SAP access control and the governance gap in enterprise IAM

At a glance

What this is: This is a Pathlock analysis of SAP Access Control that finds the core risk is not lack of controls, but governance drift between access decisions and the permissions they actually govern.

Why it matters: It matters because IAM, IGA, and PAM teams need access reviews, role design, and emergency access workflows to reflect real entitlement scope across connected systems, not just the directory or application layer.

Context

SAP Access Control is a governance layer for SAP and connected enterprise applications. It aims to analyse access risk, route approvals, certify entitlements, and handle emergency access, but those functions only work when the entitlement model matches the business process actually being controlled.

The operational problem is not the absence of policy language. It is the gap between roles, approvals, and periodic reviews on one side, and the real permissions, transaction paths, and cross-system access on the other side.

That gap is especially visible in hybrid environments where SAP, non-SAP, cloud applications, and identity systems all contribute to the effective access path. In that context, lifecycle governance is less about storing permissions and more about keeping governance aligned with how access is provisioned, inherited, and revoked.

Key questions

Q: What breaks when SAP access reviews are not tied to business roles?

A: Access reviews become checkbox exercises when roles are not defined in business terms. Reviewers can certify a title or system role without understanding the real duties it unlocks, which leaves redundant or conflicting access in place and weakens segregation of duties control.

Q: Why do cross-system SAP access workflows create governance risk even when approvals are documented?

A: Because an approval record can be correct while the downstream entitlement becomes broader than the request that was reviewed. In hybrid estates, connectors, inheritance, and non-SAP mappings can expand the real access path after the workflow closes. That is why governance must follow the effective privilege chain, not just the request ticket.

Q: How can security teams tell whether access risk analysis is missing critical entitlements?

A: Look for rule sets that depend on incomplete connector coverage, stale role design, or simplified application mappings. If the analysis consistently reports clean results while business users still reach sensitive transactions, the model is too shallow. Effective analysis should surface permission-level conflicts, not only top-level role conflicts.

Q: What should organisations do when emergency access is used in production systems?

A: Treat every privileged session as an auditable exception and require logs that reconcile the approved purpose with the actual transactions performed. Temporary access is only defensible when the review trail is complete enough to prove scope, timing, and accountability. Without that evidence, emergency access becomes a governance gap.

Technical breakdown

Access risk analysis depends on accurate entitlement modelling

Access risk analysis works by comparing user, role, and permission combinations against rule sets that identify segregation of duties conflicts and critical access. In SAP Access Control, that can happen in real time, on demand, or in batch mode, and the platform can simulate the effect of a new role before assignment. The mechanism is only as strong as the rule library and the fidelity of the connected entitlement data. If the application inventory, role mapping, or connector coverage is incomplete, the analysis can look precise while missing the permissions that matter most.

Practical implication: teams should treat risk analysis quality as a data and connector problem, not just a rules problem.

Access request workflows only govern what they can actually see

Request management routes access through approval paths and embeds risk checks before provisioning, which is meant to stop conflicting access from being granted in the first place. That works when the request flow captures the real target system, the real role, and the real conflict logic. In cross-system estates, the governance gap appears when a central workflow approves an entitlement that is later expanded by downstream application permissions, connector translation, or role inheritance. The workflow then certifies a request, but not necessarily the full effective access.

Practical implication: map the full permission path behind each request, including inherited and downstream entitlements.

Access certification fails when review scope is detached from effective privilege

User access review is designed to periodically confirm that access is still needed and remove redundant entitlement. The control depends on reviewers seeing the permissions that matter, not just a simplified role label or stale application extract. In practice, certification weakens when roles have drifted away from business meaning, when inherited permissions are hidden, or when cross-platform access is not represented in the review. The result is a review cycle that looks compliant but cannot reliably remove unnecessary access.

Practical implication: certify effective privilege, not just named roles or directory groups.

Threat narrative

Attacker objective: The objective is to obtain broader business-system access than policy intended, creating opportunity for fraud, data exposure, or control bypass.

1. Entry occurs through access provisioning or role assignment that grants more permission than the business case actually requires. When the access model is incomplete, the excess entitlement becomes part of the normal trusted path.
2. Escalation follows when the user or account accumulates broader effective access through role composition, inherited permissions, or connected application mapping. The control plane records approval, but the subject now holds a larger privilege set than intended.
3. Impact is unauthorized or excessive access to sensitive business data and processes, with increased segregation-of-duties risk, fraud exposure, and compliance failure. The governance system then struggles to prove what was actually reviewed versus what was actually reachable.

