OmniStudio component without a required permission
Why is this an issue?
OmniStudio and Vlocity components — OmniScripts, Integration Procedures, and FlexCards / OmniUI and Vlocity Cards — can read and write Salesforce data and invoke server-side logic. A required permission acts as an access gate: only users who hold the named permission (a permission set or profile) are allowed to run the component.
When a component declares no required permission, that gate is missing. Any user who can reach the component can execute it, regardless of whether they were meant to have access. This widens the attack surface and can expose sensitive data or operations to unintended users.
This rule does not apply to Data Mappers (OmniStudio OmniDataTransform / Vlocity DataRaptors); those are covered by the field-level-security rule instead.
Examples
In OmniStudio metadata (OmniScripts, Integration Procedures, and FlexCards / OmniUI Cards) the required permission is stored as a requiredPermission field inside the component's propertySetConfig JSON. In the stored metadata that JSON is XML-escaped (for example, "requiredPermission":""); it is shown decoded below for readability.
For OmniScripts and Integration Procedures the permission may instead be declared in a sibling top-level <requiredPermission> element alongside <propertySetConfig>. The rule treats the component as compliant when a non-empty value is present in either location.
Example of incorrect code — the requiredPermission field is absent, empty, or only whitespace:
<OmniUiCard>
<propertySetConfig>{ "isFlex": true, "requiredPermission": "", ... }</propertySetConfig>
</OmniUiCard>
Example of correct code:
<OmniUiCard>
<propertySetConfig>{ "isFlex": true, "requiredPermission": "Account_Manager", ... }</propertySetConfig>
</OmniUiCard>
For Vlocity DataPacks the same setting is expressed as a top-level JSON field. In classic Vlocity DataPacks the field is namespaced (for example, %vlocity_namespace%__RequiredPermission__c), while newer OmniStudio-format DataPacks use RequiredPermission. The rule reports a component when no field whose name contains RequiredPermission holds a non-empty value; a value that is empty or only whitespace is treated as no permission.
Incorrect:
{ "%vlocity_namespace%__RequiredPermission__c": "" }
Correct:
{ "%vlocity_namespace%__RequiredPermission__c": "Account_Manager" }
How can I fix violations?
Declare a required permission on the component so that it is only accessible to authorized users:
In the OmniStudio designer, open the component's properties and set the Required Permission to a permission set or profile that reflects who should be able to run it.
In the underlying metadata, set the
requiredPermissionfield inside the component'spropertySetConfigJSON (OmniStudio) or theRequiredPermissionfield (Vlocity DataPack JSON) to a non-empty value.
Choose the least-privileged permission that still allows the intended users to operate the component.
When should I disable this rule?
You may want to dismiss individual instances for components that are intentionally public and expose no sensitive data or privileged operations — for example, an Integration Procedure that only returns reference data every user is already entitled to see. If your org enforces access control exclusively through another mechanism (such as sharing rules or the platform layer that embeds these components), the rule may report violations you consider acceptable.
Resources