How To Fix ACM_SYNTAX195 - Rule won't apply to &1 because of functional grant in access control &2

SAP Error Message - Details

• Message type: E = Error

• Message class: ACM_SYNTAX - ACM: DCL Syntax Error Messages

• Message number: 195

• Message text: Rule won't apply to &1 because of functional grant in access control &2

What causes this issue?

You created an Access Control document to grant select privileges on an
entity. This entity is already protected by another Access Control
document with a functional grant. A functional grant provides select
privileges without any instance filtering to the user and has the
following syntax "GRANT SELECT ON <entity>;"

System Response

The syntax check of the Access Control document returns a warning
telling you that the Access Control document is not applied to the CDS
entity. The result set of the CDS entity is not restricted by the
current Access Control document.

How to fix this error?

To get rid of the warning remove your Access Control document for this
entity. It still might make sense to create an Access Control document
for the given entity if you are in a transport scenario. In this case
the warning is of informational purpose to not getting confused why your
Access Control document is not applied at runtime in the current system.

Procedure for System Administrators

You can ignore the warning because it has no impact at runtime. It is
for informational purposes of the Access Control developer. If you want
to get rid of this warning, contact the developer of the Access Control
document.

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message ACM_SYNTAX195 - Rule won't apply to &1 because of functional grant in access control &2 ?

  The SAP error message ACM_SYNTAX195 indicates that a specific rule cannot be applied to a user or role due to a functional grant in the access control settings. This typically occurs in the context of SAP Access Control, where rules are defined to manage user access and ensure compliance with security policies.
  Cause:
  The error arises when:
  
  A user or role is assigned a functional grant that conflicts with the rule you are trying to apply.
  The functional grant may provide access that is not compatible with the rule's conditions or restrictions.
  The rule is designed to restrict access, but the functional grant allows it, leading to a conflict.
  
  Solution:
  To resolve this error, you can take the following steps:
  
  
  Review the Functional Grant:
  
  Check the functional grant assigned to the user or role in question. Identify the permissions and access rights it provides.
  
  
  
  Analyze the Rule:
  
  Examine the rule that is being applied. Understand its conditions and the access it is intended to restrict.
  
  
  
  Modify the Functional Grant:
  
  If the functional grant is too permissive, consider modifying it to align with the intended restrictions of the rule.
  Remove or adjust the conflicting permissions that are causing the rule to be ineffective.
  
  
  
  Adjust the Rule:
  
  If the functional grant is necessary and cannot be changed, you may need to adjust the rule to accommodate the existing functional grant.
  This could involve redefining the conditions of the rule or creating a new rule that works in conjunction with the functional grant.
  
  
  
  Testing:
  
  After making changes, test the access control settings to ensure that the rule is now being applied correctly and that there are no further conflicts.
  
  
  
  Documentation:
  
  Document any changes made to the functional grants or rules for future reference and compliance audits.
  
  
  
  Related Information:
  
  Access Control Configuration: Familiarize yourself with the configuration settings in SAP Access Control, including how functional grants and rules interact.
  SAP Notes: Check SAP Notes for any known issues or updates related to ACM_SYNTAX195. SAP frequently releases notes that provide additional context or solutions for specific error messages.
  User Roles and Authorizations: Understand the broader context of user roles and authorizations in SAP, as this will help in troubleshooting similar issues in the future.
  
  By following these steps, you should be able to resolve the ACM_SYNTAX195 error and ensure that your access control rules are functioning as intended.