Operator role required for Get-PSUCache in 2026.2.1?

Operator role required for Get-PSUCache in 2026.2.1?

avatar
mshepard70

It seems like we need the operator role in order for users to execute Get-PSUCache in an app in 2026.2.1. Line 15 in the function is a Get-PSUCache call ( $CPM = Get-PSUCache -Key CPM )

[9/21/2026 10:08:11 AM] [Error] [App-CRM Banking Dashboard]
at Get-CPMTable, E:\psuSites\JHBDashboard_data\UniversalAutomation\Repository\dashboards\CRMBankingDashboard\modules\CPMBackEnd\1.0.0\Public\Get-CPMTable.ps1: line 15
at dynamicCPMTable: line 4
at dynamicCPMTable: line 3
at dynamicCPMTable: line 1
at CPM.ps1
[9/21/2026 10:08:11 AM] [Error] [App-CRM Banking Dashboard] Permission denied. The role specified does not have access to this resource.
[File]: CPM.ps1
[Endpoint]: dynamicCPMTable
[Page]: b1c7879d-5fea-4f55-8d58-66bc9a85dc0d

The description for Operator says it can add or remove psu resources like scripts or endpoints. That seems like way too much power for someone who needs to access cache programmatically.

All Comments (1)

avatar
rubentapia

Hello @mshepard70

Thank you for reporting this. I understand the concern. Assigning the Operator role solely to allow an application user to read a cache value would provide substantially broader permissions than the operation itself requires.

I would like to validate this behavior before determining whether it is expected authorization behavior or something specific to 2026.2.1.

Could you please confirm the following?
• What role or roles are currently assigned to the affected users?
• Is API security configured as Strict or Permissive?
• Did this work without the Operator role in a previous PSU version? If so, which version?
• Does the behavior change if the cache call is executed using:

Get-PSUCache -Key CPM -Integrated

Support for Integrated mode with Strict API security was added in PSU 2026.1.4, so this comparison will help us determine whether the request is being authorized differently when executed from the App.

We will also attempt to reproduce the scenario internally using 2026.2.1 and compare the behavior across user roles before reaching a conclusion.

Because this is a public forum, please sanitize all evidence before posting. Remove credentials, tokens, license keys, cookies, private keys, full connection strings, email addresses, usernames, customer data, tenant or account identifiers, internal domains, hostnames, IP addresses, and private URLs. Please do not upload unredacted HAR files, memory dumps, database backups, or complete configuration files to this public thread.

References:
https://devolutions.net/powershell-universal/release-notes/

Best regards,
Ruben Tapia