Work Management Standards › Implementation of Security › Generic Implementation of Security › Checking Authorization

Checking Authorization

Avoid explicit references to particular profile names in code, because it is then not possible to add new users without a code change.

For example, the following would be bad practice:

Instead, you should introduce an ‘authority holding’ object, such a data area, to which you may grant rights to one or many users at any time without modifying the code. You may then test the user’s authorization to the object: