Managed App Setup

Not saved yet

The rules behind the live plan

The plan applies the same rules as the td-synnex-managed-app skill (references/decision-rules.md). Rules marked [I] are judgement calls.

Which tool leads

Score each answer, then lead with the tool that is ahead by 2 or more. Within 1 point, use both.

AnswerCodeCowork
Builder is a developer+3
Builder is new to building+3
Builder has some experience but isn't a developer+1
More than 25 users, or writes to confidential data+1
More than one session or person changes the app+2
GitHub repository mode+3
Uses the ms CLI, GitHub Copilot CLI, Claude Code, VS Code or GitHub Actions+2
8 or more screens+2
5 or fewer screens+1
Stage is production+2
Stage is prototype+1
Independent reviewer wanted+1
Weekly health routine wanted+1
Attached requirements, process maps or screenshots+1
Two or more integrations (flows, agents, MCP, custom connectors, Power BI in the app)+1
ResultPatternWhat it means
CodeCode builds, Cowork acceptsCode makes each change and runs the checks; Cowork opens the live app in a signed-in browser and walks the acceptance checklist
CoworkCowork shapes and buildsCowork does discovery, the build and the walk-through; move to Code when the app outgrows it
BothCowork shapes, Code shipsCowork finds the data, people and process and can do the first build; Code engineers, tests and releases

Risk tier

High if any: highly confidential data; sensitive personal data; regulated data; the app sends email; a third-party MCP server; outside web addresses; an organization-wide app that writes data.

Medium if any: confidential data; the app writes records; more than 25 users; automated flows; customer contact data. Low otherwise.

Release bar and extra gates

TierBarExtra gates
LowThe blueprint's bar, 90 by defaultNone
MediumAt least 90The owner's preview checklist is answered
HighAt least 95Independent reviewer score; security review signed off; data owner sign-off

A gate is added when the app sends mail, and another when any source is marked never write.

Permission level for each source

SituationLevel
Dataverse table5, security roles
Read-only source2 with users on Read and only a named account writing, if confidential, unclassified or above; else 1
Highly confidential or regulated, read-write5
Creators edit only their own items, and nobody who creates may edit any3, item-level
Confidential, or more than one role2, own permissions with Contribute
Otherwise1, inherited

SharePoint site address

Blocker if the address is a OneDrive (-my) site, the root site, or has non-ASCII or percent-encoded characters in the site name. It must be https://tenant.sharepoint.com/sites/Name or /teams/Name.