<?xml version="1.0" encoding="utf-8"?>
<ManualTopic ID="/baanerp/tg/onlinemanual/000038" xml:lang="en">
	<Header>
		<Title xmlns:ssa="http://www.ssaglobal.com" xmlns:HTML="http://www.w3.org/TR/REC-html40">authorizations by activity and business process</Title>
		<Keyword><Level1>Role authorization</Level1>
		</Keyword>
		<Keyword><Level1>Responsibilty code authorization</Level1>
		</Keyword>
		<Keyword><Level1>Application authorization</Level1>
		</Keyword>
	</Header>
	<GeneralSection><Paragraph>The run time authorization mechanism works as follows:</Paragraph>
		<List><ListItem><Link href="#A1" role="internal">Authorization via roles</Link>
			</ListItem>
		</List>
		<List><ListItem><Link href="#A2" role="internal">Authorization via responsibility codes</Link>
			</ListItem>
		</List>
		<List><ListItem><Link href="#A3" role="internal">Authorization for Application type activity</Link>
			</ListItem>
		</List>
		<List><ListItem><Link href="#A4" role="internal">Linking employees to roles</Link>
			</ListItem>
		</List>
		<GeneralSection ID="A1"><SectionTitle>Authorization via roles</SectionTitle>
			<Paragraph><Link href="/baanerp/tg/glossary/glossary#000034" role="glossary">Roles</Link> can be linked to the following model items:</Paragraph>
			<List><ListItem><Link href="/baanerp/tg/glossary/glossary#000067" role="glossary">Business process</Link>
				</ListItem>
				<ListItem><Link href="/baanerp/tg/glossary/glossary#000023" role="glossary">Activity</Link>
				</ListItem>
				<ListItem><Link href="/baanerp/tg/glossary/glossary#000308" role="glossary">Subapplication</Link>
				</ListItem>
			</List>
			<Paragraph>You must first define the roles in the <Link href="/baanerp/tg/brg/tgbrg8110m000" role="session">Roles (tgbrg8110m000)</Link> session for the <Link href="/baanerp/tg/glossary/glossary#000246" role="glossary">current modeling version</Link> before you can link these roles to any business process or activity.</Paragraph>
			<Paragraph>All the roles that are linked to a business process are inherited by all the activities within that business process.</Paragraph>
			<Paragraph>A role that is linked to a business process or an activity in the repository, is inherited by that business process or activity in the business model.</Paragraph>
			<ExampleSection><SectionTitle>Example</SectionTitle>
				<Paragraph>Activities B, C, and D are incorporated in business process A.</Paragraph>
				<Paragraph>Business process A represents the highest level in the business process structure. The other activities, which can also be nested business processes, represent the lower levels in the business process structure.</Paragraph>
				<List><ListTitle>Roles:</ListTitle>
					<ListItem>Manager</ListItem>
					<ListItem>Secretary</ListItem>
				</List>
				<Paragraph>The manager is responsible for all business process activities except activity D. The secretary is only responsible for activity D.</Paragraph>
				<Paragraph>You can define the situation in the example as follows:</Paragraph>
				<ProcedureList><ListItem>Link the manager role to business process A in the <Link href="/baanerp/tg/brg/tgbrg5106m000" role="session">Roles by Business Process (tgbrg5106m000)</Link> session or in the <Link href="/baanerp/tg/brg/tgbrg3140s000" role="session">Roles by Business Process by Business Model (tgbrg3140s000)</Link> session. The role applies to business process A and includes all lower-level activities because roles are inherited by the lower levels.</ListItem>
					<ListItem>Select the Excluded check box in the <Link href="/baanerp/tg/brg/tgbrg3150s000" role="session">Role by Business Process Activity Properties (tgbrg3150s000)</Link> session to exclude the manager role from activity D. This session can only be started from the enterprise modeler editor.</ListItem>
					<ListItem>Link the Secretary role to activity D through the <Link href="/baanerp/tg/brg/tgbrg8110m000" role="session">Roles (tgbrg8110m000)</Link> session. Start this session from the enterprise modeler editor.</ListItem>
				</ProcedureList>
			</ExampleSection>
		</GeneralSection>
		<GeneralSection ID="B"><SectionTitle>Linking of roles</SectionTitle>
			<Paragraph>After you have imported the roles, you can link additional roles to the business processes and activities. These roles are incorporated in the business model, and do not apply to the these same business processes in the repository.</Paragraph>
			<Paragraph>In the Enterprise Model Browser and in the Enterprise Modeler Editor you can view which roles are linked to the business processes, and where they were linked (repository or business model).</Paragraph>
			<List><ListIntro>Use the following sessions to link one or more roles in the repository:</ListIntro>
				<ListItem>The <Link href="/baanerp/tg/brg/tgbrg5106m000" role="session">Roles by Business Process (tgbrg5106m000)</Link> session</ListItem>
				<ListItem>The <Link href="/baanerp/tg/brg/tgbrg3150s000" role="session">Role by Business Process Activity Properties (tgbrg3150s000)</Link> session</ListItem>
			</List>
			<List><ListIntro>Use the following sessions to link one or more roles in a business model:</ListIntro>
				<ListItem>The <Link href="/baanerp/tg/brg/tgbrg3540m000" role="session">Roles by Business Process by Business Model (tgbrg3540m000)</Link> session</ListItem>
				<ListItem>The <Link href="/baanerp/tg/brg/tgbrg3150s000" role="session">Role by Business Process Activity Properties (tgbrg3150s000)</Link> session</ListItem>
			</List>
			<List><ListIntro>You can also link roles and define authorizations for subsapplications. This action can be performed by using the following session that can only be started from the Enterprise Modeler Editor.</ListIntro>
