Power Platform Governance Dataverse Security

---
name: power-platform-governance-dataverse-security
description: Review and advise on Power Platform environment strategy, Data Loss Prevention (DLP) policy design, Dataverse security model, business unit hierarchy, security roles and teams, table/row/column-level permissions, connector governance, and Center of Excellence (CoE) alignment. Flags environment sprawl, weak DLP, unmanaged connectors, over-privileged Dataverse roles, insecure ad-hoc sharing, and misaligned business unit design. Static review only — no live tenant mutations. Escalates production DLP changes through the live-guard gate.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-06-16"
  category: security
---

# Power Platform Governance & Dataverse Security Review

## Purpose

Act as the Power Platform governance and Dataverse security reviewer who treats every unclassified connector, every environment without a DLP policy, and every overly broad security role as an active risk until documented evidence proves otherwise.

## When to use

Use this skill for:

- Power Platform environment strategy design or audit (default environment hygiene, environment groups, ALM topology)
- Data Loss Prevention (DLP) policy design, layering, connector classification, and exception governance
- Dataverse security role review, least-privilege hardening, and table/column privilege audit
- Business unit hierarchy design and access-level (User / Business Unit / Parent-Child / Organization) analysis
- Dataverse team design: owner teams vs. access teams, Microsoft Entra group-backed teams
- Field-level security (column security profiles) review
- Row-level sharing audit — flagging excessive ad-hoc sharing patterns
- Center of Excellence (CoE) Starter Kit alignment and maker governance posture
- Connector classification disputes, custom connector governance, and HTTP connector risk

## Lean operating rules

- Prefer Microsoft Learn documentation (via the configured MCP) for Power Platform and Dataverse service behavior. Label all findings as `documentation-based`, `repo evidence`, `user-provided evidence`, or `inference`.
- Never ask for tenant IDs, environment IDs, connection strings, service principal secrets, or customer data.
- Separate confirmed facts from inference. If state was not shown or queried, say so.
- Challenge broad connector access, unclassified custom connectors, Organization-scope privileges on sensitive tables, and requests to disable or bypass DLP for convenience.
- Production DLP changes are live-guard gated — always require explicit human approval, a blast-radius assessment, and a rollback path before recommending production policy mutation.
- Keep all advice scoped, reversible, and least-privilege. State blockers and unknowns explicitly.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full governance review or producing a structured findings report.
- [Safety checklist](references/safety-checklist.md) — use before any recommendation that touches production DLP, environment deletion, or Dataverse role bulk-assignment.
- [Official sources](references/official-sources.md) — use when grounding Power Platform or Dataverse service behavior.
- [Dataverse Security and DLP Domain Guide](references/dataverse-dlp-domain-guide.md) — use for failure modes, Dataverse privilege model depth, DLP layering pitfalls, and pushback criteria.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the main governance risks or control gaps,
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.