{"ref":"content:devtoberfest-2026-rap-authorizations-business-users","page":"/content/devtoberfest-2026-rap-authorizations-business-users","json":"/content/devtoberfest-2026-rap-authorizations-business-users.json","generated":"2026-10-30","drafted_with_ai":true,"entity":{"id":"devtoberfest-2026-rap-authorizations-business-users","title":"Developing authorizations for business users in SAP Business AI Platform, ABAP environment","content_type":"talk","url":"https://www.youtube.com/watch?v=iL3AtlE3cBQ","published":"2026-10-12","published_on":"source:youtube","authors":["actor:anfisc"],"summary":"A Devtoberfest 2026 session that walks the places an authorization check has to be written when a RAP business object is implemented, which is the whole of the [authorization](capability:authorization) edge: read restrictions as DCL access controls that become a filter at query time, a child entity inheriting its parent's conditions through an association, the projection layer inheriting rather than changing them, and the same check repeated on the draft side. The [ABAP CDS](artifact:abap-cds) edge holds on that draft half — until 2608 a draft query view was needed above the draft table so a DCL had something to attach to, while a draft table entity is already on CDS level and takes the DCL directly, as long as the associations used in the inherited conditions are redefined on it. Create, update and delete are then taken handler by handler, including the trap that instance authorization reads the buffer and so cannot see the new value a pre-check would reject, and the session closes on in local mode and privileged EML calls.","short":"Where authorization checks go when implementing a RAP BO","explains":[{"ref":"capability:authorization","applies_to":{"ecosystems":["abap"]}},"artifact:abap-cds"],"sources":[{"url":"https://www.youtube.com/watch?v=iL3AtlE3cBQ","title":"Developing authorizations for business users in SAP Business AI Platform, ABAP environment","checked":"2026-10-19","quote":"we will explain you the different yeah, points where authorizations have to be implemented when you implement a RAP BO"},{"url":"https://www.youtube.com/watch?v=iL3AtlE3cBQ","title":"Developing authorizations for business users in SAP Business AI Platform, ABAP environment","checked":"2026-10-19","quote":"So, what uh what happens if you build uh uh an access control uh object with DCL. So, that technically means that a filter uh is present at query time."},{"url":"https://www.youtube.com/watch?v=iL3AtlE3cBQ","title":"Developing authorizations for business users in SAP Business AI Platform, ABAP environment","checked":"2026-10-19","quote":"And because this is technically now a CDS view we can add an authorization check via DCL to that."},{"url":"https://www.youtube.com/watch?v=iL3AtlE3cBQ","title":"Developing authorizations for business users in SAP Business AI Platform, ABAP environment","checked":"2026-10-19","quote":"we don't need this CDS CDS view in between the database table and the DCL because we already are on the CDS level with our table entities so we can just use our draft table entity and define a DCL on top of it"}],"provenance":{"discovered_via":[{"source":"source:youtube","channel":"devtoberfest-2026"}],"first_seen":"2026-10-19"},"drafted_with_ai":true},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"good","evidence":"published this month"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"good","evidence":"no recorded change after 2026-10-12"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":null,"unit":"views"},{"value":null,"unit":"comments"},{"value":null,"unit":"likes"}]},"signals":null,"series":null,"edges":{"authors":[{"ref":"actor:anfisc","name":"Andre Fischer","json":"/actors/anfisc.json"}]}}