title: CRM2011: create a role that is able to delete invoice products, but not able to delete the invoice
body: <p><img src="https://i.stack.imgur.com/EPm9H.png" alt="enter image description here">Is that possible to define a security role that is not able to delete any invoice but able to delete invoiceproduct of any invoice?</p>
  
  <p>The environment is not customized, and the definition( Tab:Mscrm.Form.invoicedetail.MainTab-->Group:Mscrm.Form.invoicedetail.MainTab.Groups-->Group:Mscrm.Form.invoicedetail.MainTab.Save-->Controls:Mscrm.Form.invoicedetail.MainTab.Save.Controls) for the ribbon button is</p>
  
  <pre><code>&lt;Button Id="Mscrm.Form.invoicedetail.Delete" ToolTipTitle="$Resources:Mscrm_Form_Other_MainTab_Management_Delete_ToolTipTitle" ToolTipDescription="$Resources(EntityDisplayName):Ribbon.Form.Tooltip.Delete" Command="Mscrm.DeletePrimaryRecord" Sequence="70" LabelText="$Resources:Ribbon.HomepageGrid.MainTab.Management.Delete" Alt="$Resources:Ribbon.HomepageGrid.MainTab.Management.Delete" Image16by16="/_imgs/ribbon/Delete_16.png" Image32by32="/_imgs/Workplace/remove_32.png" TemplateAlias="o2" ModernImage="Remove" /&gt;
  </code></pre>
  
  <p>And the corresponding Command Definition is</p>
  
  <pre><code>  &lt;CommandDefinition Id="Mscrm.DeletePrimaryRecord"&gt;
      &lt;EnableRules&gt;
        &lt;EnableRule Id="Mscrm.FormStateNotNew" /&gt;
        &lt;EnableRule Id="Mscrm.EntityFormIsEnabled" /&gt;
        &lt;EnableRule Id="Mscrm.CanDeletePrimary" /&gt;
      &lt;/EnableRules&gt;
      &lt;DisplayRules&gt;
        &lt;DisplayRule Id="Mscrm.DeletePrimaryEntityPermission" /&gt;
      &lt;/DisplayRules&gt;
      &lt;Actions&gt;
        &lt;JavaScriptFunction FunctionName="onActionMenuClick" Library="/_static/_forms/form.js"&gt;
          &lt;StringParameter Value="delete" /&gt;
          &lt;CrmParameter Value="PrimaryEntityTypeCode" /&gt;
        &lt;/JavaScriptFunction&gt;
      &lt;/Actions&gt;
    &lt;/CommandDefinition&gt;
  </code></pre>
  
  <p>It seems it is not able to create such a role meet the requirement.
  because 
  1. In the 'displayrule' section, it needs 'Mscrm.DeletePrimaryEntityPermission' permission.
  2. In the 'enablerule' section, it needs 'CanDeletePrimary' permission.</p>
  
  <p>Thanks in advance</p>