The requirement is static because the preflight runs at Synapse setup, before data-set resolution — at that point the flow doesn't know whether it will create a data set or just add pieces to an existing one. So it asks for the worst case.
Consequence: a least-privilege key scoped to AddPieces only (exactly the kind of key the scoped-sessions feature encourages) can't run add against an existing data set, even though the operation it would actually perform is fully authorized. The gating error tells the owner to grant CreateDataSet for an upload that will never create anything.
Same pattern check is worth doing for import (same upload flow) when fixing.
The requirement is static because the preflight runs at Synapse setup, before data-set resolution — at that point the flow doesn't know whether it will create a data set or just add pieces to an existing one. So it asks for the worst case.
Consequence: a least-privilege key scoped to
AddPiecesonly (exactly the kind of key the scoped-sessions feature encourages) can't runaddagainst an existing data set, even though the operation it would actually perform is fully authorized. The gating error tells the owner to grantCreateDataSetfor an upload that will never create anything.Same pattern check is worth doing for
import(same upload flow) when fixing.