A ruleset is a flat table, one row per authorization value. There is no proprietary format and no import wizard to satisfy: prepare the table, load it, and it is available to any analysis.
Two formats are accepted:
| Format | Notes |
|---|---|
| XLSX | An Excel workbook. You name the worksheet holding the rules on import, and other sheets in the same workbook are ignored |
| CSV | Delimiter detected automatically from semicolon, comma, tab, or pipe |
XLSX is usually the more practical choice, because a risk library is normally maintained in Excel anyway and loading the workbook directly removes the export step. Only the modern .xlsx format is read; legacy .xls and .ods are not. See Loading a Ruleset.
Required columns
Ten columns must be present, in either format, or the file is rejected as a ruleset:
System, Rule Set, Access Risk ID, Functions, Action, Permission Object, Field, Value From, Value To, Condition
Column order does not matter, and extra columns are ignored. In an XLSX the header row is the first non-empty row of the named worksheet, so leave no stray text above it. In a CSV, the delimiter is found by testing which one yields all ten headers.
A file that fails to load is usually one with a renamed or misspelled header. The error message names the headers it could not find.
Optional columns
These are not required to load, but omitting them costs you specific capability rather than nothing:
| Column | What you lose without it |
|---|---|
Access Risk Description | Readable risk names in reports |
Access Risk Type | Filtering SoD against critical access |
Access Risk Level | Filtering and prioritizing by severity |
Business Process Description | Business process scoping |
Function Description | Readable function names |
Action Description | Readable action names |
Risk Owner | Scoping an analysis to one risk owner |
Status | Marking a rule InActive without deleting it |
Change Doc Action | Change document verification in Did-Do analysis |
Change Doc Object Type | Change document verification in Did-Do analysis |
Starting template
A minimal working row, semicolon-delimited:
System;Rule Set;Access Risk ID;Access Risk Description;Access Risk Type;Access Risk Level;Business Process Description;Functions;Function Description;Action;Action Description;Permission Object;Field;Value From;Value To;Condition;Status
S4HANA_LG;ITGC;IT161;Access to Maintain roles;Critical Action;Critical;Basis;IT161;Access to Maintain roles;PFCG;Role Maintenance;S_USER_AGR;ACTVT;01;02;OR;Active
To build the equivalent workbook, paste those two lines into Excel and use Data > Text to Columns with semicolon as the separator, then name the sheet something you will recognize, for example Ruleset. That sheet name is what you type into the Worksheet name field on import.
Working in Excel
Two habits worth adopting, since both produce rules that load without firing:
- Keep values as text. Excel converts
01to1and may reformat a value that looks like a date. AnACTVTof1does not match an authorization holding01. Format the value columns as Text before typing into them - Do not merge cells or add a title row above the headers. The header row is the first non-empty row of the sheet, so anything above it is read as the header
Field reference
| Field | Description | Notes |
|---|---|---|
System | The system where the function is expected to be exercised | Must match the data source name exactly, or the rule never fires. Placeholders such as $BUKRS are permitted and bound at analysis time |
Rule Set | Name of the framework the rules come from, for example ITGC | Reported in the summary report so results from different libraries stay distinguishable |
Access Risk ID | Unique risk identifier, for example S015 | The key used for tracking, exclusions, and remediation |
Access Risk Description | The fraud or error scenario the conflict enables | Written for the business reader, not the administrator |
Access Risk Type | Risk classification | Free text. Commonly Segregation of Duties, Critical Action, Critical Permission. Whatever you use becomes a filter option |
Access Risk Level | Severity | Free text, not a fixed list. Whatever values you use become the filter options |
Business Process Description | Business area affected, for example Finance | Drives business process scoping |
Functions | Function ID grouping related actions into a business capability | An SoD risk needs two or more; a critical access risk needs one |
Function Description | Readable function name | |
Action | The permission group | Not bound to a transaction code. To require a transaction, add S_TCODE as a separate permission object |
Action Description | What the action does | |
Permission Object | Authorization object being checked | All objects under the same action are required together, as a logical AND |
Field | Field within the object | All fields under the same object are required together |
Value From | Required value, or start of a range | |
Value To | End of the range | Leave empty for a single value |
Condition | AND or OR, linking multiple value rows for the same field | Mixing them means every AND value is required, plus at least one OR value |
Status | Set to exactly InActive to skip the row | Case-sensitive. Any other value, including Active or empty, keeps the row. Lets you retire a rule without deleting it |
Change Doc Action | Transaction used to check change document logging | Leave blank for Fiori |
Change Doc Object Type | Object type for change document verification, for example COND_A | Several may be given, comma or pipe separated |
Multi-value fields such as Functions and Change Doc Object Type accept &, ,, ;, or | as separators.
Before you rely on it
A ruleset that loads is not a ruleset that works. The two failure modes that produce a silently empty result are a System value that does not match your data source name, and an Action defined without the S_TCODE object where a transaction check was intended. After loading a new ruleset, run it against a small known population and confirm you get the findings you expect.
For how the engine evaluates these rows, including wildcard semantics and a worked example, see Ruleset Structure.