|                                                  + DmfConfigServiceView + DmfMappingServiceView + InventoryCostCalculateMaintain
|                                                  + JournalPostingMaintain + ExpenseReportServiceMaintain
+-- MGCLatticeIntegrationServiceQueryDuty       -> 6 module *ServiceView privileges (read-only getXxxStatus)
|                                                  + PriceInquiryServiceView + TradeAgreementEntityView
+-- MGCLatticeIntegrationServiceHighRiskDuty    -> FTICancelMaintain + IntercompanyMaintain + FixedAssetsDisposalMaintain
|                                                  + FixedAssetsReverseMaintain + InventoryCostActivateMaintain
|                                                  + PackingSlipCancelMaintain + ProductReceiptCancelMaintain
|                                                  + JournalReverseMaintain + PaymentReverseMaintain
|                                                  + IntegrationOpsManagePrivilege + IntegrationDlqEditReplayMaintain
|                                                  + DmfConfigServiceApply + DmfMappingServiceMaintain
|                                                  + RecurringDataJobEntityMaintain + RecurringDataJobClientEntityMaintain
|                                                  + RecurringJobHealthMaintain
+-- MGCLatticeIntegrationServiceMonitoringDuty  -> ServiceMetadataExplorerPrivilege + monitoring entity views + the monitoring pages, the integration operations workspace (IntegrationOperationsView) and recurring integration health (RecurringJobHealthView)
+-- MGCLatticeServiceMetadataExplorerDuty       -> MGCLatticeServiceMetadataExplorerPrivilege (2) + MGCLatticeServiceMetadataRefreshExecute (1)
+-- MGCLatticeFileIngestDuty                    -> MGCLatticeFileIngestMaintain (7) + MGCLatticeFileIngestView (1)
|                                                  + MGCLatticeFileIngestOperationsView
+-- MGCLatticeApimConfiguratorDuty              -> MGCLatticeApimConfiguratorPrivilege
+-- MGCLatticeDataEntitiesView / Maintain       -> the data entity View / Maintain privileges (+ template export / wide Excel export)
+-- MGCLatticeSetupDuty                         -> inbound order policy, sales origin dimensions, batch job event filters
+-- MGCLatticeODataEntityMetadataExplorerDuty   -> MGCLatticeODataEntityMetadataExplorerPrivilege   ( 2 entry points)
+-- MGCLatticePostingPreviewDuty                -> MGCLatticePostingPreviewExecute                   ( 2 entry points, read-only status queries)
+-- MGCLatticeServiceTestConsoleDuty            -> MGCLatticeServiceTestConsoleExecute               ( 1 entry point)
+-- MGCLatticeIntegrationOpsDuty                -> MGCLatticeIntegrationOpsPrivilege                 (console only; manage actions are high-risk)
+-- MGCLatticeBatchMaintenanceDuty              -> batch and maintenance privileges (log cleanup, sweeps, rollups,
|                                                  business event resends)
+-- MGCLatticeServiceOperationLogConfigDuty     -> MGCLatticeServiceOperationLogConfigMaintain
+-- MGCLatticeFileIngestSimulatorDuty           -> MGCLatticeFileIngestSimulatorPrivilege
+-- MGCLatticeIntegrationInboundInquiryDuty     -> MGCLatticeIntegrationInboundInquiryPrivilege
+-- MGCLatticeCrossReferenceMaintainDuty        -> MGCLatticeExternalSystemMaintain + 7 module cross-reference Maintain privileges

MGCLatticeIntegrationOperatorRole        (posting + queries + monitoring; no high-risk)
+-- MGCLatticeIntegrationServiceOperationsDuty, MGCLatticeIntegrationServiceQueryDuty, MGCLatticeIntegrationServiceMonitoringDuty
+-- MGCLatticeDataEntitiesView, MGCLatticeDataEntitiesMaintain, MGCLatticePostingPreviewDuty
+-- MGCLatticeFileIngestSimulatorDuty, MGCLatticeIntegrationInboundInquiryDuty, MGCLatticeCrossReferenceViewDuty
+-- MGCLatticeIntegrationDeadLetterViewDuty     -> MGCLatticeIntegrationDeadLetterEntityView (dead letters, payload fields denied)

MGCLatticeIntegrationReadOnlyRole        (queries + monitoring only; cannot post or mutate)
+-- MGCLatticeIntegrationServiceQueryDuty, MGCLatticeIntegrationServiceMonitoringDuty
+-- MGCLatticeDataEntitiesView, MGCLatticeIntegrationInboundInquiryDuty, MGCLatticeCrossReferenceViewDuty
+-- MGCLatticeIntegrationDeadLetterViewDuty

MGCLatticeDatabaseAccessAdministrator    (HIGH-RISK; unassigned by default)
+-- MGCLatticeDbAccessAdminDuty             -> MGCLatticeDbAccessAdminPrivilege

No role holds a privilege directly; every privilege reaches its roles through a duty.

