Implement Security and Optimize Performance
The security hierarchy
Permissions are granted at four levels: entry point, form control, table and field. Privileges bundle permissions, duties bundle privileges, roles bundle duties, and users are assigned roles. Sub-roles let a role inherit another. A menu item without a privilege is invisible no matter what else is configured, and Security diagnostics shows exactly which role grants or denies access.
Record-level security
Extensible data security applies a policy with a query and a constraint that filters rows for a role, user or company. It filters rather than blocks: the user opens the form and sees fewer records. Test XDS with a user in the constrained role, never as an administrator.
Performance
Correct indexes matter more than anything else: filter and join on indexed fields in index order, keep the clustered index narrow, and review the query plan when a form or batch job slows down. Prefer set-based statements over loops, avoid forupdate unless you update, use RecordInsertList for bulk inserts, and cache reference data instead of re-reading it. Batch work belongs in the SysOperation framework with parallelism where supported. Use SQL Insights, the trace parser, LCS environment monitoring and the profiler to locate the real hot spot before changing code.
Trap: assuming a role grants see-all, or that role assignment alone is enough when the privilege lacks table permission. Another: adding an index with fields in the wrong order and expecting the query to use it. Rule of thumb: if a user can open a form but sees no rows, suspect an XDS policy or a missing table permission.