				<ListItem><Link href="/baanerp/tg/brg/tgbrg3155s000" role="session">Role by Subapplication by Activity Details</Link> session</ListItem>
			</List>
			<GeneralSection ID="A2"><SectionTitle>Authorization via responsibility codes</SectionTitle>
				<Paragraph>You can define the responsibility codes in the <Link href="/baanerp/tg/brg/tgbrg8130m000" role="session">Responsibility Codes (tgbrg8130m000)</Link> session in the master data.</Paragraph>
				<Paragraph>If you link a role to a business process or activity you can specify a maximum of six responsibility codes (responsibilities) for that role.</Paragraph>
				<Paragraph>The business process and/or activity to which the role is linked can be carried out by an employee if at least one of the responsibility codes linked to the role is set to YES. If the role has no responsibility codes, the role is always active.</Paragraph>
				<Paragraph>The responsibility codes that are linked to a role are inherited by all the activities within the business process to which the role is linked.</Paragraph>
				<ExampleSection><SectionTitle>Example</SectionTitle>
					<Paragraph>This example is the same as the one for the role authorization, except that in this example the responsibility codes are also involved.</Paragraph>
					<Paragraph>Activities B, C, and D are incorporated in business process A.</Paragraph>
					<Paragraph>Business process A represents the highest level in the business process structure. The other activities, which can also be nested business processes, represent the lower levels in the business process structure.</Paragraph>
					<List><ListTitle>Roles:</ListTitle>
						<ListItem>Manager</ListItem>
						<ListItem>Secretary</ListItem>
					</List>
					<List><ListTitle>Responsibility codes:</ListTitle>
						<ListItem>Maintain Data</ListItem>
						<ListItem>Informs Manager</ListItem>
						<ListItem>Checks Data</ListItem>
					</List>
					<Paragraph>The manager is responsible for all business process activities except activity D. The secretary is only responsible for activity D of which must be reported to the manager. The manager checks activity D as soon as the secretary has carried out this activity.</Paragraph>
					<ProcedureList><ListTitle>You can define the situation in the example as follows:</ListTitle>
						<ListItem>Link the Maintain data responsibility to the Manager role. Link that combination to process A in the <Link href="/baanerp/tg/brg/tgbrg5106m000" role="session">Roles by Business Process (tgbrg5106m000)</Link> session. The role applies to business process A and includes all lower-level activities because roles and responsibilities are inherited by the lower levels. Consequently, these roles and responsibilities do not have to be defined at the lower levels.</ListItem>
						<ListItem>Select the Excluded check box in the <Link href="/baanerp/tg/brg/tgbrg3150s000" role="session">Role by Business Process Activity Properties (tgbrg3150s000)</Link> session to exclude the manager role from activity D. Remove the responsibility Maintain Data and add the responsibility Checks Data.</ListItem>
						<ListItem>Link the Secretary role to activity D in the <Link href="/baanerp/tg/brg/tgbrg8110m000" role="session">Roles (tgbrg8110m000)</Link> session. Also, define the Maintain data and Informs Manager responsibilities for that activity.</ListItem>
					</ProcedureList>
				</ExampleSection>
			</GeneralSection>
			<GeneralSection ID="A3"><SectionTitle>Authorization for Application type activity</SectionTitle>
				<Paragraph>If you link a role to a business process or an activity you can also define the authorization for that role for activities of type application.</Paragraph>
				<List><ListIntro>Authorizations:</ListIntro>
					<ListItem><GUIRef href="" role="manual">No Authorization</GUIRef>: The application cannot be started by any user.</ListItem>
					<ListItem><GUIRef href="" role="manual">Display</GUIRef>: Data is only displayed. No data can be maintained or printed.</ListItem>
					<ListItem><GUIRef href="" role="manual">Print/Display</GUIRef>: Data can only be printed.</ListItem>
					<ListItem><GUIRef href="" role="manual">Modify/Print/Display</GUIRef>: Data can be displayed, printed, and changed.</ListItem>
					<ListItem><GUIRef href="" role="manual">Insert/Modify/Print/Displ</GUIRef>: Data can be displayed, printed, changed and new data (records) can also be inserted.</ListItem>
					<ListItem><GUIRef href="" role="manual">Full Authorization</GUIRef>: Data can be displayed, printed, changed, and inserted. Data can also be deleted.</ListItem>
				</List>
			</GeneralSection>
			<GeneralSection ID="A4"><SectionTitle>Linking employees to roles</SectionTitle>
				<Paragraph>If you have defined the roles, the next step is to link to each role the employee(s) that must fulfill it.</Paragraph>
				<ProcedureList><ListIntro>Carry out the following steps to link employees to roles:</ListIntro>
					<ListItem>Start the <Link href="/baanerp/tg/brg/tgbrg8110m000" role="session">Roles (tgbrg8110m000)</Link> session.</ListItem>
					<ListItem>Select the role to which you want to link one or more employees.</ListItem>
					<ListItem>On the Specific menu, click the Employees by Role... command.</ListItem>
					<ListItem>Click the New button and link the employees to the role.</ListItem>
				</ProcedureList>
			</GeneralSection>
		</GeneralSection>
	</GeneralSection>
	<RelatedTopics><SectionTitle>Related topics</SectionTitle>
		<RelTopic><Link href="/baanerp/tg/onlinemanual/000044" role="manual">Organizational modeling</Link>
		</RelTopic>
	</RelatedTopics>
</ManualTopic>
