What is authorization-iam?

Guidance for controlling who can access ABAP applications, data, and operations. IAM means Identity and Access Management, while ABAP is SAP's programming language and platform.

Use it to implement authorization checks, create roles and authorization objects, configure business catalogs, or define CDS data-access rules.

It helps choose the correct access-control approach for ABAP Cloud or on-premise SAP systems and avoid giving users too much access.

authorization-iam — Skill for Claude Code by likweitan/abap-skills

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add likweitan/abap-skills --skill authorization-iam

Clone the repo

git clone --depth 1 https://github.com/likweitan/abap-skills

Made for: Claude Code.

Or install sap-abap, the plugin that ships this one along with the rest of its 17 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/likweitan/abap-skills/authorization-iam/github.svg)](https://agentmods.dev/skills/likweitan/abap-skills/authorization-iam)

Your own site

<a href="https://agentmods.dev/skills/likweitan/abap-skills/authorization-iam"><img src="https://agentmods.dev/badge/skills/likweitan/abap-skills/authorization-iam/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/likweitan/abap-skills/authorization-iam"><img src="https://agentmods.dev/badge/skills/likweitan/abap-skills/authorization-iam.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 163 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,656 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00163	$0.02656
Opus 5.5	$0.00065	$0.01062
Sonnet 5.5	$0.00033	$0.00531
Haiku 4.5	$0.00016	$0.00266

Measured 1mo ago against content hash 055911352073, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

authorization-iam scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

authorization-iam — 100% identical, 120 lines differ

skills/authorization-iam/SKILL.md · 358 lines

How it starts

The opening of the file, as written. The whole thing — 358 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Authorization & IAM

Guide for implementing authorization checks and identity/access management in ABAP Cloud and on-premise systems.

Workflow

Determine the user's goal:
- Implementing authorization checks in ABAP code
- Creating CDS access controls (DCL)
- Setting up IAM apps, business catalogs, and business roles (ABAP Cloud)
- Managing PFCG roles (on-premise)
- Defining custom authorization objects
- Understanding restriction types
Identify the platform and clean core level:
- ABAP Cloud (SAP Cloud ERP or SAP BTP ABAP Environment) → IAM apps + business catalogs + CL_ABAP_AUTHORIZATION (Level A)
- Classic ABAP / SAP Cloud ERP Private → PFCG roles + AUTHORITY-CHECK (Level B)
- Wrapper scenarios → SU22 data and variants for non-released authorization objects
Guide implementation with the appropriate authorization model

Authorization Models

ABAP Cloud — Level A

IAM App → Business Catalog → Business Role → Business User
                                    ↑
                            Restriction Type (field-level restrictions)

Uses CL_ABAP_AUTHORIZATION (a released API). Available on SAP Cloud ERP and SAP BTP ABAP Environment.

Classic ABAP — Level B

Authorization Object → PFCG Role → User Assignment
       ↑
Authorization Fields + Permitted Values

Uses AUTHORITY-CHECK. Required on SAP Cloud ERP Private, where the IAM/COM Fiori apps are not available and the classic transactions must be used instead (PFCG, SM59, SOAMANAGER, SU21, SU22).

SAP Cloud ERP Private note: unlike SAP Cloud ERP (public), there is no strict content separation between SAP and customer regarding users, roles and communications.

Authorizations for wrappers

When a wrapper exposes a classic API to ABAP Cloud code, the wrapped API often checks non-released authorization objects, which cannot be used in ABAP Cloud directly. Handling:

PFCG roles can mix released and non-released authorization objects
Provide SU22 data for the wrapper when releasing it for cloud development, so the required non-released authorization objects are transparent
Create SU22 variants for each designated usage of the wrapper, for use in role maintenance

Read the full file on GitHub · 358 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/authorization-patterns.md 10 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · +25 lines 055911352073
1mo ago First seen · 333 lines · 163 tokens per session scan A c083835eb2d3

Subscribe to this mod's changes

authorization-iam is a skill published in the GitHub repository likweitan/abap-skills (72 stars, last pushed 11d ago), licensed MIT. It adds 163 tokens to every session and 2,656 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Security abap agent-skills joule sap

sap-expert

Expert in SAP ERP systems, ABAP programming, SAP HANA, S/4HANA, Fiori applications, and SAP integration patterns including OData, RFC, and IDoc. Use when the user mentions ERP, enterprise, business apps, ABAP, HANA, or S/4HANA, or when the task involves SAP Ecosystem, ABAP Development, Integration Technologies, or…

personamanagmentlayer/pcl · 92 tokens

sap-transport-gate

Use for SAP Transport Request pre-release gate review (QAS/PRD). Triggers on any TR number in input (pattern: uppercase letters + K + 6 digits, e.g., DEVK900123, ECDK943668). Asks user: code-quality-only or functional+code review. Performs 10-dimension risk review of ABAP/CDS/DDIC source, object list, dependencies…

shrek-abaper/sap-engineering-skill · 185 tokens

abap-code-review

Performs structured pre-release security and quality review of SAP ABAP programs across 9 dimensions (SEC, AUTH, DATA, PERF, STD, INTERFACE, CHANGE, COMP, FUNC), producing a formal sign-off-ready Markdown assessment report. Trigger when the user asks to review, audit, assess, or check ABAP code before release …

shrek-abaper/sap-engineering-skill · 162 tokens

sap-adt-cli

Read/write ABAP source and metadata via SAP ADT REST API: programs, classes, function modules/groups, interfaces, includes, CDS views, DDIC tables/structures, data elements/domains, type groups, transactions, packages, search, where-used, syntax check, Open SQL preview, and transport requests (list/create/release).…

shrek-abaper/sap-engineering-skill · 116 tokens

sap-integration-wiki

Guide for integrating external systems (Java, Python, .NET, Node.js, low-code) with SAP (ECC 6.0, S/4HANA On-Premise/Cloud): OData V2/V4, RFC/JCo, SOAP-over-HTTP RFC without JCo, IDoc/PI-PO, BAPI, RAP, BTP Integration Suite/iFlow, Event Mesh, Cloud Connector, Communication Arrangements, FI-AA, AR/AP, Central Finance…

shrek-abaper/sap-engineering-skill · 276 tokens

sap-sac-planning

SAP Analytics Cloud (SAC) planning guidance for planning models, planning-enabled stories, data actions, multi actions, version management, data locking, calendar/input workflows, allocations, value driver trees, BPC live planning, and Seamless Planning with SAP Datasphere. Use this for planning design, planning APIs…

secondsky/sap-skills · 110 tokens