## 4.2.11.2.4.4.1.6  Implementing a Protection Against Unauthorized Write Activities
To protect a service, such as the example of bonus calculation from unauthorized creations, updates, or deletions, enhance the behavior implementation of the service in ABAP development tools (ADT). The implementation is required by what has been defined as authorization control in the behavior definition.
## Context
Among the methods of the behavior implementation, you add methods that check the authorizations for creation and for update and delete.
For more information about authorization control, see see the documentation for the ABAP RESTful Application Programming Model.
## Procedure
1. In the Source Code Library folder of your package, under Classes , choose the behavior implementation of your service.
2. In the PRIVATE SECTION in the handler class of the behavior implementation, define the method for authorization checks for update and deletion:
<!-- image -->
In the bonus calculation example, this method definition can look as follows:
```
 Sample Code METHODS get_instance_authorizations FOR INSTANCE AUTHORIZATION IMPORTING keys REQUEST requested_authorizations FOR calculation RESULT result.
```
3. In the PRIVATE SECTION in the handler class of the behavior implementation, also define the method for authorization checks for creation:
<!-- image -->
In the bonus calculation example, this method definition can look as follows:
<!-- image -->
4. Add a method implementation that checks the authorizations for updates and deletions.
In the bonus calculation example, this method can look like this:
<!-- image -->
```
DATA(lv_calculate_bonus_allowed) = COND #( WHEN sy-subrc = 0 THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized ). *       check delete authorization for bonus calculation, incl. bonus variant dependency AUTHORITY-CHECK OBJECT 'ZBNSCLC_AO' ID 'ACTVT' FIELD '06' ID 'ZBNS_VARNT' FIELD ls_bonus_calc-bonusvariant. *       set variable for delete authorization DATA(lv_delete_allowed) = COND #( WHEN sy-subrc = 0 THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized ). *       fill result list APPEND VALUE #( id = ls_bonus_calc-id %update = lv_update_allowed %delete = lv_delete_allowed ) TO result. ENDLOOP. ENDMETHOD.
```
5. Add a method that checks the authorizations for creation.
In the bonus calculation example, such a method could look like this:
```
 Sample Code METHOD get_global_authorizations. IF requested_authorizations-%create EQ if_abap_behv=>mk-on. *     check create authorization AUTHORITY-CHECK OBJECT 'ZBNSCLC_AO' ID 'ACTVT' FIELD '01'. result-%create = COND #( WHEN sy-subrc = 0 THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized ). ENDIF. ENDMETHOD.
```
## Results
The implemented methods provide the desired protection from unauthorized uses:
- With the implementation of the method get\_instance\_authorizations , an unauthorized business user gets an error message when trying to update or delete a business object instance (in the example, a bonus calculation) via service call.
- With the implementation of the method get\_global\_authorizations , an unauthorized business user gets an error message when trying to save the creation of a new business object instance.
- Unauthorized business users can't use the Delete button in the list view on the service UI. In addition, the Edit and Delete buttons are hidden in the detail view on the service UI for a business object instance.
Now, the service is secured against unauthorized operations. As a next step, you must make sure that business users who need to use service get the corresponding authorizations.