Country-Limited HR Access and a Stale Manager Assignment
Helios Chemicals has 2,200 employees in Germany and the UK. A German HR specialist supports 800 employees in two German legal employers. She currently has a seeded HR specialist role whose person security profile is set to 'All People', so she can see UK employees and their salary details. Separately, a UK operations manager can see 12 German employees because he was temporarily assigned as their line manager during an SAP cutover; the assignment manager field was never corrected. The works council is asking for evidence that access is limited by country and legal employer. The security team wants to create one new role for all HR specialists globally to simplify administration. You must advise on data roles, person security profiles, and the manager's access.
1. Design the German specialist's access using data roles and person security profiles. What criteria would you use and why?
Read the worked answer
I would separate the functional role from the data role. The functional role should grant the HR specialist transactions and pages. A data role should carry a person security profile restricted to the German legal employers or the specific departments she supports. Because she supports two legal employers, I would use a security criterion that includes both, rather than 'All People' or a single department, unless department is the true business boundary.
I would also check area of responsibility and any organization security profile that controls access to payroll or department records. Salary visibility often comes through a separate secure element or payroll data role, so restricting person access alone may not hide salary. In a sandbox, I would preview the data role as the specialist and confirm she can see the 800 German employees and cannot see UK employees. I would document the legal-employer criteria as evidence for the works council and set a review date.
2. How do you resolve the UK manager's access without breaking legitimate approvals?
Read the worked answer
Manager access usually derives from the manager hierarchy, so if the UK manager can see 12 German employees, the first thing to verify is whether he is still their assignment manager. If the temporary cutover role has ended, correct the assignment manager with the right effective date. That single data correction should remove his manager-based access after the effective date.
I would not remove his functional role to solve a data problem. I would also check whether any open approvals or absence requests are still routed to him. If he must approve during a short transition, use a delegation or an approval group rather than leaving a false manager relationship in place. Test in a sandbox: confirm he loses access to the German employees on the effective date, confirm the new manager can approve open items, and confirm the UK manager retains access to his actual UK reports. Document the change because it affects security and approval history.
3. Evaluate the proposal for one global HR specialist role with an 'All People' person security profile.
Read the worked answer
That proposal solves administration at the expense of data privacy. A single role with 'All People' would let every HR specialist see UK, German, and any future country employees, including salary and personal data. The works council concern would remain or worsen because there would be no country or legal-employer boundary. Role simplification should not be achieved by broadening data access.
A better design is one functional role with multiple data roles by country or legal employer. Role inheritance can reduce administration while keeping the person security profile narrow. I would also review whether the seeded role is appropriate or whether a custom role is needed. Before rollout, I would test with users in each country, check salary visibility separately, and establish a periodic access review. The decision should be based on least privilege and legal-employer boundaries, not on the number of role assignments.