Role & Authorization Design
As of 2026-08-16
Authorization design = least privilege by default, role-based by design, data-scoped where it matters — applied consistently across Datasphere + SAC. Two layers: object authorization (can you open it?) and data authorization (which rows can you see?). Datasphere does row-level via Data Access Controls (DACs) on the model; SAC enforces object roles + consumes the model's DACs. The classic breach: open access ≠ all-data access (regional manager sees every region because no DAC). Role-based not user-based; least privilege + segregation of duties. Data scoping is a legal requirement in utilities (unbundling, M099), pharma (M100), banking (M097), GDPR (M082) — a missing DAC there is a breach. Design a reviewable role→object→data matrix with re-certification for the audit.
What you will learn
- Understand the core concepts behind role & authorization design
- Apply Roles in a typical SAP analytics engagement
- Recognize the 3-5 common mistakes and how to avoid them
- Position this skill in your personal brand and rate conversation
Module overview
Authorization design decides who can see and do what across the analytics estate — and it is the control that, done badly, either leaks data or grinds the platform to a halt with access tickets. The senior principle is least privilege by default, role-based by design, data-scoped where it matters — applied consistently across SAP Datasphere and SAC, not patched per request.
Two layers of authorization. (1) Object authorization — can this user open this space, story, or model at all? (2) Data authorization — within an object they can open, which rows/values can they see? Datasphere implements row-level data authorization via Data Access Controls (DACs) bound to the analytic model; SAC enforces object access via roles and consumes the model's data authorizations through the live connection. Conflating "they can open the story" with "they can see all the data in it" is the classic breach: a regional manager opens the global revenue story and sees every region because nobody applied a DAC.
Prerequisites
- Intermediate hands-on experience on SAP analytics projects
- Review core concepts first: C038, C041, C040
Outcomes
- Understand the core concepts behind role & authorization design
- Apply Roles in a typical SAP analytics engagement
- Explain the core architecture and decision points for Role & Authorization Design
- Apply a repeatable implementation pattern in a 15-minute lab format
Full module available to members. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.