Lesson 3 of 5
Negative testing
10 min
A negative role test proves that a user cannot do what the role should not allow: actions outside the job, and actions inside the job but in the wrong organizational units. Negative tests are skipped more often than positive ones, because nobody complains when access is too broad. Auditors and fraudsters both notice eventually.
Two kinds of negative test
Action tests check the activity: create, change, display, approve, post, release. Org tests check that the same activity is limited to the right company code, plant, sales organization, purchasing organization or cost center. Both matter. A purchaser who may create purchase orders for purchasing organization 1710 should not be able to create them for another purchasing organization even though the app is identical.
Org-level restrictions
In on-premise and private cloud roles, organizational restrictions are maintained as organizational levels in the role, for fields such as company code, plant and sales organization; many projects build a master role and derive one role per org unit with different values. In Public Edition, restrictions are set per business role in Maintain Business Roles: for each restriction type you set write, read and value help access to restricted values, and SAP's guidance is to avoid "unrestricted" unless it is genuinely needed. Either way, the test is the same: try the action in a forbidden org unit and expect a refusal.
| Negative test | Role | Attempt | Expected result |
|---|---|---|---|
| NEG-BIL-01 | Billing clerk | Change a pricing condition record for CMC-ALT-100 | Refused: no change authorization; app not on launchpad or save fails with authorization message |
| NEG-BIL-02 | Billing clerk | Bill a delivery from a sales organization outside 1710 | Refused, or the delivery is not visible for selection |
| NEG-PUR-01 | Purchaser, purchasing org 1710 | Create a PO for another purchasing organization | Refused at save, or org value not offered |
| NEG-PUR-02 | Purchaser | Post a goods receipt for the PO | Refused: receiving belongs to the warehouse role |
| NEG-AP-01 | Accounts payable accountant | Change bank details of Lakeside Components | Refused: supplier master changes belong to master data team |
Display is access too
Negative tests are not only about changing data. Some data must not even be seen by some roles: supplier bank details, employee information, margins on customer contracts. If the job description says a role must not see something, write a negative display test and check every app in the role that could show it, including list reports and analytical apps that aggregate data.
What "refused" looks like
- The app is not on the user's launchpad and cannot be reached by a direct link.
- The app opens, but the forbidden action (such as Edit or Post) is not offered.
- The action is offered, but saving fails with an authorization message.
- The forbidden org unit's data is filtered out: the delivery or PO simply does not appear.
All four can be correct. What matters is that the action cannot be completed. Write the expected refusal in advance, so that a surprising path (for example, the action succeeds through a different app) is recognized as a failure.
- Could the action be completed in any way?Yes → negative test failed; raise a defect · No → next question
- Was the refusal the expected type (hidden, not offered, message, filtered)?Yes → pass · No → next question
- Is the unexpected refusal acceptable to the process owner?Yes → pass with note · No → raise a usability defect
What would you do?
Contoso's purchaser test user, restricted to purchasing organization 1710, tries to create a PO for another purchasing organization. The PO saves. What should the tester do?
- Negative tests prove forbidden actions and forbidden org units are blocked.
- Org restrictions: organizational levels in PFCG roles on-premise; restrictions in Maintain Business Roles in Public Edition.
- A refusal can be a missing app, a missing action, an authorization message or filtered data.
- Write the expected refusal in advance, and test side doors for the riskiest actions.
Check your understanding · not graded
Lesson check
1. What does a negative role test prove?
2. Where are org restrictions such as company code and plant typically maintained in an on-premise role?
3. Which result counts as a correct refusal?
4. Why test side doors such as list reports, uploads or classic transactions?