Hello,

Record permission definitions are stored in the SysEntitySchemaRecordDefRight table, while the actual record-level permissions are stored in system-generated tables such as SysCaseRight, SysContactRight, or, in general, Sys[ObjectName]Right.

Unfortunately, neither SysEntitySchemaRecordDefRight nor Sys[ObjectName]Right records can be migrated using the standard OOTB data binding mechanism available in packages and require an SQL script to be transfered between environments.

Example you might find useful:

INSERT INTO "SysFolderTreeRight"("Id","RecordId","SysAdminUnitId","Operation","RightLevel","Position")
VALUES ('9f4d6f1c-74f6-4b2d-a7d6-1c9f0f9f0001','ac7a534b-046b-1534-78ac-1b946522dbaf','a29a3ba5-4b0d-de11-9a51-005056c00008',0,1,0)
ON CONFLICT ("Id") DO UPDATE SET
    "RecordId" = EXCLUDED."RecordId",
    "SysAdminUnitId" = EXCLUDED."SysAdminUnitId",
    "Operation" = EXCLUDED."Operation",
    "RightLevel" = EXCLUDED."RightLevel",
    "Position" = EXCLUDED."Position";

Hi Oshi Varshney,

Two tables are involved, and only one of them is usually worth migrating:

• SysEntitySchemaRecordDefRight — the record permission rules you configured (which role gets Read / Edit / Delete by default). This is what you want to move.
• Sys[YourObject]Right — the actual per-record rights generated at runtime. Leave these alone; the target environment regenerates them.

1. Find your object's SubjectSchemaUId

System Designer → Object permissions → search your object → open it. The UId is right there in the URL:

.../#/AdministratedObjects/25d7c1ab-1de0-4501-b402-02e0e5a72d6e

Or from SQL:

SELECT "UId" FROM "SysSchema" WHERE "Name" = 'UsrYourObject';

2. Generate the INSERT on Dev (PostgreSQL)

WITH TargetPermissions AS (
    SELECT "Id", "AuthorSysAdminUnitId", "GranteeSysAdminUnitId",
           "Operation", "RightLevel", "Position", "SubjectSchemaUId"
    FROM public."SysEntitySchemaRecordDefRight"
    WHERE "SubjectSchemaUId" = '<YOUR-OBJECT-UID>'::uuid
)
SELECT
  'INSERT INTO public."SysEntitySchemaRecordDefRight" ("Id", "AuthorSysAdminUnitId", "GranteeSysAdminUnitId", "Operation", "RightLevel", "Position", "SubjectSchemaUId") VALUES ' || CHR(10) ||
  string_agg(
      '    (' || COALESCE(quote_literal("Id"::text) || '::uuid', 'NULL') || ', '
      || COALESCE(quote_literal("AuthorSysAdminUnitId"::text) || '::uuid', 'NULL') || ', '
      || COALESCE(quote_literal("GranteeSysAdminUnitId"::text) || '::uuid', 'NULL') || ', '
      || COALESCE("Operation"::text, '0') || ', '
      || COALESCE("RightLevel"::text, '0') || ', '
      || COALESCE("Position"::text, '0') || ', '
      || COALESCE(quote_literal("SubjectSchemaUId"::text) || '::uuid', 'NULL') || ')',
      ',' || CHR(10)
  ) || CHR(10) ||
  'ON CONFLICT ("Id") DO UPDATE SET ' ||
  '"AuthorSysAdminUnitId" = EXCLUDED."AuthorSysAdminUnitId", ' ||
  '"GranteeSysAdminUnitId" = EXCLUDED."GranteeSysAdminUnitId", ' ||
  '"Operation" = EXCLUDED."Operation", ' ||
  '"RightLevel" = EXCLUDED."RightLevel", ' ||
  '"Position" = EXCLUDED."Position", ' ||
  '"SubjectSchemaUId" = EXCLUDED."SubjectSchemaUId";' AS insert_sql
FROM TargetPermissions;

The ON CONFLICT ... DO UPDATE is the important part — it makes the script idempotent, so re-running the package install is safe.

Sample of what it produces:

INSERT INTO public."SysEntitySchemaRecordDefRight"
    ("Id", "AuthorSysAdminUnitId", "GranteeSysAdminUnitId", "Operation", "RightLevel", "Position", "SubjectSchemaUId")
VALUES
    ('73dab094-c821-4025-840b-c8d05d519a72'::uuid, 'a29a3ba5-4b0d-de11-9a51-005056c00008'::uuid,
     'b9c3d55d-6598-473b-901b-021399383963'::uuid, 2, 1, 0, '<YOUR-OBJECT-UID>'::uuid)
ON CONFLICT ("Id") DO UPDATE SET
    "AuthorSysAdminUnitId" = EXCLUDED."AuthorSysAdminUnitId",
    "GranteeSysAdminUnitId" = EXCLUDED."GranteeSysAdminUnitId",
    "Operation"            = EXCLUDED."Operation",
    "RightLevel"           = EXCLUDED."RightLevel",
    "Position"             = EXCLUDED."Position",
    "SubjectSchemaUId"     = EXCLUDED."SubjectSchemaUId";

Column meanings: Operation 0 = Read, 1 = Edit, 2 = Delete. RightLevel 1 = granted, 2 = granted with delegation. Position = the order the rules are listed in.

3. Bind it to the package — this is the part that makes it automatic

Configuration → select your package → Add → SQL script. Set:

• DBMS type: PostgreSQL (Creatio cloud is Postgres-only; MSSQL/Oracle need a separate SQL script schema each, with MERGE or an IF EXISTS guard instead of ON CONFLICT)
• Installation type: AfterSchemaData, so it runs after the object and any bound data are installed
• Backward compatible: tick it if you want the package rollback path preserved

4. Make sure the roles exist in the target first

GranteeSysAdminUnitId points at SysAdminUnit rows. 

5. After install, actualize

Record permission rules only apply to records created after the rule exists. In the target environment, open the object's record permissions and run Actions → Update record permissions so existing records pick them up. It's resource-intensive on large tables, so schedule it off-hours.


BR,
Bala.