What Can ACE Do for You? Lessons Learned from a Recent Implementation

  • by Boris Dingenouts, Senior SAP CRM Consultant, Exxap
  • May 15, 2007
Learn how CRM Access Control Engine (ACE) provides CRM users with just the data they need, reducing the time spent maintaining data. Also learn how to set up business rules in ACE with minimal ABAP programming. Finally, take a look at lessons learned from a recent ACE implementation.
Key Concept

Access Control Engine (ACE) determines access rights on a business object level. It does not control whether you are allowed to see customers, but it controls which customers you are allowed to see. For example, you can see customers A, B, and C, but not customers D through Z. They do not show up in any search list and, as far as you are concerned, they do not exist in the system. This is based on business rules — for example, you can see customers who are assigned to the same sales area as you are or who are located in the same country as you.

Say you are an SAP CRM user and want to search for a customer, but you know only part of the name. This is not a problem if you just have thousands of customers in your SAP CRM system. It is also not a problem if you are responsible for customers in just one sales area and your authorizations are set up to limit the results of your search query. However, what if you have millions of customers or you are responsible for customers across multiple sales areas and your search result lists contain irrelevant customers? It would be more efficient if the user’s authorizations could adapt to the user’s role.

To satisfy these requirements, SAP created Access Control Engine (ACE), which controls what you can view, modify, and delete by using rules. For example, a typical rule is that users can view all customers who belong to their sales areas, but only modify those they are linked to as the responsible employee. In addition to focusing searches, ACE allows you to control what external agents can view in your system. Also, if your organizational model changes, ACE allows your sales representatives to view updated customer lists automatically. To compare this to Basis authorizations, see the sidebar, “How ACE Differs from Basis Authorizations.”

I’ll explain the components of ACE — the actors, rules, user groups, and rights. Then, I’ll explain how to create custom rules so you can use ACE in CRM Sales and Service scenarios. In the standard delivered ACE content you have only user groups and rules that are designed for Partner Channel Management and contain relationship types that are specific to Partner Channel Management. This means that you cannot use the ACE rules out of the box in standard CRM Sales and Service scenarios. In this case, you must create your own rules by copying the standard SAP rules.

I’ll also describe how to activate the rules in ACE and show how they work during runtime. Finally, I’ll share some lessons learned from recent ACE projects. ACE works only with People-Centric User Interface (PCUI). You can use ACE in all SAP CRM versions in which PCUI is delivered, including SAP CRM 4.0 and 2005.

Boris Dingenouts

Boris Dingenouts is a senior SAP CRM consultant for the Dutch consulting company Exxap. Boris has more than 11 years of consulting experience in SAP, with more than six years in SAP CRM. Exxap is an innovative SAP consultancy company with a focus on SAP xApps.

See more by this author


No comments have been submitted on this article. 

Please log in to post a comment.

To learn more about subscription access to premium content, click here.