Logic Sentinel

Logic Sentinel (long form: Logic Fabric Sentinel) audits the security of a Logic Fabric project. It maps who can trigger or reach which artifacts and data, through users, teams, security roles and their privileges, and reports privilege-escalation paths, gaps in business process authorization, separation-of-duties conflicts and exposed secrets. Each finding has a risk score, evidence and a fix.

Logic Sentinel is read-only. It never writes to Dataverse, so it is safe to run against production.

Run a security scan

1. Sign in to Logic Sentinel and select the Project.
2. Select Run security scan. Progress shows the roles, privilege grants, users and teams, and artifacts being read, followed by deeper analysis of each artifact.
3. Review the report, starting with Attack scenarios and Since last scan.
4. Select ⤓ Download HTML to share the report.

To reopen an earlier report, choose it from Scan history (Open a past scan…). Each entry shows when it ran and its count of critical, warning and info findings.

The report

Part	What it shows
Summary	Counts of Critical, Warning and Info findings and attack paths.
Since last scan	New and Resolved findings compared with the previous scan.
Attack scenarios	Plain-language stories of how weaknesses chain together: what the attacker has, the steps, the result and the Blast radius.
Attack graph	Chains from an entry point (a user, team or role), through artifacts, to an impact. Hover to trace a chain.
Role risk	Security roles ranked by risk: how many people hold each role, its widest scope, and how many tables it can write to and delete from, including organization-wide write and delete.
Findings	Every finding, ranked by risk score, with filters by severity and type of issue.

Findings

Each finding shows:

• A risk score from 0 to 100, combining impact, likelihood and exposure.
• A severity: Critical, Warning or Info.
• Whether its evidence is ✓ evidence verified or unverified, and whether it was inferred from indirect signals.
• The Impact, an explanation and the Evidence.
• How to fix: the recommended remediation.

Type of issue	What it looks for
Attack path	Chains that let a principal reach a sensitive action or data they shouldn’t.
Privilege escalation	Ways to gain more access than a role grants, for example through logic that runs with broader rights.
Data-flow / taint	Untrusted input that flows into sensitive operations.
Secrets	Hardcoded secrets, for example in configuration values or service connections.
Separation of duties	One person or role able to perform steps that should be split.
BPM authorization	Business processes that can be started or advanced by more people than intended.
Access hygiene	Over-privileged application or service users, guest or disabled users that still hold access, and over-broad share or assign rights.

Findings can also be filtered by the artifact type they concern, such as flow, block, recipe, business process, event, schedule, service connection or configuration.

How it behaves

• Read-only. Nothing is written back to your environment, and the report says so.
• Runs as you. The scan sees only what your Dataverse security roles let you read. For a complete picture, run it with an account that can read security roles, users and teams.
• Faster rescans. Each scan is compared with the previous one, and artifacts that haven’t changed are reused.
• Project-scoped history. Scan history is available only to members of the project. A scan in progress can be seen only by the person who started it.

Example

A Sentinel scan of the Sales project reports a critical finding with a risk score of 86: the Sales Rep role, held by 140 users, can trigger a logic flow that updates any account’s credit limit, because the flow doesn’t check who is calling it. The attack scenario shows the steps and the blast radius (every account in the organization). How to fix suggests adding a precondition to the flow and restricting the role’s write scope. After the fix, the next scan lists the finding under Resolved.

Related

• Logic Guard
• Preconditions
• Assignment and tasks
• Logic Foundry security tools