How do managed and unmanaged RAP services differ for security governance?

Why This Matters for Security Teams

Managed and unmanaged RAP services are not just different development styles. They change where security responsibility sits, how much can be assumed from the framework, and how much must be enforced by the application team. In managed RAP, the framework provides more built-in transactional and validation behavior, which can reduce accidental inconsistency. In unmanaged RAP, those guardrails move into custom ABAP, which increases the chance that authorization, data integrity, and input handling drift over time.

That distinction matters because security governance is only as strong as the place where control is actually implemented. If reviewers assume the framework is enforcing a rule that was only coded in a service class, gaps can survive design review and reach production. For teams aligning to NIST Cybersecurity Framework 2.0, the practical issue is governance visibility: knowing which controls are inherited, which are custom, and which require evidence. NHIMG’s Top 10 NHI Issues and Ultimate Guide to NHIs — Key Challenges and Risks both reflect the same pattern: the most damaging failures usually come from assumptions about control coverage, not from the absence of controls altogether. In practice, many security teams discover those gaps only after a custom service has already been extended, copied, or reused in a higher-risk process.

How It Works in Practice

Managed RAP tends to be easier to govern because the framework enforces more of the standard service lifecycle. That gives security and audit teams clearer review points for create, update, and delete operations, plus a more predictable place to validate business rules. Unmanaged RAP shifts those responsibilities into custom ABAP implementation, which means the security model depends more heavily on the developer’s design choices, code quality, and test coverage.

For governance, the practical question is not which model is “safer” in the abstract. It is which model makes control ownership explicit. In managed RAP, teams usually focus on configuration, authorization checks, and any exceptions to framework behavior. In unmanaged RAP, teams need stronger design review for items such as:

• authorization logic embedded in custom behavior handlers
• transactional consistency across multiple custom save steps
• input validation and error handling outside framework defaults
• logging and traceability for sensitive business actions
• segregation of duties when one service can both validate and commit changes

This is where the NHI Lifecycle Management Guide is useful as a governance analogy: controls only work when identity, permissioning, and retirement are managed as part of the lifecycle, not treated as one-time setup. The same principle applies to RAP services. If the environment has strong standardization and low customization, managed RAP often fits better. If business logic is highly specialised, unmanaged RAP may be necessary, but it should be accompanied by compensating controls, code review, and regression testing aligned to the service’s risk. These controls tend to break down when unmanaged services are copied into new processes without re-review because inherited code is often mistaken for inherited assurance.

Common Variations and Edge Cases

Tighter framework control often increases implementation constraints, requiring organisations to balance consistency against flexibility. That tradeoff is real in RAP governance because not every process fits neatly into managed behavior, especially when complex orchestration, custom validations, or legacy integration are involved.

Current guidance suggests treating unmanaged RAP as higher-governance by default, not automatically higher-risk in every case. A well-reviewed unmanaged service can be acceptable, but only if security ownership is explicit and evidence is retained for the custom logic. By contrast, managed RAP can still become risky if teams overtrust the framework and skip service-specific reviews. The key distinction is where the security boundary actually lives.

For audit and operating model decisions, the most important edge cases are services with mixed patterns, shared utility classes, or reused authorization logic across multiple apps. Those situations often blur the line between framework protection and custom responsibility. NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives reinforces the broader lesson: auditors care less about the label and more about whether control ownership, evidence, and exception handling are documented. In practice, unmanaged RAP becomes hardest to govern when multiple developers extend the same service over time because the original security assumptions are rarely preserved with the code.

Related resources from NHI Mgmt Group

• Who is accountable when managed services handle security operations?
• When does managed security services help identity teams most?
• Managed Services For Identity Security
• What is the difference between role-based access and API key governance for NHI security?