Architectural Reference Blueprint • Module 09
Enterprise CDS Access Control & DCL Security Architecture in ABAP Cloud
👤 Andrea Antonio Perrelli (SAP Certified Solution Architect)
📅 October 2026
⏱ 8 min read
🌎 Clean Core Security & Authorization
Imperative AUTHORITY-CHECK statements inside procedural loops are a major cause of memory bottlenecks, data leaks in Fiori Elements OData services, and ATC clean core rejections. In this reference guide, discover how to architect declarative, database-pushed authorization rules using SAP CDS Data Control Language (DCL).
1. The Performance Flaw of Imperative Authorization
In legacy SAP implementations, authorization was typically enforced imperatively in application server memory:
/* ANTI-PATTERN: Imperative check inside procedural loop */
SELECT * FROM vbak INTO TABLE @DATA(lt_orders).
LOOP AT lt_orders INTO DATA(ls_order).
AUTHORITY-CHECK OBJECT 'V_VBAK_VKO'
ID 'VKORG' FIELD ls_order-vkorg
ID 'ACTVT' FIELD '03'.
IF sy-subrc <> 0.
DELETE lt_orders. " Severe memory & network overhead
ENDIF.
ENDLOOP.
This architecture suffers from critical flaws:
- Massive Data Transfer: All records are transferred from SAP HANA to the ABAP application server before filtering occurs. If a user only has access to 5 out of 100,000 sales orders, 99,995 rows are fetched across the network and discarded.
- Broken Paging in Fiori Elements: In modern OData V4 services, client paging (
$top=50&$skip=0) is evaluated at the database level. If authorization filtering happens later in memory, the client receives empty or truncated page sets.
- ATC Cloud Blocker: ATC variant
ABAP_CLEAN_CORE_DEVELOPMENT flags missing DCL access controls on CDS view entities as security compliance errors.
2. Declarative Authorization Pushdown via DCL
In SAP CDS, authorization rules are declared in separate artifacts using Data Control Language (define role). When Open SQL queries the CDS view entity, the SAP HANA SQL Optimizer automatically transforms the DCL rules into dynamic WHERE clauses in the native database query.
@EndUserText.label: 'Access Control for Sales Orders'
@MappingRole: true
define role ZR_SalesOrder {
grant
select
on
ZR_SalesOrder
where
( SalesOrganization ) = aspect pfcg_auth (
V_VBAK_VKO,
VKORG,
ACTVT = '03'
);
}
Zero Network Waste: Because the DCL condition is pushed directly into the HANA calculation engine, only rows for which the user possesses active PFCG authorizations are ever read off disk.
3. Multi-Field PFCG Authorizations & Literal Conditions
Real-world enterprise requirements often involve compound authorizations (e.g., verifying both Sales Organization and Distribution Channel) or combining role checks with business status literals:
@EndUserText.label: 'Multi-Aspect Access Control with Literal Conditions'
@MappingRole: true
define role ZR_SalesOrderComposite {
grant
select
on
ZR_SalesOrder
where
// 1. Compound multi-field PFCG check
( SalesOrganization, DistributionChannel ) = aspect pfcg_auth (
V_VBAK_VKO,
VKORG,
VTWEG,
ACTVT = '03'
)
// 2. Exception: Always allow viewing public/demo orders
or OrderType = 'DEMO'
// 3. User-specific field mapping (SAP user name)
or CreatedByUser = aspect user;
}
4. DCL Inheritance in Projection Views
When building SAP RAP business objects, access controls defined on the Interface View (ZR_*) do not need to be duplicated on the Consumption Projection View (ZC_*). Instead, use the inherit clause:
@EndUserText.label: 'Inherited Access Control for Projection'
@MappingRole: true
define role ZC_SalesOrder {
grant
select
on
ZC_SalesOrder
where
inherit ZC_SalesOrder on ZR_SalesOrder;
}
5. Privileged Access Mode: Background Processing
In background batch jobs, asynchronous event listeners, or technical admin utilities where user context does not exist, developers previously had to bypass authorization by disabling checks globally.
In ABAP Cloud, you explicitly invoke the WITH PRIVILEGED ACCESS addition in Open SQL:
/* Clean Core Compliant Privileged Read in ABAP Cloud */
SELECT SalesOrder,
TotalNetAmount,
Currency
FROM ZR_SalesOrder WITH PRIVILEGED ACCESS
WHERE CreationDate = @lv_today
INTO TABLE @DATA(lt_batch_orders).
Generate DCL Roles Interactively:
Use our free browser-based SAP CDS Access Control & DCL Role Generator.
Launch DCL Generator →
COMPLETE ENTERPRISE ARCHITECTURE SUITE
Master Enterprise Clean Core on S/4HANA & SAP BTP
Get all 15 modules, 40 Retina architecture diagrams, 61 production-grade code snippets, editable DOCX specifications, and the SAP BTP AI Companion.