Protect both reads and changes at the right layer

CDS access control (DCL) can restrict which rows a CDS consumer reads. RAP authorization handles whether a user may perform a BO operation such as update or delete. These controls solve related but different problems.

Declare an authorization strategy

authorization master ( instance )

This BDEF characteristic says the root entity uses instance authorization. The behavior implementation must provide the authorization logic and report the decision correctly. A DCL rule on the CDS entity does not by itself authorize a write operation.

Design read visibility, operation authorization, and field/operation availability separately. Do not use a client-supplied filter or a hidden UI button as an access-control boundary. Test the behavior with appropriate users and roles in the target system; this article’s code checker is not a security test.

Sources

Developer practice · ABAP

Practice: identify which RAP layer enforces access

Declare instance authorization in the behavior definition, and identify DCL as a separate read-access concern.

Complete the task using the syntax and structure described above. Variable names can differ if you use them consistently. This browser checker checks structure only; it does not compile or run ABAP.

0 required structures detected · 0 checks