Reg derived roles combination into composite role

Question

Dear All,
We have a role called GR Clerk. This will be available across all stores and DC for our retail customer. We have devised a strategy wherein we will create one global role with * in org level for site. Then we will
create derived roles for individual DC and stores (from global role) and maintain site for each derived role.
Now our customer wants following:
Example: Store 1's GR clerk shall have required authorizations on transaction for Store 1, plus, one
additional authorization/transaction for Store2.
What we initially though that we will create two individual global roles: One for all authorizations and
second for additional authorization.
Global GR Clerk role: GRC
Transactions: t1, t2, t3          
Global GR Clerk role: GRC_additional
Transactions: t4
Derived Roles
for GRCStore1:     
1. GRCStore1 with org level Site= Store1     
2.GRCStore1_additional with org level Site= Store2
Now I will assign both derived roles to user who is GR Clerk on Store1.
Is this approach correct?
Also, customer wants that only one role should be assigned to user. So shall I create a composite role out of 2 derived roles?
Will the respective site org levels be maintained after combining derived roles into composite one?
Thanks for your time in advance.
regards, Sean.

Answer 1

Hi,
Regarding the transaction roles and authorization roles, it is also a good approach, however, you would still have to consider the above point in case the authorization objects overlaps and make sure that both are restricted to appropriate "stores".
Whether it's a good approach or not, per me, depends on the overall scenario and the fact that how much maintenance would be required in long term.
Like say, if it is a case that the transaction codes (t1,t2 and t3) are for specific stores and transaction t4 is like display activity of other store and not just store 2. Then creating a common role for transaction t4 and including it in the composite role apart with the store specific role with tcodes (t1,t2 and t4) would also be a good approach.
ZZZ:STORE_CLERK_STORE1             (Composite Role)
ZZS_STORE_CLERK_STORE1                      transaction code t1, t2 and t3
ZZZ_STORE_CLERK_STANDARD                  transaction code t4 (Either no org level restriction or all store access)
ZZZ_STORE_CLERK               (Parent Role)
ZZS_STORE_CLERK_STORE1                  Org level Restricted to Store 1
ZZS_STORE_CLERK_STORE2                  Org level restricted to Store 2
and so on
PS: Naming convention are for illustration only
Cheers !!
Zaheer