How to create a Routing Rule in SAP GRC for different approvers on Role Approval process (BRF+)

[Fernando_Costa]

Hey guys I have the following scenario here in my SAP GRC:

Using the Role Approval process , I want the final approval to be made by Internal Controls when it is a Business role (based on Business Sub Process value) or IT personnel when it is a IT role. I was trying to use BRF to be able to do that but I have some doubts like:

Which Rule should I create? Routing Rule or a Initiator Rule?

I was able to create the Decision Table but how can I trigger this type of validation to be executed and redirects the approval?

I mean, I created the lines as IF SubProc = IT then RESULT = IT_APPROVAL_PATH but I do not know exactly how to call it to determinate the correct path/stage.

Imagine something like the SOD Violation detour.... it´s the same thing , whether the role is IT defined on the Sub Process it should detour to IT approval else it can go to Internal Controls....

Can anyone give some advice or a guide to achieve that? 

[debashish-sarma]

Hi @Fernando_Costa,

To achieve this, you need to configure a routing rule by following these steps:

1. Define Custom Agent Rules:

• Create two custom agent rules to identify Internal Control Owners and IT Personnel.

• Ensure you have the logic and agent type identified. If not, please share more details so I can guide you on the agent rule configuration.

2. Configure the Routing Rule:

• Set the input as the business process and the result as the Routing Path to determine Internal Control Owners and IT Personnel.

• Map these results to the “Rule Result Value” in Stage 2 of MSMP for the routing rule.

3. Define Paths in MSMP (Stage 5 - Maintain Paths):

• Create two separate paths: one for Internal Control Owners and another for IT Personnel.

• Assign the respective custom agents to each MSMP path stage. Since we are routing from the 2nd last stage, we have to keep this stage at each of the routed paths to be consistent with the requirement.

• In Stage 6 of MSMP (Maintain Route Mapping), link these stages to the Routing Rule and Routing Paths.

4. Enable Routing in the Approval Process:

• In the second-to-last stage of role approval (before the final approval path), enable Routing and provide the rule ID of the newly created routing rule.

• This configuration is done at Stage 5 of MSMP.

Let me know if you need further clarification.

Best regards,

Debashish Sarma

SAP Access Control for SAP S/4HANA 

[Fernando_Costa]

Hi there Debashish first of all thank you very much for your time!

I had some questions to make.... regarding the topics you created I will make the questions:

Define agent rules: As far I understood, I have to create 2 agent rules, rule type BRF Plus Flat Rule?  Do I have to create any Rule kind of Route rule?
I´ve created these 2:
Agent rule for Internal Controls:

and Agent rule for IT:

After that I accessed the BRF+ tcode and edited the Application I´ve created (that I´ve called ZGRAC_MSMP_DETOUR_ROLE) I´ve edited the Decision Table with the following contents:

I´ve added both Agent rules I´ve created above in the SAP_GRAC_ROLE_APPR process (that is what I need) in the Stage 2 Maintain Rules:

You mentioned about the PATH´s but it must be created outside the MSMP Workflow Maintenance, we need to create it on the GRFNMW_CONFIGURE right? Can you share the steps? See if what I did makes sense to you:

(If this is not right please let me know how to make it)

Now the routing map (Stage 06) I´ve left this way:

When I try to activate I am getting this error:

Maintain route mapping for rule GRAC_ROLEAPPR_INITIATOR for process ID SAP_GRAC_ROLE_APPR

Based on what you are seeing, can u point where am I missing something?