Note: Per-privilege entry-point counts for the nine module *ServiceMaintain privileges are in the Appendix. MGCLatticePriceInquiryService.resolveSalesPrice is granted by MGCLatticePriceInquiryServiceView, which is part of MGCLatticeIntegrationServiceQueryDuty.

---

Security Best Practices for Integration

Service Account Management

• Use dedicated service accounts per integration. Each external system or integration partner should authenticate with its own Microsoft Entra ID application registration mapped to its own service account user in D365. This enables granular auditing, independent credential rotation, and isolated access revocation.
• Never share service account credentials across environments. Production, UAT, and development environments must each have their own Microsoft Entra ID application registrations with independent client secrets or certificates.
• Name service accounts descriptively. Use naming conventions that identify the integration partner, environment, and purpose (e.g., svc-erp-integration-prod, svc-warehouse-sync-uat).

Access Control

• Apply the principle of least privilege. Avoid assigning the full MGCLatticeIntegrationAdministratorRole when only a subset of service operations is required. Create custom roles with only the specific privileges needed by each integration.
• Separate operational access from monitoring access. Integration service accounts that invoke operations should not necessarily have the same role as operations staff who monitor logs. Use the MGCLatticeIntegrationServiceMonitoringDuty independently for monitoring-only access.
• Review role assignments periodically. Conduct quarterly access reviews to verify that service accounts still require their assigned roles and that no orphaned accounts retain active access.

Credential Security

• Use certificate-based authentication when possible. Microsoft Entra ID application registrations support both client secrets and certificate credentials. Certificate-based authentication is more secure and eliminates the risk of secret exposure in configuration files.
• Rotate client secrets on a defined schedule. For deployments using client secrets, establish a rotation schedule (90 days recommended) and automate rotation where possible.
• Store credentials in Azure Key Vault. Never store client secrets or certificates in application configuration files, source control, or shared documents. Use Azure Key Vault with managed identities for credential retrieval.
• Scope file ingestion connection credentials tightly. Each file ingestion connection holds an Azure connection string, SAS token, account key, or SFTP password or key for inbound file pulls, encrypted with the platform encryption service in MGCLatticeFileIngestConnection.AuthSecret, or only an Azure Key Vault reference in AuthSecretKvRef. Issue scoped SAS tokens limited to the inbound container, and SFTP keys with read + delete on the inbound folder only, plus write on the archive and error folders when they are set (the framework moves or deletes source files after a pull). Restrict the MGCLatticeFileIngestMaintain privilege - which cannot display a stored secret but can replace or clear it and run the connection with it - to trusted integration administrators, and grant monitoring staff MGCLatticeFileIngestView instead.
• Plan for database copies. Like other platform-encrypted values such as the email SMTP password, file ingestion connection secrets and database access grant passwords may need to be entered again after a database is copied to another environment. Key Vault references are unaffected, which is one more reason to prefer them (Key Vault secrets).

Auditing and Monitoring

• Audit service call logs regularly. Query the MGCLatticeServiceCallLogEntity via OData to monitor for unexpected call patterns, elevated error rates, or unauthorized access attempts.
• Monitor idempotency log growth. The MGCLatticeServiceIdempotencyLogEntity tracks processed request identifiers. Unusual growth patterns may indicate retry storms or misconfigured integrations.
• Track async operation completion rates. Use the MGCLatticeAsyncOperationTrackingEntity to identify stuck or failed asynchronous operations that require manual intervention.
• Integrate with SIEM. Export service call log data to your Security Information and Event Management (SIEM) platform for correlation with broader infrastructure security events.
• Review secret access. Every save or decrypt of a file ingestion connection secret or a database access grant password writes a platform encryption audit row (SysEncryptionLog), so reads of stored secrets can be reviewed alongside the database access grant audit rows.

Environment Isolation

• Use separate Microsoft Entra ID application registrations per environment. Production, staging, and development environments must have distinct application registrations to prevent cross-environment access.
• Do not promote credentials between environments. When promoting code from development to production, credentials must be provisioned independently in each environment. Never copy client secrets or certificates across environment boundaries.
• Restrict production role assignments. Production service accounts should have the minimum required privileges. Broader access may be acceptable in development and testing environments to facilitate integration development.

Network and Infrastructure

• Enforce HTTPS for all service calls. All custom service operations are exposed via the D365 service endpoint, which requires TLS. Verify that integrating systems do not bypass certificate validation.
• Use IP restrictions where applicable. Configure Microsoft Entra Conditional Access policies to restrict service principal authentication to known IP ranges corresponding to your integration infrastructure.
• Enable diagnostic logging in Microsoft Entra ID. Monitor sign-in logs for the Microsoft Entra ID application registrations to detect authentication failures, token acquisition anomalies, or sign-ins from unexpected locations.

Third-party components

The Lattice package includes the third-party .NET libraries listed in Third-party notices. Every build checks them against NuGet's vulnerability advisories.

