How to restrict executing tcodes in transaction tab for master clients

Question

This question applies SOLMAN project implementation tools: SOLAR01, SOLAR02 and so on.
Our ERP2005 development U50 system has two clients:
One is master client 101 where all customizing should take place  but no transactions are allowed
second client 102 works as sandbox client where new customizing can be test and master data and transaction are allowed.
Only U50/101 is defined in Solution manager SMSY in system role 'development system'. Currently U50/102 is not defined in Solution manager to any system role at all.
As configuration should take place via Solution manager,  the consultants use SOLAR01 and SOLAR02 in system role 'development system' meaning that they are connected to U50/101 if want to execute transactions in transaction tabs or IMG nodes in Configuration nodes.
But U50/101 is our MASTER client and no transactions nor most master data are allowed in there. We want to keep it clean. How can I avoid tcodes being executed in system role 'development'. I want to allow consultants use tcodes if they change to system role 'quality system'. But they might forget to change the system role before executing the transaction.
Is there an option in Solution manager Project implementation tools that do not allow tcode launch from transaction tabs when system role is 'development system'.
Of course I can restrict tcode execution with authorizations in satellite systems, but then I would need to disable authorizations for each tcode possibly being used. So I don't like that option.
br: Kimmo

Answer 1

Okay, I'll continue dialog with myself. I found solution how to assign other clients on one system to other system roles, which are so-called 'customer roles'.
See solution manager help:
http://help.sap.com/saphelp_sm40/helpdata/en/3b/8be61c54d22945837fd69861d21a08/content.htm
I did not know until know, that system roles are actually customizable. The roles with letter P,D,C,T,E, etc. are reserved for SAP but you can create your own system roles into table SMSY_ROLES. You would not do it with SM30, but from tcode SMSY and following menu Utilities-System Settings->tab:System Roles. Switch to change mode. Roles with 0-9 are available for "customer roles". Choose role type and write your own description ( like: Sandbox client in development system ).
Now the new role is available in SMSY. But You cannot see it yet in SOLAR_PROJECT_ADMIN/System Landscape tab. In there you must press button 'System role assignment' and in the opening window add your own 0-9 role defined earlier and save. Now you see your new role in 'system landscape' tab and you can assign systems to it like you had done with SAP standard roles.
Now users using implementation tools can change their current system role to your new 'customer role'.
But what it comes to my original problem (see title), that still remains. I have debugged the tcode execution from transaction tabs and don't see any possible way to avoid tcodes being executed for an unwanted system role. An Enhancement Spot ( =new BADI) can of cource be used for making custom rule for my requirement.
I'll make this thread answered. Hope you joined my self-dialog.
Keywords: DEFINE EDIT SYSTEM CUSTOMER ROLES SMSY_ROLES
br: Kimmo