## 13.13.6.2.1.4  Authorizations
Use
The business function Commercial Project Inception and Lean Staffing uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply to Commercial Project Inception and Lean Staffing .
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) on the AS ABAP.
## Standard Roles
The table below shows the standard roles that are used by Commercial Project Inception and Lean Staffing . Standard Roles
| Role                     | Description                                                          |
|--------------------------|----------------------------------------------------------------------|
| SAP_SAWE_UNIVERSAL       | Maintenance of staff assignments and forecasts                       |
| SAP_CATS_LEAN_STAFFING   | Maintenance of cross-application time sheet (Web Dynpro application) |
| SAP_BC_EMPLOYEE          | Access to HCMdata (for employee search, for example)                 |
| SAP_BPR_INT_SALES_REP_14 | Maintenance of assignment objects of type 'SD order'                 |
| SAP_PS_STRUCT            | Maintenance of assignment objects of type 'project'                  |
| SAP_BC_ENDUSER           | Non-critical basis authorizations for all users                      |
In addition, users must be assigned to:
- the authorization profile K\_ORDER for the maintenance of assignment objects of the type 'internal order'
- the authorization profile I\_PM\_ALL for the maintenance of assignment objects of the type 'service order' .
##  Note
As the authorization profiles K\_ORDER and I\_PM\_ALL comprise all available authorizations for internal orders and service orders respectively, we recommend that you narrow the granted authorization range to suit your specific requirements.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used by Commercial Project Inception and Lean Staffing .
Standard Authorization Objects
| Authorization Object                                          | Field                         | Value                                                  | Description                                                                                                                                                                                            |
|---------------------------------------------------------------|-------------------------------|--------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| P_ORGIN and P_PERNR (Au- thorization check for HRinfo- types) | INFTY SUBTY AUTHC             | 0002 <blank> R                                         | The employee search in the Lean Staffing application and in the Lean Staffing report- ing lists only employees for whose info type 0002 the user has a read authoriza- tion.                           |
| PRS_LS_CUS (new)                                              | ACTVT                         | 02, 03, 06                                             | The system checks this au- thorization object when staff assignments to customers are made.                                                                                                            |
| V_PRS_LS_H (new)                                              | VKORG VTWEG SPART KDGRP KOSTL | VBAK-VKORG VBAK-VTWEG VBAK-SPART KNVV-KDGRP VBAK-KOSTL | The system checks this au- thorization object when staff assignments to SD orders are made. The user must be authorized for the sales area, distribution channel, di- vision, customer group and       |
| V_PRS_LS_I (new)                                              | PRCTR ACTVT                   | VBAP-PRCTR 02, 03, 06                                  | The system checks this au- thorization object when staff assignments to SD orders are made. The user must be authorized for the profit cen- ter of the SD sales document item.                         |
| C_PRPS_LS (new)                                               | PS_FKOKR PS_FKSTL PRCTR ACTVT | PRPS-FKOKR PRPS-FKSTL PRPS-PRCTR 02, 03, 06            | The system checks this au- thorization object when staff assignments to WBSele- ments are made. The user must be authorized for the controlling area, cost center and profit center of theWBS element. |
| K_PRS_LS                                                      | PRCTR ACTVT                   | AUFK-PRCTR 02, 03, 06                                  | The system checks this au- thorization object when staff assignments to internal or service orders are made. The user must be authorized for the profit center of the order.                           |
| Authorization Object   | Field     | Value           | Description            |
|------------------------|-----------|-----------------|------------------------|
| PRS_LS_FC              | EMP_LEVEL | Level 1, 2 or 3 | See description below. |
|                        | ACTVT     | 02, 03, 06      |                        |
The authorization for staff assignments is based on the assignment object to which it refers; it is independent of the employee for whom the assignment is made. As shown in the table above, different types of assignment objects (SD order, project and so on) use different fields for this authorization.
The authorization for forecasting is based on the employee whose time is forecast; it is independent of the assignment object for which it is made. There are several levels ( EMP\_LEVEL) of authorization concerning the employee:
- Level 1: The user is authorized to change and display own forecasts (the forecasts for the employee ID contained in the user's master record).
- Level 2: The user is authorized to change and display forecasts for the members of his or her team (note that level 2 does not necessarily imply level 1). The team is determined on the basis of the employee ID contained in the user's master record, as follows:
- The HCM organizational model is queried (current relationships according to info type 1001, subtype A008; for details, see method CL\_SAWE\_API\_PROVIDER\_FC-&gt; GET\_TEAM\_OF\_EMP). The result of this query is the same for managers and their assistants.
- You can influence the list of employee IDs returned by this query by adding or removing entries in an implementation of the Business Add-In (BadI) SAWE\_AUTHORITY\_CHECK, method TEAM\_OF\_EMPLOYEE.
- If neither the HCM organizational model nor the BAdI implementation is used, the team does not contain any employees.
- Level 3: The user is authorized to change and display forecasts for all employees.
The system checks both authorizations (authorization for staff assignments and authorization for forecasting) in the following cases:
- ACTVT = '02' (change): Checked when the Lean Staffing or Forecasting application is executed in the change mode (this refers to the UI-based application and to the A2X Enterprise Services).
- ACTVT = '03' (display): Checked when the Lean Staffing or Forecasting application is executed in the display-only mode .
- ACTVT = '06' (delete): Checked when the deletion of an assignment object triggers the deletion of its staff assignments and forecasts (without further user interaction).
This is different from the deletion of individual entries in the Lean Staffing and Forecasting applications, because users who are authorized to delete assignment objects (for example, SD order items) may need this authorization, even if they do not have authorization to execute the Lean Staffing or Forecasting application.
The authorizations for reporting are based on the specific user group 'SAWE' , which you can maintain using transaction SQ03. Users who are authorized to analyze employee assignments, resource consumption, employee utilization and skill utilization need to be assigned to this user group.