## 6.3.1.13.18  Display Authorization Trace
With this app you can enable an authorization trace for a business user. This helps you to analyze if any authorizations are missing or are insufficient.
## Key Features
You can use this app to:
- Activate or deactivate a trace
- Display authorization check results including already assigned authorizations and failed checks
- Display all business roles granting access to selected fields and values
A maximum of 10.000 data sets is possible, therefore we recommend to consider this when defining the selection criteria, especially the date range.
The following authorization check statuses are possible:
| Status     | Meaning                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
|------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Successful | The authorization check was successful.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Failed     | The authorization check failed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Filtered   | When reading an object, an authorization check is taking place and certain data is filtered out defined by a DCL (Data Control Language).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
|            |  Note When the Authorization Check Status is set to Filtered , no authorization check is carried out for any value. In- stead, access filtering occurs. In this case, No Value is displayed for the corresponding restriction fields. Filter- ing means that the authorizations of the user for the specified restriction type/authorization object and for the specified field values are read and these authoriza- tion values are used as additional filter conditions during the selection of the business data. This way, the user only has access to the data for which he or she has appropriate authorizations. |
If an authorization check resulted in a Failed and Filtered status, you can check which business roles expose the affected restriction type. The root cause could be that the business user that has been checked is not assigned to the required business role or that the required value has not been maintained yet.
##  Note
The trace entries are deleted automatically within a certain time frame.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-SRV-APS-IAM .