SSH.NET 2024.2.0 (Renci.SshNet.dll, used by SFTP file ingestion connections) is named in two advisories, GHSA-mggc-4xg6-vcxf and GHSA-q939-rpr3-3284. Both are in SSH.NET's ScpClient, which handles SCP transfers. Lattice does not use it: SFTP connections use SftpClient, and the build fails if Lattice ever references ScpClient. The SSH.NET release that fixes them, 2026.0.0, depends on newer versions of .NET libraries than Finance and Operations loads, so it cannot run there. A security scanner that flags Renci.SshNet.dll in the Lattice package is reporting these two advisories.

---

Appendix: Entry Point Count by Privilege

Module *ServiceMaintain privileges (mutating, non-high-risk operations):

Privilege	Services	Single Operations	Batch Operations	Total Entry Points
MGCLatticeAccountsPayableServiceMaintain	6	14	14	28
MGCLatticeAccountsReceivableServiceMaintain	3	7	7	14
MGCLatticeInventoryServiceMaintain	2	9	9	18
MGCLatticeProductionServiceMaintain	1	8	8	16
MGCLatticeGeneralLedgerServiceMaintain	4	10	10	20
MGCLatticeFixedAssetsServiceMaintain	1	5	5	10
MGCLatticeProjectServiceMaintain	2	5	5	10
MGCLatticeWorkflowServiceMaintain	1	5	5	10
MGCLatticeAsyncOperationServiceMaintain	1	1	0	1
Maintain subtotal	21	64	63	127

Service-operation privileges granted separately: the read-only status queries and high-risk operations are granted by the View privileges (MGCLatticeIntegrationServiceQueryDuty) and high-risk privileges (MGCLatticeIntegrationServiceHighRiskDuty), and the trade-agreement, sales order capture, item cost calculation, journal posting, expense report, DMF configuration, DMF mapping and database access operations have privileges of their own:

Privilege	Services	Single Operations	Batch Operations	Total Entry Points
MGCLatticeAccountsPayableServiceView	1	1	0	1
MGCLatticeAccountsReceivableServiceView	1	1	0	1
MGCLatticeGeneralLedgerServiceView	1	1	0	1
MGCLatticeProductionServiceView	1	1	0	1
MGCLatticeWorkflowServiceView	1	1	0	1
MGCLatticeAsyncOperationServiceView	1	1	0	1
MGCLatticeAccountsReceivableFTICancelMaintain	1	1	1	2
MGCLatticeAccountsReceivablePackingSlipCancelMaintain	1	1	1	2
MGCLatticeAccountsPayableProductReceiptCancelMaintain	1	1	1	2
MGCLatticeGeneralLedgerIntercompanyMaintain	1	1	1	2
MGCLatticeGeneralLedgerJournalReverseMaintain	1	1	1	2
MGCLatticePaymentReverseMaintain	1	2	2	4
MGCLatticeFixedAssetsDisposalMaintain	1	1	1	2
MGCLatticeFixedAssetsReverseMaintain	1	1	1	2
MGCLatticeInventoryCostActivateMaintain	1	1	1	2
MGCLatticeInventoryCostCalculateMaintain	1	1	1	2
MGCLatticeSalesTradeAgreementServiceMaintain	1	1	1	2
MGCLatticeSalesOrderCaptureServiceMaintain	1	1	1	2
MGCLatticeJournalPostingMaintain	1	5	5	10
MGCLatticeExpenseReportServiceMaintain	1	2	2	4
MGCLatticeDmfConfigServiceView	1	3	0	3
MGCLatticeDmfConfigServiceApply	1	1	0	1
MGCLatticeDmfMappingServiceView	1	1	0	1
MGCLatticeDmfMappingServiceMaintain	1	1	0	1
MGCLatticeDbAccessAdminPrivilege	1	2	0	2 (plus 2 menu item entry points: the Database access grants page and the expiry sweep)
MGCLatticeServiceMetadataExplorerPrivilege	--	2	0	2
MGCLatticeServiceMetadataRefreshExecute	--	1	0	1

Notes:

• Overlap: each status query is granted by its module *ServiceView privilege, not by the module *ServiceMaintain privilege. MGCLatticePostingPreviewExecute (2 entry points) re-grants the getSalesOrderStatus and getJournalStatus queries and so is not added to any total here.
• Price inquiry: MGCLatticePriceInquiryService.resolveSalesPrice (1 read-only operation) is granted by the MGCLatticePriceInquiryServiceView privilege, in MGCLatticeIntegrationServiceQueryDuty, and is not counted above.
• Menu / entity privileges are not service operation entry points and are excluded from the counts above: the three monitoring entity views (MGCLatticeServiceCallLogEntityView, MGCLatticeServiceIdempotencyLogEntityView, MGCLatticeAsyncOperationTrackingEntityView), the file-ingest, OData, service-test-console (MGCLatticeServiceTestConsoleExecute) and service-call-statistics (MGCLatticeServiceCallStatisticsView) privileges, and MGCLatticeIntegrationOpsManagePrivilege.