babamba2babamba2/superclaude-for-sap/skills/role-matrix/SKILL.md

role-matrix

Skill69 starsChanged 7 months agoMITView on GitHub

SAP role & authorization document for a project — one editable HTML workbook (cover with checks, business roles, technical PFCG roles, business role × T-code matrix F/C/D, user × role assignment, authorization objects, SoD rules with automatic conflict check, change history). New design (module consultant proposes roles, T-codes, authorization objects and SoD rules; T-codes narrowed to the ones users run when ST03N usage is available) or read from the connected SAP system (PFCG roles, T-codes, authorization values, org levels, user–role assignment by user ID). Spreadsheet-style editing in the browser, CSV per sheet, versioned.

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Very specific:
MUST read workflow.md before Step 1.
line 53

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

SC4SAP Role Matrix

One editable HTML workbook per role design — the classic SAP role-matrix workbook (seven sheets and a cover) as a page the security owner, module consultants and the business edit together. Built new from a consultant's proposal, or read from the roles that already exist in SAP.

<Purpose>
Role design is a project deliverable that changes every week: business roles are argued over with the business, T-codes move between roles, users are assigned before go-live, SoD conflicts must be found before an auditor does. Spreadsheets drift from what PFCG really holds. This skill keeps one model, draws the workbook from it, checks it (unmapped roles, T-codes in no role, SoD conflicts per user and inside a role), and can read the real roles from SAP so the document starts from the system — not from memory.
</Purpose>

<Response_Prefix>Every response triggered by this skill MUST begin with [Model: <main-model> · Dispatched: <sub-summary>] per ../../common/model-routing-rule.md § Response Prefix Convention.</Response_Prefix> <Target_Object>Roles are read on the active profile's system only. Not found → stop and ask per ../../common/multi-profile-artifact-resolution.md § Target object not on the active system.</Target_Object>

<Use_When>

"권한 매트릭스", "Role 매트릭스", "역할 설계", "권한 설계서", "PFCG 역할 정리", "SoD 점검", "사용자 권한 배정표", "role matrix", "authorization concept", "SoD"
A project needs its role & authorization document (new design), or an existing system's roles must be documented / reviewed </Use_When>

<Do_Not_Use_When>

Creating or changing roles in PFCG — this skill never writes to SAP
Reading user master data, passwords or logon data — never
Process documentation → /sc4sap:module-to-process; project plan → /sc4sap:project-dashboard </Do_Not_Use_When>

<Session_Trust_Bootstrap> MANDATORY — Step 0. Invoke /sc4sap:trust-session with parent_skill=sc4sap:role-matrix. Skip silently if .sc4sap/session-trust.log has a line within the last 24h. </Session_Trust_Bootstrap>

<Decisions_Fixed> Settled with the user (2026-10-28) — do not ask again:

Topic	Decision
Layout	The classic workbook: cover (document info, sheet guide, legend, computed summary, checks), 1 business roles, 2 technical roles, 3 business role × T-code (F/C/D), 4 user × business role (X), 5 authorization objects, 6 SoD, 7 change history
Company form	Forms differ by company. The workbook above is the default; on request a company layout (`layout.md`) read from the company's own form (.html / .docx) sets sheet titles and order, columns and headers, own columns, level codes, cover fields, colours, font and logo — editing, CSV, checks and SoD stay the same
Output	ONE self-contained HTML page per document with spreadsheet-style editing (range select, F/C/D/X typed over a range, Excel copy / paste, fill down, undo, rename an ID everywhere) and CSV per sheet. No xlsx
Mode	Always ask: new design or read from SAP
SAP reads	Role design tables (AGR_DEFINE, AGR_TEXTS, AGR_FLAGS, AGR_AGRS, AGR_TCODES, AGR_1251, AGR_1252) and the assignment table AGR_USERS (user ID and validity only). Names, departments and positions of users are typed in the page. USR* tables are never read
New design	The module consultant proposes business roles, T-codes with levels, technical roles (master + derived per org value), authorization objects (SU24 view) and SoD rules; narrowed to the T-codes users run when ST03N usage is available
SoD	Rules by business-role pair or by T-code sets (library `scripts/role/sod-library.json`); conflicts are computed per user and inside a single role
Versions	0.1 steps in sheet 7; each Save in the page adds a row; `--major` for 1.0
</Decisions_Fixed>

<Paths>
`<RM>` = `<artifactBase>/roles` ([`../../common/multi-profile-artifact-resolution.md`](../../common/multi-profile-artifact-resolution.md)). Per document `<RM>/<CODE>/`: `<CODE>-roles.json` (model), `<CODE>-role-matrix-v<ver>-<lang>.html`, `_src/`. Tool: `node "<PLUGIN_ROOT>/scripts/role/build-role-doc.mjs" <cmd> … --dir <RM>` (the header of that file lists every command).
</Paths>

<Workflow>
MUST read [`workflow.md`](workflow.md) before Step 1. Model fields: [`model-schema.md`](model-schema.md) — read before writing a draft or editing a model file.
</Workflow>

<Output_Format>

Role matrix <CODE> · <project> · v<ver> · <new design | read from SAP <SID> (<n> roles)>
Business roles <n> · technical roles <n> · T-codes <n> · users <n> · auth rows <n> · SoD rules <n> (broken <n>)
Checks: <err> errors · <warn> warnings — <top 3>
Page: <html>
Next: edit in the browser → Save → "import <file>", "SoD 규칙 추가 (MM, FI)", "SAP에서 다시 읽기", "회사 양식 적용 (<form>.docx)"

</Output_Format>

Download now (ZIP)

In this repository23 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- analyze-cbo-objSkill
- analyze-codeSkill
- analyze-symptomSkill
- ask-consultantSkill
- compare-programsSkill
- config-to-documentSkill
- create-objectSkill
- create-programSkill
- ecoSkill
- interface-mapping-specSkill
- mcp-setupSkill
- module-to-processSkill
- package-to-processSkill
- program-to-manualSkill
- program-to-specSkill
- project-dashboardSkill
- sap-doctorSkill
- sap-optionSkill
- setupSkill
- smartform-from-pdfSkill
- smartform-previewSkill
- trust-sessionSkill

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free