1986264 - ARA: Rule set changes for FBZ0 object F_REGU_BUK

Within SAP standard rule set, in functions AP01, and AR01, there is a rule for t-code FBZ0 where the ACTVT 12 and 13 are enabled for auth object F_REGU_BUK and field FBTCH

ACTVT 12 = Edit proposal

ACTVT 13 = Display proposal

This means, if a role has both ACTVT 12 and 13 for auth object F_REGU_BUK and field FBTCH, this role violates a risk.

If a user has ACTVT 12 to edit proposal, is it really a risk to have also the ACTVT 13 to display a proposal?

SAP Access Control 12.0

GRAC_RA_RULESET_SAP_R3, BC, SCPR20, identical, differs, authorization object, transaction, risk, violates, has a risk, display , KBA , GRC-SAC-ARA , Access Risk Analysis , How To