Skip to main content

14.2 — Users, Roles & Privileges

1. Global roles versus scoped roles​

A global role controls capabilities at the tenant level.

A scoped role applies privileges to selected spaces.

This distinction is fundamental.

A user may therefore have different responsibilities in different spaces.

For example:

UserFinanceSalesProcurement
Modeler AModelerViewerNone
Modeler BNoneModelerModeler
Analyst AViewerViewerViewer

2. Standard roles​

Current SAP Datasphere provides standard role templates and predefined roles for common responsibilities.

Examples include:

  • System Owner;
  • DW Administrator;
  • DW Space Administrator;
  • DW Viewer;
  • DW Consumer.

Do not memorize role names as architecture. Understand the privileges behind them.

3. Role composition​

Use this reasoning:

PERSON | +--> GLOBAL ROLE | +--> SCOPED ROLE | +--> SPACE A +--> SPACE B

The effective authorization is the result of the user's assigned roles and privileges.

4. Privilege categories​

Privileges are associated with application areas, objects and tasks.

Typical categories include:

  • Data Warehouse General;
  • Spaces;
  • User;
  • Role;
  • Data Builder;
  • Data Integration;
  • Connection;
  • Data Access Control;
  • Lifecycle;
  • Activity Log;
  • Catalog-related privileges.

Always validate the exact privilege required for the current product version instead of relying on an old role matrix.

5. CRUD is not the whole story​

A role can have different operations such as:

  • create;
  • read;
  • update;
  • delete;
  • share;
  • maintain or manage.

The security review must consider the exact operation, not merely whether the user can open the application.

6. Scoped roles​

Scoped roles are particularly powerful for enterprise environments because one role definition can cover selected spaces while still allowing differentiated membership.

Example:

DATA_ENGINEER_EU | +--> Sales_EU +--> Finance_EU +--> Procurement_EU

This is generally more maintainable than manually assigning dozens of independent combinations.

7. Least-privilege workflow​

For every role:

  1. identify business responsibility;
  2. list required applications;
  3. list required operations;
  4. identify required spaces;
  5. remove unused privileges;
  6. test positive access;
  7. test negative access;
  8. document ownership;
  9. review periodically.

8. Anti-patterns​

Everyone is an administrator​

Fast initially, dangerous permanently.

Copy the DW Administrator role for every team​

Creates uncontrolled privilege growth.

One role per person​

Produces authorization sprawl.

Security through undocumented convention​

If access depends on tribal knowledge, it is not a reliable control.

Hands-on lab​

Create a role matrix for:

  • platform admin;
  • space admin;
  • data engineer;
  • analyst;
  • consumer.

For each, document global privileges, scoped privileges, spaces and prohibited actions.

Architect question​

When would you prefer a standard role, a custom role, or a scoped role?

Your answer should consider reuse, blast radius, separation of duties and lifecycle management.