A plugin step whose required privilege no role grants

No operational role grants the required privilege.

A plugin step runs on a CRUD message against a table whose privilege no operational role grants, so least-privilege users hit access errors and the step does not execute. A functional-coverage gap, not over-privilege.

For each plugin step, note its message and target table, then check whether any role your users actually hold grants the matching create, write or delete privilege on that table. System Administrator does not count, since it holds everything by definition and tells you nothing about the real user population.

Add the missing privilege to a role the users already hold, custom or out-of-the-box.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A security role assigned to both people and integrations
• An integration account holding System Administrator
• An integration account that can grant itself privileges
• A non-admin role that can grant itself administrator