Organization level control on Role

Question

Dear security gurus.
I have 2 business roles in company and 2 subsidiaries under HQ.
Each company have
- Accout clerk
- Account manager
HQ's clerk&manager: be able to check all company's data.
Subsidiary's clerk&manager: be able to check ONLY their own company's data
In this case, I have to create these 6 roles, because
company code restriction can be controled only by role, not user.
Am I correct?
1.HQ's manager(Company code: *)
2.HQ's clerk(Company code: *)
3.Subsidiary1's clerk(Company code: 1)
4.Subsidiary1's manager(Company code: 1)
5.Subsidiary2's clerk(Company code: 2)
6.Subsidiary2's manager(Company code: 2)
Yoshi

Answer 1

Hi,
I'd never give business access to all companies.
My proposal:
1.HQ's manager(Company code: 1, 2)
2.HQ's clerk(Company code: 1, 2)
3.Subsidiary1's clerk(Company code: 1)
4.Subsidiary1's manager(Company code: 1)
5.Subsidiary2's clerk(Company code: 2)
6.Subsidiary2's manager(Company code: 2)
You could also assign HQ both roles of subsidiaries:
1.HQ's manager (MGR-01, MGR-02)
2.HQ's clerk (CL-01, CL-02)
3.Subsidiary1's clerk (CL-01
4.Subsidiary1's manager (MGR-01)
5.Subsidiary2's clerk (CL-02)
6.Subsidiary2's manager (MGR-02)
That way, you need only four roles
MGR-01
MGR-02
CL-01
CL-02
- more effort with assigning the roles
- saves a little effort on the roles management side
- works only if needed transactions are exactly the same (Subsidiary vs HQ).
greetings
Alexander Walkenhorst