HIGH Effort: M — Medium (days) Security

How to remediate: Missing AUTHORITY-CHECK

Programs reading/writing sensitive data without AUTHORITY-CHECK statements.

Is this issue in your codebase?

A1 scans all 30 rules across your custom ABAP — results in minutes.

Scan your codebase free →

What changes in S/4HANA

S/4HANA audit requirements. ABAP Cloud checks require explicit authorization.

Before and after: ABAP code example

Before (ECC) 
* ECC: reads vendor data without authority check
SELECT lifnr, name1, ktokk
  FROM lfa1
  INTO TABLE @DATA(lt_vendors)
  WHERE ktokk = @lv_account_group.
After (S/4HANA) 
* S/4HANA: explicit authority check before read
AUTHORITY-CHECK OBJECT 'F_LFA1_GRP'
  ID 'KTOKK' FIELD lv_account_group
  ID 'ACTVT' FIELD '03'.
IF sy-subrc <> 0.
  RAISE EXCEPTION TYPE cx_sy_no_handler
    MESSAGE 'No display authorization for vendor group'(001).
ENDIF.
SELECT lifnr, name1, ktokk
  FROM i_supplier
  INTO TABLE @DATA(lt_vendors)
  WHERE supplieraccountgroup = @lv_account_group.

Effort estimate and common pitfalls

Effort estimate

M — Medium (days)

Estimate is per affected object. Total effort scales with the number of occurrences in your codebase. Use the A1 scan to get an object-level count before estimating the full project.

Common pitfalls

  • ! Missing related objects that contain the same pattern
  • ! Not testing edge cases after replacing the API
  • ! Skipping regression tests for dependent programs

Related rules to check

MEDIUM S

Hardcoded client/system fields

Hardcoded MANDT, client numbers, or system IDs. Breaks in multi-client and cloud scenarios.
HIGH L

ABAP Cloud restricted object access

Access to SAP internal objects without C1 release status. These are blocked in ABAP Cloud.
MEDIUM S

Unchecked SY-SUBRC

Database operations or function module calls without checking SY-SUBRC return code.

Find every instance of this issue in your codebase

The A1 scanner checks all 30 compatibility rules — including Missing AUTHORITY-CHECK — across your custom ABAP objects and produces a prioritised remediation backlog.

Scan your codebase for this issue free →
← All remediation rules Resources →

SAP, S/4HANA and ABAP are trademarks of SAP SE. s4ready.ai is an independent solution and is not affiliated with, endorsed by, or sponsored by SAP SE.