Check on Visibility in the Organization Model 
Check on Visibility in the Organization Model
The check for the authorization object CRM_ORD_LP enables the system to control the access to documents depending on the assignment of the employee to specific organizational units via his position.
The following possibilities are offered:
The relevant sales organization is determined in the sales scenario, depending on the position which the user is assigned to in the organization model. The user can also be assigned to several sales organizations. The system then checks whether the document which the user wants to process was entered for this sales organization or for one of the lower-level organizational units assigned to the sales organization. If this is the case, and the user has the authorization for his selected activity, then he can process the document.
The relevant service organization is created in the service scenario, depending on the position which the user is assigned to in the organization model. Several service organizations can also be assigned. The system then checks whether the document which the user wants to process was created for this service organization. If this is the case, and the user has the authorization for his selected activity, then he can process the document.
The relevant sales office is determined in the sales scenario, depending on the position which the user is assigned to in the organization model. Several sales offices can also be assigned. Finally, the system checks whether the document which the user wants to process was created for this sales office or for one of the lower-level organizational units assigned to the sales office. If this is the case, and the user has the authorization for his selected activity, then he can process the document.
The relevant sales group is determined in the sales scenario, depending on the position which the user is assigned to in the organization model. Several sales groups can also be assigned. Finally, the system checks whether the document which the user wants to process was created for this sales group or for one of the lower-level organizational units assigned to the sales group. If this is the case, and the user has the authorization for his selected activity, then he can process the document.
The relevant distribution channel is determined in the sales scenario, depending on the position which the user is assigned to in the organization model. Several distribution channels can also be assigned. Finally, the system checks whether the document which the user wants to process was entered for this distribution channel or for an organizational unit to which this distribution channel is assigned, or for one of the lower-level organizational units assigned to the organizational unit. If this is the case, and the user has the authorization for his selected activity, then he can process the document.
One node is read to the top in the organization model in the hierarchy, depending on the position which the user is assigned to in the organization model. After this, the lower-level organizational units and business attributes subordinate to this node (sales organization, sales office, sales group, distribution channel, service organization) are determined. The system then checks whether the document was entered for one of the attributed organizational units. If this is the case, and the user has the authorization for his selected activity, then he can process the document.
This also applies for two to ten higher-level nodes, that is, two, three...to ten nodes are read to the top in the organization model, depending on the position assigned to the user.
This check has the advantage that you do not have to enter the organizational units, which the user should have the authorization for, explicitly for each user in the user profile. Furthermore, when the user is reassigned in the organization model, the new assignments have immediate effect on the authorization check, as the check is always carried out dynamically during the run time, and the relevant organizational units are not fixed in the authorization profile.