Lesson 1 of 5
Roles from the business view
10 min
Authorization testing has a reputation as a technical job for the security team. The security team builds roles, but only the business can say whether a role lets a billing clerk do the whole job and nothing more. This course teaches key users and process owners to test roles from that business view: start from the job, prove the job can be done, prove what must be blocked is blocked, and leave evidence an auditor will accept.
What a business role is
In SAP S/4HANA a business role bundles what a person in a job needs: the apps on their launchpad and the authorizations behind them. In on-premise and private cloud systems, a business role is a role maintained in the role maintenance transaction PFCG; it references business catalogs (sets of apps) and holds the authorization objects and values the apps check. SAP delivers business role templates, named with the prefix SAP_BR_, such as SAP_BR_BILLING_CLERK or SAP_BR_CREDIT_CONTROLLER, which projects copy and adapt rather than edit. In SAP S/4HANA Cloud Public Edition, administrators build business roles from templates and business catalogs in the Maintain Business Roles app and set restrictions there.
Start from tasks, not from apps
A role test design starts from a job description, not from the role's app list. Write down what the person must be able to do, and just as carefully, what they must not. The second list is where the risk lives.
| Job: Contoso billing clerk | Must be able to | Must not be able to |
|---|---|---|
| Billing | Create billing documents from deliveries for sales organization 1710; cancel and recreate an incorrect invoice | Create billing documents for another company's sales organization |
| Corrections | Create a credit memo from an approved credit memo request | Create a credit memo without a request; approve credit memo requests |
| Pricing | Display prices on invoices | Change pricing condition records |
| Customers | Display customer master data | Change customer bank details or credit limits |
| Finance | Display the journal entry for an invoice | Post manual journal entries or clear customer payments |
Mapping tasks to roles and apps
Next, map each task to the business role that should grant it and the app or transaction the user will use. Gaps show up immediately: a task with no app in the role, or an app in the role that no task needs. The second kind is common when templates are copied without trimming, and it is often where an unwanted capability hides.
- Job descriptionAgreed with the manager, including the must-not list
- Task listEach task phrased as an action on a business object in an org unit
- Role mappingTask → business role → app or transaction
- Gap checkTasks without apps, apps without tasks
- Test designOne positive test per must-do task; one negative test per must-not task
Several roles per person
Real users rarely hold one role. A Contoso billing clerk in Chicago may also hold a display role for finance and a baseline role that every employee gets. Design tests for the combination a real person will have, not only for each role in isolation, because access granted by one role can undo a restriction in another. Ask the security team for the planned user-to-role assignments early; they are as much a test input as the roles themselves.
What would you do?
The security team sends Maria a copy of SAP_BR_BILLING_CLERK renamed for Contoso and asks her to "test the role". Where should she begin?
- A business role bundles apps and authorizations for a job; on-premise it is a PFCG role, in Public Edition it is maintained in Maintain Business Roles.
- SAP delivers SAP_BR_ templates that projects copy and adapt.
- Design role tests from a job description with both must-do and must-not lists.
- Map tasks to roles and apps; look for tasks without apps and apps without tasks.
Check your understanding · not graded
Lesson check
1. What prefix do SAP's business role templates use?
2. Who should define what a billing clerk must not be able to do?
3. An app is in the role but no task needs it. What does this suggest?
4. In Public Edition, where are business roles built and restricted?