## 4.2.11.2.4.4.1.4  Implementing a Read Protection
Prevent unauthorized read access to the data exposed by your service using access control. For this purpose, you create an access control and then implement it for the CDS view on which your service is based.
## Defining the Use of Access Control in the Data Definition
## Context
For the data definitions that you want to protect, you need to define the use of access control.
##  Note
If you're using additional data definitions of type projection view, you need to define the use of an access control in them.
## Procedure
1. Add the following line to the data definition of the interface:
@AccessControl.authorizationCheck: #CHECK
For more information, see Access Control Annotations in the documentation of the ABAP RESTful Application Programming Model.
2. If you're using additional data definitions of type projection view, you also need to define the use of an access control in them.
## Creating an Access Control
## Context
Even if you have modeled necessary authorizations for your service by creating a new authorization object, the authorization object itself doesn't protect your service from being accessed by a business user in the ABAP environment. Therefore, as a next step, you implement a read protection for your service. In our example, this means that business users should only be allowed to view bonus calculations whose bonus variant matches with the users' authorization. You implement a read protection using access control, which uses the authorization object that you created.
## Procedure
1. Go to the core data service (CDS) view on which your service is based. You can find this CDS view under the data definitions of the core data services of your package.
2. To create an access control for the CDS view, follow the instructions of the ABAP CDS Development User Guide: Creating Access Controls and use the template Define Role with PFCG Aspect .
3. If you're using additional data definitions of type projection view, you also need to create additional access controls for them using the template Define Role with Inherited Conditions .
## Implementing the Access Control
## Context
You must edit the access control code to implement access control for the CDS view on which your service is based. Access control is based on the authorization object that you created before.
## Procedure
1. Choose the access control that you've created, which currently looks like the following:
2. Adapt the code so that it grants access if the requesting business user has authorizations that contain authorization object ZBNSCLC\_AO ( Bonus Calculation ) with allowed activity ( ACTVT ) 03 Display and bonus variant ( ZBNS\_VARNT ) values that match the bonus variant ( bonusvariant ) of the existing bonus calculation:
```
 Sample Code @EndUserText.label: '<your access control description>' @MappingRole: true define role <your access control name> { grant select on ${cds_entity} where (${entity_element_1}, ${entity_element_2}) = aspect pfcg_auth(${authorization_object}, ${authorization_field_1}, $ {authorization_field_2}, ${filter_field_1} = '${filter_value_1}'); }
```
```
 Sample Code @EndUserText.label: 'Access Control for CDS Z_I_BONUS_CALCULATION' @MappingRole: true define role Z_I_BONUS_CALCULATION { grant select on z_i_bonus_calculation where (bonusvariant) = aspect pfcg_auth(ZBNSCLC_AO, ZBNS_VARNT, ACTVT = '03'); }
```
In our example, cds\_entity is the z\_i\_bonus\_calculation CDS view.
3. If you're using additional data definitions of type projection view, enhance the coding as follows:
```
 Sample Code @EndUserText.label: '<your access control description>' @MappingRole: true
```
```
define role <your access control name> { grant select on <your projection view name> where inheriting conditions from entity z_i_bonus_calculation; }
```
## Results
As a result, only business users with the corresponding authorizations get bonus calculations from the service, and they only get bonus calculations with allowed bonus variant values.