Week 5 of 8
Roles and security
Fusion security is a three-way link: a user, a job role, and a data context such as a business unit, ledger or data access set. Oracle recommends copying predefined roles and removing what users do not need, rather than assigning Oracle’s roles as they ship.
That copy needs maintenance. Oracle says updates can change predefined roles, and that you should carry relevant changes into your custom roles as an ongoing task. How you copied the role decides whether Oracle’s changes reach your users automatically.
This week: build a role test matrix and a quarterly role check
- List every custom job role, the predefined role it was copied from, and the copy option used (top role only, or top role and inherited roles).
- For each role write positive tests (can do the job, in the right business unit or ledger) and negative tests (cannot see another business unit, cannot both create and pay a supplier invoice).
- Test with real test users per role, never with an implementation consultant role.
- Each quarter, run Compare Roles in the Security Console between your copy and the newly shipped role, and log what you adopt.
Number of the week
4 a year
mandatory updates, each able to change Oracle’s predefined roles. Oracle says to carry relevant changes into your custom copies.
Source: Oracle, Securing Applications: Guidance for Assigning Predefined Roles (26D)Use this week
- Oracle Role & Security Test Matrix →
Custom roles, data access tests, SoD pairs and a quarterly Compare Roles log.
- Defect Severity & Triage Matrix →
Agree now how severe “user can see another ledger” is.
Next week: FBDI and HDL loads that “completed successfully” can still be wrong. We set up data load validation.
Get the playbook in your inbox, one week at a time
Subscribe free and every template in the library is yours.