Testing Business Roles and Authorizations

Keep this: job aid

Role testing card

• Start from the job: must-do and must-not lists signed by the business.
• One positive test per must-do task; one negative test per must-not task.
• Always test with a dedicated user holding only the target role.
• Run tasks to their business result; a visible tile is not proof.
• Cover every org unit the job uses; try forbidden org units in negative tests.
• Capture failures: message, SU53 or trace (Display Authorization Trace in Public Edition).
• SoD: do the allowed step, attempt the conflicting step, expect a refusal.
• Accepted conflicts need a mitigating control with owner, frequency and evidence.
• Retest after role changes, new role combinations, upgrades and org changes.
• Record role version, test user, expected and actual result, tester and date.