## 13.3.2  Authorizations
The authorizations topic plays a fundamental role in the area of Human Resources since access to personnel data must be carefully protected. In SAP Human Resources, there is a two-part concept for setting up authorizations. You should familiarize yourself with this concept if you use Human Resources components.
Human Resources uses the authorization concept provided by ABAP platform . Therefore, the security recommendations and guidelines for authorizations detailed in the ABAP Platform Security Guide also apply to Human Resources .
##  Note
Furthermore, Human Resources has specific structural authorizations for which the organizational assignment is checked to see whether a user may perform an activity.
For detailed information about authorizations in Human Resources , go to https:/ /help.sap.com/ s4hana\_op\_2021, enter Authorizations for Human Resources into the search bar, press Enter , and open the search result with that title.
The ABAP platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the Application Server ABAP .
## Standard Roles
The table below shows the standard roles that are used by the Personnel Management components listed under 'Description'.
##  Note
The standard roles for Human Resources components that are described in a separate chapter of this Security Guide are also in the 'Authorizations' section. The same applies to the self-service components Employee Self-Service [page 332] and Manager Self-Service [page 347] that are also described under Cross-Application Components Self-Services in this Security Guide.
Standard Roles
| Role               | Description                                                                                                   |
|--------------------|---------------------------------------------------------------------------------------------------------------|
| SAP_HR_BN *        | Roles for the PA-BN ( Benefits ) component                                                                    |
| SAP_HR_CM *        | Roles for the PA-CM ( Compensation Management ) compo- nent                                                   |
| SAP_HR_CP *        | Roles for the PA-CM-CP ( Personnel Cost Planning ) compo- nent                                                |
| SAP_HR_OS *        | Roles for the PA-OS ( Organizational Structure ) component                                                    |
| SAP_HR_PA_xx_ *    | Roles for the international versions and country versions of the PA-PA ( Personnel Administration ) component |
| SAP_HR_PA_PF_xx_ * | Roles for the PA-PF ( Pension Schemes ) component                                                             |
| SAP_HR_PD *        | Roles for the PA-PD ( Personnel Development ) component                                                       |
| SAP_HR_RC *        | Roles for the PA-RC ( Recruitment ) component                                                                 |
## Role
## Description
<!-- image -->
| SAP_HR_REPORTING      | Role for the Human Resources Analyst  Note This role is obsolete. Werecommend that you no longer use this role.                               |
|-----------------------|------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_ASR_ADMINISTRATOR | Enhancement of the role SAP_HR_PA_xx_ * for the HRad- ministrators that use the functions of the component PA-AS ( HRAdministrative Services ) |
For the roles marked with an asterisk (*), several roles exist for each of the components. For roles with xx , where xx represents the SAP country key, various roles exist for each of the country versions.
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used by Human Resources .
##  Note
For more information about the authorization objects for Human Resources, see https:/ /help.sap.com/ s4hana\_op\_2021 under Product Assistance Enterprise Business Applications Human Resources HR Tools Authorizations for Human Resources Technical Aspects Authorization Objects .
Most Important Standard Authorization Objects
| Authorization Object   | Name                       | Description                                                                                                                                                                                                                                 |
|------------------------|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| P_ORGIN                | HRmaster data              | Used to check the authorization for ac- cessing HRinfotypes. The checks take place when HRinfotypes are edited or read.                                                                                                                     |
| P_ORGINCON             | HRmaster data with context | This authorization object consists of the same fields as the authorization object P_ORGIN , and also includes the field PROFL (structural profile). A check using this object enables user-specific contexts to be mapped in HRmaster data. |
| Authorization Object   | Name                                        | Description                                                                                                                                                                                                                                |
|------------------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| P_ORGXX                | HRmaster data - extended check              | You can use this object to determine that other fields are also to be checked. You can determine whether this check is to be performed in addition to or as an alternative to the HRMaster Data authorization check.                       |
| P_P_ORGXXCON           | HRmaster data - extended check with context | This authorization object consists of the same fields as the authorization object P_ORGXX , and also includes the field PROFL (structural profile). A check using this object enables user-specific contexts to be mapped in HRmaster data |
| P_TCODE                | HR: Transaction Code                        | This authorization object checks some specific SAP Human Resources trans- actions.                                                                                                                                                         |
| PLOG                   | Personnel planning                          | Determines for which types of informa- tion processing a user has authoriza- tion.                                                                                                                                                         |
| PLOG_CON               | Personnel planning with context             | This authorization object consists of the same fields as the object PLOG , and also includes the field PROFL (structural profile). The check using this object en- ables user-specific contexts to be map- ped.                            |
| Authorization Object   | Name                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
|------------------------|-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| P_ASRCONT              | Authorization for process content                               | The Authorization for Process Content object is used by the authorization check for HRAdministrative Services . It checks the authorization for access to various process contents and also runs through the authorization objects that you have specified in Customiz- ing in the table T77S0 (see note be- low). For more information, see https:/ / help.sap.com/s4hana_op_2021 under Product Assistance Enterprise Business Applications Human Resources Shared Services HR Administrative Services (PA-AS) HCM Processes and Forms and section Au- thorization Concept of HCMProcesses and Forms . |
| P_DEL_PERN             | Deletion of personnel numbers in live systems                   | This authorization object is used in the report RPUDELPP and facilitates the de- letion of personnel numbers in live sys- tems. It is used by two roles, one for requesting the deletion and one for per- forming the deletion. These roles need to be assigned to two different users (double verification principle).                                                                                                                                                                                                                                                                                 |
| P_EICAU                | Authorization for activity in the Em- ployee Interaction Center | This authorization object checks the authorization for editing EIC activ- ities. For more information, see https:/ /help.sap.com/s4hana_op_2021 under Product Assistance Enterprise Business Applications Human Resources Shared Services Employee Interaction Center (EIC) General Settings and section Authori-                                                                                                                                                                                                                                                                                       |
##  Note
In Customizing for certain authorization objects, you can specify whether they are to be checked. The table T77S0 in the Group for Semantic Short Text for PD Plan AUTSW groups all central switches and settings for the Human Resources authorization check. Note that changes to the settings severely affect your authorization concept.
For more information about changing the main authorization switch, see Customizing for Personnel Administration and choose Tools Authorization Management .