Fusion access is determined by three layers: the job role defines function, the duty roles beneath it define specific privileges, and data security policies determine which records the user sees. A user who can open a page but sees no data almost always has the function through their job role but no matching data security assignment, typically a missing business unit or organisation.
What problem does this solve?
The most common report is a user who can reach a page but sees nothing. Function access and data access are separate; granting the job role does not grant the data.
The opposite problem — users seeing more than they should — usually comes from role inheritance. A job role carries duty roles whose combined privileges exceed what anyone intended.
Segregation of duties conflicts accumulate as roles are added over time. Nobody removes the old role when responsibilities change, so privilege only ever grows.
How the solution works
We diagnose function and data access separately, because they fail differently and the fix is different. Confirming which layer is missing takes minutes and prevents unnecessary role grants.
Custom roles are built by copying and restricting a seeded role rather than by adding privileges to a user, so access remains explainable during an audit.
- 1Establish whether the user cannot reach the function or reaches it and sees no data.
- 2List the user's job roles and the duty roles those inherit.
- 3Confirm the data security policy grants the required business unit, organisation or ledger.
- 4Diff against someone with correct access; the difference is usually a single assignment.
- 5Add only the missing element rather than a broader role that would resolve it incidentally.
- 6Check the resulting combination does not create a segregation-of-duties conflict.
Limitations & prerequisites
- Seeded roles are deliberately broad and rarely satisfy an auditor unedited; custom restricted roles are usually necessary.
- Role changes take effect after the security synchronisation process runs, so an apparently ineffective change may simply not have propagated yet.
- Quarterly updates can introduce new privileges into seeded duty roles, which means inherited access can change without any local action.
- Data security based on organisation hierarchies changes when the hierarchy changes, so HR structure changes can silently alter access.
- Segregation-of-duties analysis needs a defined ruleset; without one, conflicts are a matter of opinion rather than a finding.
FAQ
They have function access through their job role but no data security policy granting that business unit. Function and data access are separate layers, and granting a job role alone frequently produces exactly this symptom.
A job role represents a position and is what you assign to a user. Duty roles sit beneath it and carry the actual privileges. You assign job roles; you inspect duty roles when diagnosing why access is broader or narrower than expected.
No — copy them and restrict the copy. Modifying seeded roles creates problems at every quarterly update, when Oracle may change the seeded definition underneath your edits.
Quarterly updates can add privileges to seeded duty roles, so inherited access changes without anyone locally doing anything. Re-testing role assignments after each update should be part of the regression pack.
With custom roles built by restriction, a documented mapping from role to business justification, and evidence of periodic access review with removals. Seeded roles assigned broadly are difficult to defend regardless of intent.
Security changes require the synchronisation process to run before they take effect. Check that first; it accounts for a large share of reported role problems.
Tell us the module, the release and the exact symptom.
Send the module in scope, your Fusion release or EBS version, and the exact error text or symptom with a screenshot where you have one. We reply with a written assessment: the likely cause, what we would check first, and whether it is a configuration fix, a data fix, or a defect that needs an Oracle service request. When Swedish Technology can help, we scope the remediation with effort and sequence before you commit to anything.
Request an Oracle AssessmentSources & evidence
- Oracle Help Center — Cloud Applications documentation — module setup, subledger accounting and period-close reference
- Oracle Help Center — all product documentation — database, middleware and infrastructure reference used for error diagnosis
- My Oracle Support — patches, known-issue notes and service requests; Oracle account required
Vendor and product names are trademarks of their respective owners; references are for technical context and do not imply partnership, certification or endorsement unless stated on the vendor's official pages.