Why it comes up
Most ECC role sets grew by accretion. A role was copied for one user, a transaction was added to unblock a month-end, and nobody removed anything. Carrying that into S/4HANA means carrying fifteen years of compromise into a system you have just paid to rebuild.
What the work covers
Business role model
Roles that map to jobs people recognise, not to technical groupings only the security team understands.
Derived role structure
A master and derived design that keeps org-level maintenance out of the transport path.
Org-level strategy
Company code, plant, purchasing organisation and sales area decided once, deliberately.
Naming conventions
A convention that tells you what a role is, who owns it and where it applies, from the name alone.
Usage-based design
Built from actual execution data, so the catalogue reflects real work rather than requested work.
What you get
A signed business role catalogue, a derived role structure, and a naming standard your team can apply without us.
Other services
SoD remediation
Conflicts ranked, mitigated and signed off
Fiori authorization
Spaces, pages and catalogues mapped to roles
Audit readiness
Evidence prepared before the auditor asks
SAP BTP security
IAS, IPS, role collections and API access
Baseline assessment
A fixed-price read of where you stand today
Bring us in at the gate that suits you.
Phase 01 stands alone as a fixed-price baseline assessment if you want to understand your exposure before committing a workstream.