Breaches seen in the wild

• SAP Kubernetes secrets exposure 2023: Kubernetes secrets committed to GitHub exposed 203 valid registry credentials, including SAP artifact repository access. SAP closed it after Aqua's report.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Governance drift is the real failure mode here: SAP Access Control is only effective when roles, approvals, and certification remain aligned with the effective permissions being granted in connected systems. Once business role names stop matching actual privilege, the control plane becomes a reporting layer rather than a governance layer. The practitioner lesson is that access governance must be measured against effective entitlement scope, not against the shape of the approval workflow.

Cross-system access makes entitlement truth fragmentary: The article reflects a familiar enterprise pattern where SAP, non-SAP, cloud, and identity systems all contribute to one access decision. That means a clean request record can still hide privilege inherited later through connectors, mappings, or downstream application logic. The practitioner implication is that central governance must account for the full access chain, not just the originating request.

Periodic certification is not enough if the review surface is incomplete: User access review can only remove what it can actually see and interpret. When reviewers certify roles instead of effective permissions, redundant access persists under a compliant-looking process. The practitioner conclusion is that certification quality depends on entitlement fidelity, not on the review cadence alone.

Firefighter access is a governed exception only when session evidence is complete: Emergency access controls can reduce risk, but temporary privilege still creates a high-trust window that must be logged, reviewed, and bounded by purpose. If the logs do not map cleanly to the privileged actions taken, the exception becomes harder to justify than the emergency it was meant to resolve. The practitioner conclusion is that elevated access needs auditability at the transaction level, not just an approval trail.

Permission-level governance is the named concept that matters most: Business-role governance alone is not enough when the effective risk sits below the role, at the permission layer. That is the practical boundary this article exposes: access governance must be able to reason about what a user can do, not just what role they were assigned. The practitioner conclusion is to align governance controls with permission-level reality.

What this signals

Permission-level governance is where the next control gap sits: enterprise access programmes often know the role a user requested, but not the full permissions the user can exercise after inheritance and connector translation. That is the gap that turns certification into a paper exercise and makes lifecycle governance feel complete when it is not.

Access governance for SAP and adjacent systems needs to follow effective entitlement scope across the whole access chain. When approvals, roles, and downstream permissions diverge, the programme is still operating, but it is no longer governing the real risk surface.

For practitioners

• Audit effective entitlement scope Compare approved roles to the actual permissions inherited through SAP, non-SAP, and connector-based access paths. Flag cases where the business role no longer explains the reachable privilege set.
• Rebuild certification around real privilege Make review campaigns show effective permissions, downstream inheritance, and cross-system access rather than only role names or directory groups. Reviewers need the access that can be exercised, not just the label attached to it.
• Simulate access before provisioning Use pre-provisioning checks to test segregation-of-duties conflicts and critical access combinations before approval is final. Treat simulation as a gate, not a report after the fact.
• Log and reconcile emergency access at transaction level Require emergency access sessions to produce transaction-level evidence that can be matched to the approval and the emergency purpose. If the logs cannot be reconciled, the temporary privilege path is not sufficiently governed.
• Inventory connectors that change privilege scope Identify integrations that can expand, translate, or expose access beyond the originating SAP role model. These connectors should be part of the access governance scope, not treated as neutral plumbing.

Key takeaways

• SAP access control fails most visibly when business roles stop matching the permissions users can actually exercise across connected systems.
• The central risk is governance drift, where approvals and certifications look complete while effective privilege keeps expanding underneath them.
• The control that matters most is entitlement fidelity, because access reviews and emergency access only work when they reflect real permission scope.

Key terms

• Access Risk Analysis: Access Risk Analysis is the process of evaluating entitlements against rules that define conflicting or excessive access. In SAP governance, it helps identify segregation of duties issues, critical permissions, and risky combinations before or after access is granted.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Emergency Access: Emergency access is elevated access granted for urgent operational or recovery needs, often under tighter monitoring and time limits. In ERP systems, it must be attributed, approved, and reviewed because it can bypass normal role boundaries and create hidden privilege concentration.
• Effective Privilege: Effective privilege is the real access an entity can exercise after inheritance, delegation, token scope, and connected-system trust are applied. It is often broader than the permissions shown in an identity repository, which is why runtime validation matters.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.