SAC Security & Row-Level Access
As of 2026-08-16
SAC security = 3 layers: tenant/roles (least privilege, no named admins), model access (read-only production models), row-level (DSP DAC via live connection preferred over SAC-side import DAC). DAC in DSP = enterprise-grade: inherited at query time, single source of truth, zero SAC maintenance. Column security: restricted measure returning NULL in DSP AM. Security test protocol: 5 test users per region, filter bypass attempt, planning data isolation. Joule respects DAC.
What you will learn
- Design the 3-layer SAC security ADR (tenant roles, model access, row-level DAC) before the first data load on a multi-region engagement
- Configure DSP Data Access Controls so SAC inherits row-level security via live connection, eliminating SAC-side import DAC maintenance
- Implement restricted measures in the Datasphere analytic model that return NULL for salary and margin data to unauthorized users
- Execute the 5-user security test protocol (filter bypass included) before UAT opens to verify DAC is enforced at the query layer
SAC security is a three-layer stack: tenant administration, model-level access, and row-level data access. The senior discipline: design all three layers before the first data load, not after the first complaint. Junior failure: build a beautiful story, then discover at UAT that every user can see every region, every salary, every competitor margin. Senior craft: security is designed in the ADR, enforced in Datasphere Data Access Controls, inherited via live connection, and tested with production-like user profiles before any UAT.
Layer 1: Tenant and Role Administration
SAC has a role-based access model. Standard roles: Viewer, Creator, Planner, BI Admin, System Owner. Custom roles extend these. The senior pattern is least privilege plus no admin access for data consumers. Finance viewers need Viewer only; story creators need Creator; no data consumer needs BI Admin. Admin roles are service accounts, not named users. Every named admin access is a potential data leak and an audit finding waiting to happen.
Layer 2: Model-Level Security (Content Security)
Prerequisites
- Intermediate hands-on experience on SAP analytics projects
- Review core concepts first: C008, C019, C020
Outcomes
- Design the 3-layer SAC security ADR (tenant roles, model access, row-level DAC) before the first data load on a multi-region engagement
- Configure DSP Data Access Controls so SAC inherits row-level security via live connection, eliminating SAC-side import DAC maintenance
- Explain the core architecture and decision points for SAC Security & Row-Level Access
- Apply a repeatable implementation pattern in a 15-minute lab format
Full module available to members. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.