3794069 - Write Access Restrictions Not Enforced When Read Access Is Unrestricted

In C4C v1, when a Business Role is configured with Read Access = Unrestricted and Write Access = Restricted using structural Restriction Rules (such as 01 or 99), the write restrictions are not enforced for business objects controlled by instance-level Access Contexts (e.g., Tickets). Users can modify and successfully save changes to records explicitly outside their authorized organizational, team, or territory scope without receiving an authorization error.

SAP Cloud for Customer

1. Go to the Administrator work center → Business Roles and select the target role.
2. In the Access Restrictions tab, locate the relevant Work Center Views (e.g., SEOD_TICKETMD_SADL_WCVIEW).
3. Set Read Access = Unrestricted and Write Access = Restricted.
4. In the Restriction Rule column for Write Access, explicitly select 99 - Define Specific Restrictions.
5. Go to the lower Detailed Restrictions tab, locate the master data hierarchy (e.g., Organizational Units, Teams, or Territories), and manually check specific authorization groups to whitelist them while leaving the rest unchecked.
6. Go to Administrator → General Settings → Check User's Authorization.
7. Run a check for the target Business User against an out-of-scope Business Object instance (e.g., a Ticket belonging to a Team or Org Unit left completely unchecked in your Rule 99 setup).
8. Observe : The Document Access tab confirms that the instance's Access Control List (ACL) has no overlap with the user's calculated authorizations.
9. Log into the system as the affected business user.
10. Locate and open the out-of-scope business record (the record appears in the list because Read Access is set to Unrestricted).
11. Modify any editable field and click Save.
12. Actual Result: The save operation succeeds without any authorization block or user-facing error message. The changes are permanently recorded in the object's Changes tab, bypassing the Rule 99 constraints entirely.
13. Expected Result (from a business logic perspective): The save operation should be rejected with an authorization error, since the user possesses no matching write parameters in the instance's ACL buffer according to Rule 99.

This behavior is By Design and reflects the performance-optimized architectural sequence of the SAP Business Object Processing Framework (BOPF) and the Access Control Engine.

A platform code-level change will not be introduced for this behavior in version 1 due to the foundational architectural dependencies of the access engine. To enforce strict segregation of duties and prevent unauthorized write operations, you must transition to one of the two officially supported configuration workarounds:

1. Create the Visibility Role (Role A):
   • Go to Administrator and Business Roles.
   • Set Read Access to Restricted and Write Access to No Access.
   • Choose a broad, landscape-wide restriction rule (such as 01 - Local/Territory or an expansive custom variant) to grant the necessary broad visibility.
2. Create the Operational/Execution Role (Role B):
   • Set Read Access to Restricted and Write Access to Restricted.
   • Assign the strict, targeted Restriction Rule 99 (or another specific rule) and map the explicit whitelisted Org Units, Teams, or Territories.
3. Assign Both Roles to the User:
   • C4C will merge the permissions at runtime. Because both roles require a Restricted Read, the engine is forced to fully execute instance-level database queries and load the ACL buffer.
   • The active buffer allows Role B's strict Write restrictions to successfully validate and block out-of-scope saves.