Skip to content

Commit 5ff9af6

Browse files
docs: fix inaccurate compile-time permissions.write validation claim in debug prompt (#1617)
1 parent 158f305 commit 5ff9af6

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

prompts/debug-ado-agentic-workflow.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -416,7 +416,7 @@ this action. Details: identity 'Build\<guid>', scope '<scope>'.
416416
- **ARM service connection not authorized**: The pipeline needs explicit authorization for the service connection. Go to the pipeline's settings in ADO and authorize the service connection.
417417
- **Token scope insufficient**: The ARM service connection may not have the required permissions on the ADO project. Verify the connection's role assignments.
418418
- **Cross-project failure (`VS800075`)**: The pipeline is trying to act on a resource in a different project than where it runs and "Limit job authorization scope to current project" is ON. Either turn the toggle off (broader scope) or use a write service connection whose identity has explicit rights in the target project.
419-
- **Compile-time validation**: The compiler should catch missing `permissions.write` when write-requiring safe outputs are configured. If you're seeing this at runtime, the front matter may have been edited without recompiling.
419+
- **No compile-time error for missing `permissions.write`**: The compiler does **not** require `permissions.write` for write-bearing safe outputs — it emits a valid pipeline regardless, using `$(System.AccessToken)` as the default write token. Permission failures are purely a runtime concern. There is no "recompile to fix this" path; the fix is granting the right permission to the build identity or setting `permissions.write` to an ARM service connection with sufficient rights.
420420

421421
**Diagnosis hint when reporting**: include the full `TF401027` line (with `<PermissionName>` and the `Build\<guid>` value), the failing safe-output `name`, the target repo / PR / work item id, and — if you have it — whether the build identity has an explicit Deny vs missing Allow on the target. The [`safe-output-permissions.md`](../docs/safe-output-permissions.md) reference page has the REST recipe to pull this in one curl.
422422

0 commit comments

Comments
 (0)