authorization-iam

Implement ABAP authorization by selecting the right model for your platform: use IAM apps with business catalogs for ABAP Cloud, or PFCG roles for on-premise. This provides structured workflows for both environments.

CDS DCL defines data-level access controls directly in Core Data Services, while PFCG manages role-based authorizations for on-premise systems. CDS DCL secures data access, whereas PFCG handles broader role assignments.

Create authorization objects by defining fields and validation logic, then apply field restrictions to enforce role-based access. Real-world examples illustrate configuring these checks and managing field-level security.

ABAP Cloud uses IAM apps and business catalogs for identity and access management instead of classic AUTHORITY-CHECK. For on-premise systems, traditional AUTHORITY-CHECK and CL_ABAP_AUTHORIZATION remain valid approaches.

You need CDS access control when securing data at the Core Data Services model level, ensuring consistent reads. PFCG role management is used for broader transactional and user-level access on-premise.

IAM apps are specific to ABAP Cloud environments and require business catalogs for role assignment. They do not apply to on-premise scenarios, where PFCG role management and classic authorization objects are required.