Security and Control - Creation of ORG Roles

Question

Hi
I have created an organization role against one functional role by adding the objects containing org elements only which are falling in that functional role. Now as per the rule it should a user will have one functional role attached and one respective org role which will have local value of org elements and accordingly there will be so many instances of org role. Viz. if there are 100 plants and 50 company codes, then there will be 100 org role for plants and 50 org roles for company codes. so by this practice we are reducing the number of instance roles ( which in tradition method would have been 100*50 = 5000 and in this case it will be 100 + 50 = 150)
This concept works fine if we have only one org element falling in one object (e.g F_BKPF_BUK, has only plant as the org element), but my question is how can I handle the sceneriao in which there are more than one org element falling in the object ?? e.g. authorization object J_1IA_POSO contains org elements company code and plant ( which comes from transaction code J1I0).
Your early responce is highly appreciated.
Thanks & Regards
Shailendra

Answer 1

Dear Gaurish
your demand is quite standard. There is only a "but": nearly 60% of the properties are "global" ones and not "local" ones. That means e.g. "density" data should be valid "global". But e.g. in the context of GHS, OEL etc. local data is required. The access concept is therefore not always prepared on level of VAT/property; e.g. a french guy need to maintain the OEL; the same for the german guy; but there is only one VAT. So the differentiation is done in most cases on usage level. But you need to differentiate the maintenance in CG02/CG02BD from the topic of generation and releasing SDS. Here as well access concepts are used.
Any access conept is very "company" specific. Just check the available objects which are used to "control"/"Set up" access rights. E.g.:
SAP EHS user list and Authorizations | SCN
E.g. consolut - Complete Authorization Object Documentation From /AAA up to E
might helps as well.
On top: Access cocnept depends on release you are using. Higher releases does have more authorization objects as in the past. So access concept is not only company specific but release specific as well.
Topic of access concept is discussed "rarely" here.
Authorization object C_SHES_TVH
authorisation object for property tree in CG02
Specification type authorizations
IHS safety measures authorization object
EHS
May be check "Best practise" approach; which is discussed very often here to get idea about access concept.
C.B.
PS: may be check:
consolut - C_SHES_TVH - EHS: Specification Value Assgmt with Reference to a Spec.
Authorization check with usage profile in user parameter
Define Authorizations - Product Safety - SAP Library
(sorry describes only old releases but good starting point)