Behavior observed

An agent role that does not have Create privilege on the Knowledge Article entity receives a "Create privilege required on knowledgearticle" error when attempting to link a Knowledge Article to a Case. The same role receives a "Delete privilege required on knowledgearticle" error when unlinking.

Why Append / AppendTo alone are not sufficient

For a true many-to-many relationship, Append (on the child) + AppendTo (on the parent) are enough. Because the case-article relationship is implemented via the knowledgearticleincident child entity instead of a pure intersect table, the platform additionally requires the corresponding CRUD privilege on the parent (knowledgearticle) at the moment the link row is created or deleted.

Request:

The workaround provided from Microsoft engineering was granting the agent role Create and Delete at User-level (Basic depth) on Knowledge Article. This satisfies the platform check while keeping the privilege scope minimal.

However, this exposes a lot of security concerns, as not all businesses are willing to give users control to create/delete KAs at will. We would like to be able to let users link/unlink KAs to records without having create/delete privileges for KAs.