Authorization check flow

Question

Hello Folks,
I wonder if some one can help clearing a doubt of mine.
The standard definition one finds on the net for Authorization check maintenance in SU24 for transactions is:
CM = Check performed AND object added in PFCG when tcode added to the role.
C = Check performed BUT object not added in PFCG when tcode added to the role.
N = No check OR check will return sy-subrc = 0 even if the user does not have the authorization.
U = Unknown. A check will may be hardcoded in the program, or maybe not.
My take on the above definitions is:
example object: V_VBAK_AAT
if
CM for  V_VBAK_AAT the object is included in the role while working with PFCG.
As per the definition check performed on object and object added.
Question 1: Even if the object is maintained as CM it would not make a difference if the check is not coded in the program (authority-check). Would it?
If
C check performed but object not added
Question 2:  If a check is going to be made on this object, why not include it in the role i.e mark it as CM? I was once told that these are objects that are most commonly used and hence from a BASIS point of view that the roll buffer will have that much less authorizations to load. But that does not ring true to me.
If
N - check will return value 0 thereby allowing the user through even though he does not have the authorization to do so
Question 3: Why suppress a check that is coded into the prgram in the first place. After all, the whole idea of Security is "any authorization not explicitly assigned" means NO AUTHORIZATION
For the last couple of years that i have been working on this, i have accepted this, as one would,  the bible :-)...
But now i wonder if there will be some enlightenment....
Regards,
Prashant

Answer 1

>
Prashant Pasala wrote:
>
> Question 1: Even if the object is maintained as CM it would not make a difference if the check is not coded in the program (authority-check). Would it?
no, it wouldn't. the check has to be coded.
>
Prashant Pasala wrote:
> Question 2:  If a check is going to be made on this object, why not include it in the role i.e mark it as CM?
>
because you would have many obsolete objects in your role, depending on the setup of your applications, the org-structure and several other things (mostly in configuration), whether an extension-set is active, a special IS used ...
>
Prashant Pasala wrote:
> Question 3: Why suppress a check that is coded into the prgram in the first place. After all, the whole idea of Security is "any authorization not explicitly assigned" means NO AUTHORIZATION
>
here one can only guess. one scenario might be: due to a bug in a SAP standard BAPI you deactivate the check until you get a correction from SAP. you have to do this to keep up the business ...
Edited by: Mylene Euridice Dorias on Mar 11, 2008 3:59 PM