SAP access control is software that checks who can do what inside SAP, and stops any single person from holding two duties that together would allow fraud. SAP is the enterprise resource planning (ERP) software on which many large companies run their finance, purchasing, stores and payroll. This kind of software is also called SAP GRC, because it brings governance, risk and compliance to that one system.
SAP controls access through roles. A role is a bundle of permissions, such as "create a purchase order" or "post a payment". A large company may have 5,000 SAP users and 2,000 roles. Over the years, people change jobs and collect more roles. Nobody can check by hand which person can now do which combination of tasks.
The most important rule is segregation of duties (SoD). It means that no single person should be able to complete a risky task from start to end alone. The classic case is suppliers. If one person can both create a new supplier and approve a payment to it, that person can create a fake supplier and pay it. So the two duties must belong to two different people.
Take, for example, an auto parts maker in Chennai. The software reads every user's roles in SAP and compares them with a list of about 200 risky pairs of duties. It finds that an accounts executive can create suppliers and can also run the weekly payment batch. She received the second role a year ago, while covering for a colleague on leave, and nobody removed it. The software reports this conflict to her manager, who removes the payment role. Sometimes a conflict cannot be removed, for instance in a small plant with only two accountants. Then the company records a mitigating control instead: a finance manager reviews the first payment to every new supplier.
The software does three more jobs. It checks each new access request before it is approved, so a new conflict is caught in advance. It handles emergency access: a powerful login that an engineer receives for a few hours to fix a problem, with every action recorded. And it runs a yearly review, in which each manager confirms the access of their team.
Auditors care about this. In India, the auditor of every public company, and of larger private companies, must report on the company's internal financial controls, and SoD in SAP is one of the first things they test. The findings go to the GRC platform.
SAP access control applies least privilege inside one system. Identity governance and administration (IGA) does a similar job across every system in the company, and many companies connect the two.