Access and SoD for S/4HANA
Move access once, with your S/4HANA program.
Roles, segregation of duties and audit evidence usually arrive after go-live, as a clean-up. We design them into the program, for people and for AI agents, so you do not pay for the move twice.
Fixed scope. Ends with a role impact report and a segregation of duties baseline for S/4HANA.
Two ways to move access. Tap to compare what arrives.
example, made-up dataArrives clean 0
Needs a decision 5
- Fiori app access
- Emergency access
- Mitigating controls
- AI agent access
- Go-live audit evidence
Carried over 3
- Old segregation of duties conflicts
- Roles nobody uses
- Custom code authorizations
The problem
Access is the part of the move everyone leaves for later.
Old roles do not fit new apps
S/4HANA and Fiori change what a role has to contain. Copied roles are either too wide or broken.
Conflicts travel with you
Every segregation of duties conflict you have today moves with the data unless someone removes it.
Agents arrive with the new system
AI agents act through roles as well. If nobody designs their access, they inherit a person's.
Auditors ask at go-live
They want to see who can do what on day one, and how you know.
A migration moves your data. It also moves every access mistake you have.
What we do
Measure, set the rules, redesign, go live with evidence.
- Step 01 of 4
Measure the impact
Which of today's roles survive the move, which break, and which should be retired.
- Step 02 of 4
Set the baseline
A segregation of duties ruleset for S/4HANA, agreed with your process owners and audit.
- Step 03 of 4
Redesign and test
Role design for people and for agents. We design and lead; the build is done with your integrator.
- Step 04 of 4
Go live with evidence
What your auditor needs on day one, prepared before cutover.
Step 1 of 4
What you get
Six documents that keep access inside the program, not after it.
Tap a document to see what's inside.
- Roles that carry over
- Roles that break
- Roles to retire
- Rules by business process
- Conflicts you accept, with reasons
- Who signed off
- Built for the new apps
- Least access by default
- Tested against the baseline
- Each agent's role
- No agent approves its own work
- Where a person must step in
- What must be ready for each test cycle
- Who builds and who reviews
- Cutover checks
- Who can do what
- How conflicts were handled
- Emergency access and its log
How it fits
Your integrator moves the system. We make sure access moves properly.
We work inside your program, alongside the integrator, not instead of them.
Your integrator
Moves data, configuration and code
- Runs the migration
- Builds roles to a design
- Owns the cutover
Your auditors
Test at go-live
- Ask who can do what
- Test segregation of duties
- Want evidence, not promises
We design and lead
The access workstream
- Role and ruleset design
- Agent access alongside people's
- Review of what the integrator builds
- Evidence ready before cutover
Who this is for
Your S/4HANA program is planned, and access is not in it yet.
- Your S/4HANA program is starting or already running.
- Access and GRC are outside your integrator's scope.
- You have audit findings on access you do not want to carry over.
- You plan to switch on Joule after go-live.
How to start
How to start
- 01
Role impact review
Fixed scope. Ends with the role impact report and the baseline.
- 02
Access design
Role design, agent access rules and the migration plan.
- 03
Go-live support
Reviews during build and test, and the evidence pack.
Questions
What people ask before the first call.
Do you replace our system integrator?
No. They run the migration and build. We design the access workstream, review what is built, and prepare the evidence.
Can this start in the middle of a program?
Yes. Earlier costs less, because every test cycle run with copied roles has to be repeated.
Does it cover SAP GRC Access Control?
Yes. The ruleset work includes it, and the design covers whether you keep it or move to one of SAP's newer options.
Do AI agents need segregation of duties rules?
Yes. If one agent can create a payment and another can approve it, you have the same conflict you would have with two people.
Will your access arrive clean, or just arrive?
Start with the role impact review. You will know which roles survive the move before the first test cycle.
Or write to support@ux4tech.com
Insights and Architecture Briefs
