Authorizations 

Composite Application Framework (CAF) defines instance- and class-based authorizations at design time. A description of standard roles delivered with and used in all configuration aspects of CAF are listed in the table below:

Standard roles in CAF

Role	Description
SAP_CAF_ADMIN	Required if you use the CAF administrative UI tools. It is required to work with the Composite Application Framework Authorization Tool.
SAP_CAF_DEVELOPER	Required if you work with the Service Browser.

You use the User Management Engine (UME) to create and configure the users of CAF.

The CAF also provides the Composite Application Framework Authorization Tool for configuring the Access Control Lists (ACLs) to manage and restrict the access to business object in a composite application. To access it, go to the following URL:http://<host>:<port>/nwa and navigate to Configuration Management → Composite Application Framework Authorization Tool.

CAF uses the UME ACL functionality for authorization management.

More information: Composite Application Service Security.