Knowledge base / Analysis and remediation
Remediation Studio (ROLESWEEP)
A finding tells you what is wrong. The Remediation Studio shows how to fix it for the whole user — and what each fix would cost the business — before anyone touches SAP. It ends with an approved, reproducible change package for the SAP security team.
1. Choose a plan
Open any finding and select Fix this user, or open Access Analytics → Remediation Studio. Choose which risk levels must never be allowed (high and critical by default). ClearDuty builds up to five alternatives from roles you already have:
| Plan | What it does |
|---|---|
| Minimal change | Removes the fewest current roles (up to two) that clear the blocked risks with the least business loss. Nothing new is assigned. |
| Rebuild from usage | ROLESWEEP: the set of existing roles that keeps the most of what the user actually ran, without a blocked risk. |
| Strict rebuild | As Rebuild, but no risk of any level is allowed. |
| From Simulator | The role set you built by hand in the Simulator for this user. |
| Keep access, add controls | No change; every remaining risk needs a mitigating control. The baseline for comparison. |
Each plan card shows risks left (and how many are at a blocked level), used t-codes lost, business functions disrupted (and how many are essential) and the number of role changes.
2. Compare current access with the plan
Side by side: Roles (kept, removed, added), Conflicts (resolved, remaining, new), Business functions and, under Permissions retained and lost, every t-code with its run count and which role grants it before and after.
Business functions group the user's t-codes by the activity they serve, such as "Run the payment program". A function carrying at least 10% of the user's activity in the usage period is marked Essential; if a plan disrupts one, the Studio warns you to agree a hand-off or choose another plan.
3. Approve
- Prepared by analyst — Save this plan. The findings it resolves move to In remediation.
- Reviewed by SAP security — name and comment (reviewer or administrator rights).
- Approved by business owner — name and comment, for example "hand-off of vendor changes to MDM agreed".
Approvals are bound to the package ID. If the data, the ruleset, the as-of date or the chosen plan changes, the ID changes and the approvals no longer apply.
4. Change package
An Excel workbook for the SAP security team: the SU01 steps in order (remove or assign role, user, validity dates, columns for who did it and when), the expected result per risk, the business impact, the input files with their SHA-256 fingerprints, the approvals and the verification steps. Download one user's package, or Export approved packages for all users at once.
Reproducible: the package ID is computed from the source files, the ruleset, the as-of date and the plan. Anyone who loads the same extracts gets the same ID and the same steps.
Still stuck? Ask us — we answer within one working day.