App Authorization Variants
The concept name was not provided, so a precise definition cannot be reliably grounded in the available sources. Based on the sources, which focus on authentication, authorization, and the Application Security Descriptor File (xs-security.json), the closest identifiable concept is the Application Security Descriptor (xs-security.json): a configuration file that developers use to define authorization information — such as scopes, role templates, and attributes — for an application on SAP BTP. It is consumed by the SAP Authorization and Trust Management Service to enforce authentication and authorization at runtime.
Tutorials that teach this
Docs explaining this concept
- Doc Authorization with SAP Cloud Identity Services
- Doc New Architectures & Contributors (Q3-2025)
- Doc SAP Document AI
- Doc SAP IAM integration with SAP Cloud Identity Services
- Doc Adding Authentication and Authorization
- Doc Attributes
- Doc Business Roles, Business Catalogs, App Authorization Variants, Restrictions
- Doc Configuration Options for the SAP Authorization and Trust Management Service
Code samples embodying this
Prerequisites
- Concept IAM App, Business Catalog, and Business Role The concept name provided is "undefined," which does not correspond to a recognizable SAP developer concept. The supplied sources cover unrelated topics — privileged mode access for business services, booking supplement queries, and SAPUI5 adaptation projects — and do not contain enough shared or focused information to produce a grounded, accurate definition for an unnamed concept. Please provide a valid concept name and relevant supporting sources so a precise definition can be written.
- Concept PFCG Aspect in CDS Access Control A **read protection** is an authorization mechanism used in SAP BTP, ABAP Environment to prevent unauthorized access to data exposed by a service. Developers implement it to ensure that only users with the appropriate authorizations can read sensitive business data through an application or API. As described in the [SAP BTP documentation](https://help.sap.com/docs/btp/sap-business-technology-platform/2a5524a8e57c4888a7ebec4898272484?locale=en-US&state=PRODUCTION&version=Cloud), this is part of building a broader authorization model that controls what data a user is permitted to retrieve.