Authorizations to create substitutes

[Soady, Phil]

Before going the full development route you should also consider the TASK Classification option.
 
The classification allows you assign tasks to a concept.
 
One or more classes are assigned to a subst. Profile.
So that when you a creating a substitute you can nominate
the "profile" you are delegating.  EG HR tasks.
 
This could simply prevent the delegation of ALL tasks at once.
 
One could build a custom tool to maintain HRUD_D2 / or HRP1000 A210
which ever you are using, so that the profile is always part of the process.  Or perhaps A simply mod to make it a mandatory field.
 
Then a program can run regularly to make sure certain HRUS_D2
entries when created are  appropriate and if  not remove them.
 
The whole concept of profiling and task classification is important to substitution, since it is quite important to be able to delegate, but also to be able to say but only these tasks are delegated.
 
EG Delegate approval of leave but not approval of major financial decisions.
 
See tables T77tc, t77ro and t77rp.
Now classify a task (same screen as possible  agent assignment)
You can now test delegations in HRUS_D2 with specific profiles.
 
Only certain tasks you be made visible to the other user.
 
cheers
Phil.
 
 
 
Phil Soady
Senior Consultant
Professional Services
SAP Australia
Level 1, 168 Walker Street, North Sydney 2060, Australia.
M   +61 412 213 079
E   phil.soady at sap.com
http://www.sap.com
 
 
-----Original Message-----
From: Hassine, Felix [mailto:Felix.Hassine at pmintl.com]
Sent: Friday, August 22, 2003 3:23 AM
To: SAP-WUG at MITVMA.MIT.EDU
Subject: Re: Authorizations to create substitutes
 
Thanks for everyone for the input.
 
As I expected, the restriction of the substitution ability is driving us
into developped solutions.
 
In other words, we have to integrate this as a development constraint, and
tell workflow designers around our company that the effects and weaknesses
of substitution need to be addressed at the workflow design levels.
 
Conceptually, I don't think the workflow coding is the right place to
auto-protect itself against bad substitutions, because this is an admin
task, inherent to the role of the Workflow Business Administrator.
 
 
In the meantime, I think a must-have is the ability to restrict the
substitute functions (workflow settings) with an authorization object.
 
Jocelyn, a BADI could be a solution. If this is of any interest, here are my
basic requirements:
 
        - Have a  user-exit on the substitution screen
        - Have a Task-dependant or task-group-dependant substitution
mechanism (should't be difficult, after all this is all infotype links
between HR-defined objects, is it not?). The reason is that I want different
substitutions for an A/Payable workflow than for a procurement workflow.
 
For individual developments, implementing this with functions (such as
RH_SUBSTITUTION_MAINTAIN as proposed by Swami) is very heavy. On top of it,
I see no way of restricting access in 4.6 to the substitute transaction....
 
Sorry to look so negative, as an Internal Controller I usually promote SAP
workflow, and this weakness now pops up....
 
Thanks for all responses, and best regards.
 
Felix
 
 
-----Original Message-----
From: Dart, Jocelyn [mailto:jocelyn.dart at sap.com]
Sent: Thursday, August 21, 2003 3:52 AM
To: SAP-WUG at MITVMA.MIT.EDU
Subject: Re: Authorizations to create substitutes
 
 
Hi Felix/Vineet,
Unfortunately, as a substitute executes the work item under the original
user's access to the work item, changing the possible agents won't help. And
option 3 results in a work item in error. Regards,
        Jocelyn Dart
Consultant (SRM, EBP, Workflow)
and co-author of the book
"Practical Workflow for SAP"
SAP Australia
email: jocelyn.dart at sap.com
phone: +61 412 390 267
fax:   +61 2 9935 4880
 
 
 
 
 
-----Original Message-----
From: Vineet.Mehta at mbusi.daimlerchrysler.com
[mailto:Vineet.Mehta at mbusi.daimlerchrysler.com]
Sent: Thursday,21 August 2003 11:45 AM
To: SAP-WUG at MITVMA.MIT.EDU
Subject: Re: Authorizations to create substitutes
 
 
I am not sure how you have it configured but here are few things you can
check:
 
1. If it is set up as a "general task" and open to everyone, then everyone
can execute it (including substitutes). 2. If that is true, then you may
want to use "wf role assignment..  job or position" to restrict them. (when
you do agent assignment for the Task) 3. Another possibility is to check
authorization for the transaction to approve the task.. (check with Security
folks if they can restrict).
 
These are just some pointers. I am not sure how your specific workflow is
setup but should give you some ideas.
 
Let me know if I can help.
Regards
Vineet
 
 
 
 
 
 
 
Felix.Hassine at pmintl.com
Sent by: Owner-SAP-WUG at MITVMA.MIT.EDU
20/08/2003 11:53 AM
Please respond to SAP-WUG
 
 
        To:     SAP-WUG at MITVMA.MIT.EDU
        cc:
        Subject:        Authorizations to create substitutes
 
Hi everyone,
 
We have a workflow related to approval of invoices with monetary limits
assigned to different agents. Unfortunately, some agents may conturn our
internal rules  by assigning their own substitutes (who may not have this
level of approval...). If a user can assign up to 10000 USD or invoices,
assigning user X to his substitute authorizes this user X to execute the
approval task (Based on a DECISION step...).
 
Is there any way to restrict users from maintaining their own substitutes?
 
I would like to avoid re-coding the DECISION step in order to verify the
monetary limit of the approver. Has anyone encountered such situation?
 
Thanks for any info.
 
Best regards,
 
Felix