Delete and Write Access for PA infotypes

Question

Hi Gurus,
Our clients require managing Write and Delete access separately for PA infotypes. Example, an employee can have Write access (able to save values in infotypes) but s/he will not be able to Delete this infotype record one it has been Saved.
How do we implement this?
In the standard authorizatio object for HR master data, P_ORGIN you only have M, R and W. If an employee was given a W access, s/he'll also have Delete access.
Is there a way on how to do this?
<removed by moderator>.
Thanks.
Olekan Babatonde
Edited by: Suresh Datti on Dec 28, 2009 6:21 PM

Answer 1

Olekan,
First of all, if your managing PA Infotypes, you're also using the P_PERNR object authorization.
Next, you're right. For SAP, the Write and Delete permissions are the same authorization level (W).
To avoid build a "Z" solution, i suggest you use the "block" permission in one of these ways:
1) assign the S authorization level (Symmetric) for write access using the Symmetric Double Verification Principle; that is, user 1 do changes to an infotype and data is saved with "blocked" status, then user 2 save or delete data entered by user 1. Another day, user 2 do changes to an infotype, then data is saved with "blocked" status and only user 1 will be able to save or delete data entered by user 1.
2) assign the E and D authorization level for write access using the Asymmetrical Double Verification Principle; that is, if user 1 has E, and user 2 has D, then the user 1 ever maintain data with "blocked" status and never will be able to save or delete data. And user 2 ever will be able to "unblocked" data (for save or delete) and never will be able to maintain data without "blocked" status.
Check this links ([1|http://help.sap.com/saphelp_erp60_sp/helpdata/en/fd/4bba3b3bf00152e10000000a114084/content.htm] y [2|http://help.sap.com/saphelp_erp60_sp/helpdata/en/d3/4bba3b3bf00152e10000000a114084/content.htm]) to find out more information about these principles.
Kind regards