Elevated Privilege Does Not Protect Included Roles - Support and Troubleshooting

Elevated Privilege Does Not Protect Included Roles Issue When a custom role is configured with Elevated privilege = true and contains one or more non-elevated technical roles, the permissions associated with the contained technical roles are available immediately after user login, even if the user has not activated the elevated role through the Elevate Roles dialog.

Steps to reproduce:

1. Create a custom role and Set: Elevated privilege = true 2. For custom role, under Contains Roles, add a role with Elevated privilege = false 3. Create a custom user 4. Assign the custom elevated role to the user. 5.Log in as the test user without elevating any roles. 6.Verify that functionality granted by the contained non-elevated role is available.

Release All

Resolution The reported behavior is working as designed.The Elevated Privilege mechanism applies only to the role that is explicitly configured as elevated. Roles included through the Contains Roles relationship continue to be inherited and evaluated independently of the parent role's elevation state. During review, it was identified that there are multiple out-of-box examples where elevated roles contain non-elevated roles. This confirms that the platform allows and supports this role composition model.

As a result: - An elevated parent role does not act as a security boundary for the permissions of contained non-elevated roles. - Non-elevated roles added through Contains Roles may be effective without activating the parent elevated role. - The observed behavior is consistent with the current platform design.

PRB2073513 : This behavior is as per design.