---
title: "The Authorization Model"
description: "Three duties per business object (View, Edit, Process), object roles and add-on bundles, licensing and roles both checked, and what a refused user sees."
source: "https://help.rikaiso.com/public-cloud/2026.2/authorization-model"
edition: "public-cloud"
editionLabel: "S/4HANA Public Cloud"
version: "2026.2"
latest: true
language: "en"
section: "Information for Administrators > Users, Roles and Role Collections"
updated: "2026-11-05"
---

# The Authorization Model

> Three duties per business object (View, Edit, Process), object roles and add-on bundles, licensing and roles both checked, and what a refused user sees.

> **Draft brief for authors.** Replace with the final text; keep the concept-page structure.

**Page type:** Concept · **Audience:** Administrator

**Contains**

- One role per business object and duty (Equipment Viewer, Equipment Partner Editor, Maintenance Task List Operation Processor, …); an Editor includes View, a Processor includes View; nothing is inherited within a family.
- The add-on bundles (Asset Management Viewer / Editor / Processor) as every object of the add-on.
- Licensing (add-on) and roles are always both checked; fail closed.
- What a refused user sees: the sentence naming the role and the collection that would grant the action; tiles, tabs and lists follow the roles.
- Who may stop or pause a job: the same duties per object.

**Related information:** `role-collections`, `custom-role-collections`, `messages-authorization`.

**Source in the product repository:** customer guide §4, `.claude/rules/licensing-and-roles.md` (D108, D139).