Ruleset Structure
A ruleset defines:
| Element | Description |
|---|---|
| Risks | Risk ID, name, level (Critical/High/Medium/Low), type (SoD/Critical Access) |
| Functions | Business functions that group related actions |
| Actions | Transaction codes or activities |
| Permissions | Authorization object and field value requirements |
Technical Considerations
-
System: This field identifies the system where the function is expected to be triggered.
Note: The system value must match exactly with the one defined in the corresponding data source(s).
-
Action: The
Actionfield acts as a permission group; permissions with the same action are evaluated together to trigger a function.Note: An action is not bound to a specific Tcode. If a transaction is involved, the authorization object
S_TCODEmust be included separately. -
Object: Represents the authorization object. All objects assigned to the same action are considered during evaluation.
-
Field: The authorization field within an object. All fields under the same object are taken into account.
-
Value From / To: A string range used for value matching. Values will be considered if they fall within the specified range, starting with special characters (e.g.
/) and ending with a letter (e.g.Z). -
Condition (AND / OR): Operators define how multiple values for the same field of the same object are interpreted:
ANDrequires the value to be met.ORrequires at least one value to be met.
Note: Combining
ANDandORis technically possible. In that case all values with conditionANDare required in combination with at least one value with conditionOR. -
Wildcard (
*) – ANY vs ALL:- To trigger the function by any value: use
* - To trigger the function by all values: use
' * '(quoted with a space)
- To trigger the function by any value: use
Example Explained
Note: The examples shown are not functionally correct, they're simply meant to explain how the tool processes and interprets technical input.
| Function | Action | Authorization Object | Field | Value From | Value To | Condition |
|---|---|---|---|---|---|---|
| Table Maintenance | SM30_NAM | S_TABU_NAM | ACTVT | 01 | OR | |
| Table Maintenance | SM30_NAM | S_TABU_NAM | ACTVT | 02 | OR | |
| Table Maintenance | SM30_NAM | S_TABU_NAM | ACTVT | 03 | AND | |
| Table Maintenance | SM30_NAM | S_TABU_NAM | TABLE | Z* | OR | |
| Table Maintenance | SM30_NAM | S_TABU_NAM | TABLE | A* | BKPF | OR |
| Table Maintenance | SM30_NAM | S_TCODE | TCD | SM30 | AND | |
| Table Maintenance | SM30_DIS | S_TABU_DIS | ACTVT | 01 | OR | |
| Table Maintenance | SM30_DIS | S_TABU_DIS | ACTVT | 02 | OR | |
| Table Maintenance | SM30_DIS | S_TABU_DIS | DICBERCLS | '*' | AND | |
| Table Maintenance | SM30_DIS | S_TCODE | TCD | SM30 | AND |
To trigger the Table Maintenance function, a user or role must be provisioned with either of the following sets of authorizations:
Option 1: Using S_TABU_NAM
- Transaction code:
SM30 - Authorization Object:
S_TABU_NAM- Field
ACTVTmust include:03AND (01OR02) - Field
TABLEmust include: Any table starting withZOR any table fromAtoBKPF
- Field
Option 2: Using S_TABU_DIS
- Transaction code:
SM30 - Authorization Object:
S_TABU_DIS- Field
ACTVTmust include:01OR02 - Field
DICBERCLSmust include: All table groups
- Field