Role & Authorization Design
As of 2026-10-06
Authorization design = least privilege by default, role-based by design, data-scoped where it matters — applied consistently across Datasphere + SAC. Two layers: object authorization (can you open it?) and data authorization (which rows can you see?). Datasphere does row-level via Data Access Controls (DACs) on the model; SAC enforces object roles + consumes the model's DACs. The classic breach: open access ≠ all-data access (regional manager sees every region because no DAC). Role-based not user-based; least privilege + segregation of duties. Data scoping is a legal requirement in utilities (unbundling, M099), pharma (M100), banking (M097), GDPR (M082) — a missing DAC there is a breach. Design a reviewable role→object→data matrix with re-certification for the audit.
What you will learn
- Work through a realistic scenario: Multinational on Datasphere + SAC, regional managers, a finance team, GDPR personal data, and a utility-style unbundling obligation in one division.
- Recognize and avoid the anti-pattern: Object access without data authorization (no DAC) — Open-the-story = see-all-data; data leak across regions/customers.
- Apply the module's core decision: Object vs data authorization — choose Both layers; DAC for row-level on sensitive models, not Object access alone (opens story = sees all data).
- Track mastery with the KPI: Data-authorization coverage (target: DAC on every sensitive model; red flag: Sensitive model open with no row-level DAC).
Module overview
Authorization design decides who can see and do what across the analytics estate — and it is the control that, done badly, either leaks data or grinds the platform to a halt with access tickets. The senior principle is least privilege by default, role-based by design, data-scoped where it matters — applied consistently across SAP Datasphere and SAC, not patched per request.
Two layers of authorization. (1) Object authorization — can this user open this space, story, or model at all? (2) Data authorization — within an object they can open, which rows/values can they see? Datasphere implements row-level data authorization via Data Access Controls (DACs) bound to the analytic model; SAC enforces object access via roles and consumes the model's data authorizations through the live connection. Conflating "they can open the story" with "they can see all the data in it" is the classic breach: a regional manager opens the global revenue story and sees every region because nobody applied a DAC.
Prerequisites
- Intermediate hands-on experience on SAP analytics projects
- Review core concepts first: C038, C041, C040
Outcomes
- Work through a realistic scenario: Multinational on Datasphere + SAC, regional managers, a finance team, GDPR personal data, and a utility-style unbundling obligation in one division.
- Recognize and avoid the anti-pattern: Object access without data authorization (no DAC) — Open-the-story = see-all-data; data leak across regions/customers.
- Apply the module's core decision: Object vs data authorization — choose Both layers; DAC for row-level on sensitive models, not Object access alone (opens story = sees all data).
- Track mastery with the KPI: Data-authorization coverage (target: DAC on every sensitive model; red flag: Sensitive model open with no row-level DAC).
Full module available to members. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.