Which roles configure the SAP integration, schedule, confirm and force transport imports, and read the SolMan archive — and the separation-of-duties rules enforced in code.

SAP rights follow TENSOR's role catalog. Configuring the integration uses the general integration permissions. Transport import steps have their own permission keys, so that scheduling and confirming an import never sit on one operational role.

Roles

Role	What the role can do
`platform_owner`	Everything, including scheduling, confirming and force-importing transports.
`tenant_admin`	Configure connections, agents, landscapes, initial setup, auto-sync, migration mode, EWA reports and SolMan imports; read and export the SolMan archive.
`change_manager`	Schedule and cancel imports, view the import queue, force an import despite a collision.
`infrastructure_admin` (Basis administrator)	View the import queue and confirm that an import was executed in SAP STMS.
Change approvers / CAB	Approve transport Changes through the normal Change approval.
`auditor`, `compliance_officer`	Read SAP settings pages; read and export the SolMan archive.
`external_auditor`	Read the SolMan archive.
`service_desk_agent`, `incident_manager`, `cmdb_admin`	Read SAP settings pages (connections, health, HANA, landscapes).

A dedicated sap_basis_admin role is Planned — not yet available. Until then, infrastructure_admin acts as the Basis administrator.

Permission keys

Permission	Allows
`integration.config.read`	View all SAP settings pages, transports, drift, collisions, authorisations, HANA, Cloud ALM, EWA and agents.
`integration.config.manage`	Create, edit and remove connections; store secrets; test connections; create and disable agents; set collectors; landscapes; initial setup; auto-sync; migration mode; EWA upload; SolMan dry-run and import.
`sap.transport.import`	View the import schedule of a transport Change.
`sap.transport.schedule`	Schedule and cancel a transport import.
`sap.transport.confirm_import`	Confirm that a scheduled import was executed in SAP STMS.
`change.sap_transport.force_import`	Override a detected object collision with a mandatory annotation.
`sap.archive.read`	Browse the SolMan archive and its import batches.
`sap.archive.export`	Export per-batch archive evidence with signed manifest.

Generating the Berechtigungskonzept, which includes the SAP SoD catalog, needs reporting.berechtigungskonzept.export and the flag bait_berechtigungskonzept_export.

Separation of duties enforced in code

Rule	How it is enforced
Developer is not approver	The person who created the transport Change may not approve it. Checked when a transport is created or its position is updated.
Developer is not importer	The Change creator may not confirm the import. A violation returns FORBIDDEN at the import confirmation and is audited.
Scheduling and confirming are split	`sap.transport.schedule` (change manager) and `sap.transport.confirm_import` (Basis administrator) are never granted to one operational role; only the platform owner holds both.
Approval stages are separate	Not yet enforced. The DEV-to-QA approver should not approve QA-to-PROD. The rule is in the catalog, but enforcing it needs per-stage approver tracking.
Force import is a separate right	Only holders of `change.sap_transport.force_import` can override a collision, always with an annotation and an audit row.
Machine ingest is not a person	Agent data never counts as an approver or importer, so it cannot satisfy or bypass an SoD rule.

Transport SoD is therefore partially available: developer-is-not-approver and developer-is-not-importer are enforced; approval-stage separation is not. For the platform-wide rule list, see segregation of duties.

Who counts as the developer

The SAP developer's own SAP user is not stored in TENSOR, so the creator of the linked Change serves as the developer identity. If the developer and the Change creator are different people, the check is conservative and enforces on the Change creator.

For auto-created Changes, the creator is the mapped TENSOR user of the transport owner or, where no mapping exists, an explicitly audited system actor.

What a refusal looks like

Approval refused. If you created the transport Change, TENSOR refuses your approval. Another approver must approve it.
Confirmation refused. If you created the Change, Confirm import fails with a separation-of-duties error, and the refusal is written to the audit trail.
Position update refused. If the SoD guard refuses a position update, TENSOR records a drift event of kind Position update refused by the separation-of-duties rule instead of dropping the fact.

How the duties divide in practice

Step	Who acts	Permission
Approve the transport Change	Change approvers / CAB (not the Change creator)	Normal Change approval
Schedule, reschedule or cancel an import	Change manager	`sap.transport.schedule`
Execute the import	Basis team, in SAP STMS	— (outside TENSOR)
Confirm the executed import	Basis administrator (not the Change creator)	`sap.transport.confirm_import`
Override a collision	Holder of the force-import right, with annotation	`change.sap_transport.force_import`
Configure connections, agents, landscapes, migration	Tenant administrator	`integration.config.manage`
Review, audit, export evidence	Auditor, compliance officer	`integration.config.read`, `sap.archive.read`, `sap.archive.export`

How administrators grant access

A tenant administrator assigns roles under Settings → Roles or on the user record under Users. Custom roles can include the SAP permission keys. Adding compliance-tagged permissions to a custom role needs dual approval.

When you design custom roles, keep sap.transport.schedule and sap.transport.confirm_import on different roles. Only the platform owner is meant to hold both.

SAP roles and permissions