Lesson 2 of 6
The role-to-process matrix
7 min
Listen to this lesson
Role tests are only as good as the list of what each role should and should not do. That list is the role-to-process matrix: business roles down one side, process steps and apps across the top, and a clear mark in each cell for "allowed", "allowed with restriction" or "not allowed". Security uses it to build roles; testers use it to derive tests.
| Process step / app | Sales clerk (1710) | AP clerk (1710) | Buyer (Chicago) | Warehouse clerk (Chicago) |
|---|---|---|---|---|
| Create sales order (VA01 / Manage Sales Orders) | Allowed, sales org 1710 | Not allowed | Not allowed | Not allowed |
| Create purchase order (ME21N / Manage Purchase Orders) | Not allowed | Not allowed | Allowed, plant 1720, purchasing group 001 | Not allowed |
| Post goods receipt (MIGO) | Not allowed | Not allowed | Not allowed | Allowed, plant 1720 |
| Post supplier invoice (MIRO / Create Supplier Invoice) | Not allowed | Allowed, company code 1710 | Not allowed | Not allowed |
| Change supplier bank details (business partner) | Not allowed | Not allowed | Not allowed | Not allowed |
Part of Contoso's role-to-process matrix. Each cell becomes at least one test.
- Is the cell marked "allowed"?Yes → positive test, completed through save · No → next question
- Is it "allowed with restriction", such as plant 1720 only?Yes → positive test inside the restriction plus a negative test outside it, such as plant 1710 · No → next question
- Is it "not allowed"?Yes → negative test if the denial is high priority: wrong org unit, wrong activity, sensitive data, direct start, SoD · Otherwise → cover by spot check
Deriving positive tests
Every "allowed" cell becomes a positive test: log on as a test user with exactly that role and complete the step end to end, including saving and any follow-on display the user needs. Do not stop at "the app opened". Many authorization checks only run when you save, change a status or navigate to a related document. A buyer role that can open Manage Purchase Orders but fails on save has not passed.
Positive tests should also cover the restriction. If the buyer is allowed for plant 1720 only, the positive test uses plant 1720. The matching negative test uses plant 1710.
Remember the steps around the main transaction. A sales clerk who creates an order usually also needs to display the customer, check stock availability, view the price and print or send the order confirmation. If the matrix lists only "create sales order", the clerk may be able to save an order but not see why it was blocked. Walk through the job with the key user and add the supporting displays to the matrix; they are a common source of day-one tickets.
- Display the customerGreat Lakes Fleet Services in sales area 1710 / 10 / 00.
- Check availabilityStock of CMC-ALT-100 in plant 1710.
- View the priceConditions and the fleet agreement.
- Create and save the orderThe step usually listed in the matrix.
- Send the confirmationOutput to the customer and a follow-on display of the order.
Deriving negative tests
Negative tests prove that access that should be denied is denied. You cannot test every "not allowed" cell for every role, so prioritize. Test the denials that matter most:
- Wrong organizational unit: the Chicago buyer tries to create a PO for plant 1710.
- Wrong activity: a display-only finance user tries to change a journal entry or a cost center.
- Sensitive data: an AP clerk tries to change supplier bank details.
- Out-of-role apps: a sales clerk tries to open a purchasing app directly by URL or transaction code, not just by looking for the tile.
- Segregation of duties: a user tries to do both halves of a conflicting pair (covered in a later lesson).
What would you do?
Security has built a new buyer role for Contoso's Chicago plant 1720. Priya has time for three tests. Which set gives the best coverage?
- The role-to-process matrix lists, per role, which steps are allowed, restricted or not allowed.
- Each allowed cell is a positive test, completed through save, not just app start.
- Prioritize negative tests: wrong org unit, wrong activity, sensitive data, direct start of out-of-role functions, SoD.
- Hiding a tile is not a denial; test the transaction or URL directly.
Check your understanding · not graded
Lesson check
1. Which is a NEGATIVE role test?
2. Why must a positive test go as far as saving the document?
3. The Chicago buyer role is restricted to plant 1720. Which negative test follows directly from that?
4. Why is a hidden tile not proof that access is denied?