Provisioning Common Application Functions
Provisioning scope
Common application functions provide identity, access, and shared configuration used by every procurement module. Provision users and roles, assign role provisioning, and scope data access to business units. Approval Management, notifications, lookups, descriptive flexfields, attachment categories, and profile options are common setup levers. Security must be tested with the actual job role, not a proxy with broad privileges.
Roles and data access
A role grants entitlements such as Manage Purchase Orders. A procurement agent can be restricted by procurement BU and document type. Separation of duties matters: the person who creates a supplier should not also approve it without a compensating control. Use role provisioning rules and audit.
Worked example
A buyer must create POs in the US Procurement BU but not approve them. Assign a purchasing role with the Create Purchase Order privilege, scope it to US Procurement, and exclude approval privileges. Test by signing in as a test user, opening the Create Order page, and confirming the BU list and approval button behavior. If the user sees all BUs, the role or data access set is too broad.
Traps
Do not test security as an administrator. Do not confuse a role with a privilege. Do not assume a lookup change is visible until cache or session refresh.