Catalogue › Security and Compliance

Security and Compliance

Use it in Copilot Cowork: download the Security and Compliance plugin for Copilot Cowork and upload it in Cowork under Customize > Plugins > Upload plugin. How to install.

Reviewer-class: security model review, business units and teams, field-level security, marketing consent compliance and data retention. Blocking findings are not overruled by the department under review.

Layer Reviewer (reviewer-class)

Lead role modelled Security Architect and Data Protection Officer

Subject lead Both

Agent charter .claude/agents/security-compliance.md

Install

Claude Code:

/plugin marketplace add SimonFoote-greensparx/d365forge
/plugin install security-compliance@d365forge

ChatGPT and Codex: add this repository as a plugin marketplace, or copy this folder into .agents/skills/ in your project.

Reviewer-class

This department also reviews what other departments build. It holds no write surface in that capacity, and its blocking findings are not overruled by the department under review. Disagreement escalates to the executive sponsor or steering committee.

Skills

Skill What it covers Status

security-compliance:business-units-and-teams Designs and reviews the Dataverse business unit tree and the use of owner, access and Entra ID group teams, so that data is segregated only where it must be, and classifies findings as blocking or advisory. Use when deciding business units, choosing team types, planning a restructure or modelling several legal entities. reviewed

security-compliance:data-retention Designs and reviews how long CRM data is kept and how it is deleted, anonymised or retained, covering bulk deletion, Dataverse long-term retention, audit logs, call recordings and downstream copies, and classifies findings as blocking or advisory. Use when setting retention rules, planning deletion jobs or handling erasure requests. reviewed

security-compliance:field-level-security Decides which Dataverse columns need column-level protection, designs field security profiles and checks that the protection holds in exports, reports and integrations, classifying findings as blocking or advisory. Use when values such as salary, bank details or vulnerability flags must be hidden from some users who can see the record. reviewed

security-compliance:marketing-consent-compliance Reviews marketing consent against UK GDPR and PECR, covering lawful basis, consent records, soft opt-in, preference centres, tracking and subject access across Customer Insights - Journeys and seller outreach, and classifies findings as blocking or advisory. Use when marketing is about to go live or consent is being migrated. reviewed

security-compliance:security-model-review Reviews a Dataverse security model as an independent reviewer, covering security roles, privilege depth, teams, hierarchy security, record sharing and Entra ID access, and classifies every finding as blocking or advisory. Use when a role matrix needs sign-off, before UAT or go-live, or when users see records they should not. reviewed

Skill	What it covers	Status
`security-compliance:business-units-and-teams`	Designs and reviews the Dataverse business unit tree and the use of owner, access and Entra ID group teams, so that data is segregated only where it must be, and classifies findings as blocking or advisory. Use when deciding business units, choosing team types, planning a restructure or modelling several legal entities.	reviewed
`security-compliance:data-retention`	Designs and reviews how long CRM data is kept and how it is deleted, anonymised or retained, covering bulk deletion, Dataverse long-term retention, audit logs, call recordings and downstream copies, and classifies findings as blocking or advisory. Use when setting retention rules, planning deletion jobs or handling erasure requests.	reviewed
`security-compliance:field-level-security`	Decides which Dataverse columns need column-level protection, designs field security profiles and checks that the protection holds in exports, reports and integrations, classifying findings as blocking or advisory. Use when values such as salary, bank details or vulnerability flags must be hidden from some users who can see the record.	reviewed
`security-compliance:marketing-consent-compliance`	Reviews marketing consent against UK GDPR and PECR, covering lawful basis, consent records, soft opt-in, preference centres, tracking and subject access across Customer Insights - Journeys and seller outreach, and classifies findings as blocking or advisory. Use when marketing is about to go live or consent is being migrated.	reviewed
`security-compliance:security-model-review`	Reviews a Dataverse security model as an independent reviewer, covering security roles, privilege depth, teams, hierarchy security, record sharing and Entra ID access, and classifies every finding as blocking or advisory. Use when a role matrix needs sign-off, before UAT or go-live, or when users see records they should not.	reviewed

Credit and licence

Created by Simon Foote and Robert Peledie as part of D365Forge. The skills are licensed under CC BY 4.0: use them freely, including commercially, and credit Simon Foote and Robert Peledie when you share or adapt them. NOTICE.md gives the wording.