Knowledge base / Analysis and remediation

Access lookup and role design

The cheapest SoD conflict is the one never built. Three tools help before anything changes in PFCG.

Access lookup

Type a transaction, a Fiori app or a plain description (for example material ledger). ClearDuty shows the suggested business role, the existing roles that already grant it safely, the risks it belongs to and what it must not be combined with. Partial codes get "did you mean" suggestions. Upload TSTCT and the Fiori app catalog to make lookup exact for your release.

Role designer

Pick an industry and a business role, then tick the activities the job genuinely needs. ClearDuty checks the combination against the ruleset as you go and proposes roles built from SAP standard business roles (SAP_BR_*) to copy in PFCG. The library holds 108 business role templates; the industry filter covers 23 industries.

Activities and t-codes are ClearDuty's mapping of each job to classic SAP GUI transactions. SAP's delivered role content differs by release and Fiori activation, so confirm in PFCG or the SAP Fiori apps reference library before you copy.

Simulator

Remove or add a role for a user and see which findings appear or disappear — and, with usage loaded, which t-codes the user ran that they would lose — before you touch SAP. To get a complete proposal for one user, use ROLESWEEP.

PreviousRemediation Studio (ROLESWEEP)NextIntelligence view

Still stuck? Ask us — we answer within one working day.