RBP Advisor brings version control to SAP SuccessFactors Role-Based Permissions. It captures your permission model on a schedule or on demand, tracks every change between captures, and flags Segregation of Duties risks.
Role-based permissions are where the sensitive decisions live, who sees compensation, who reaches personal data, who can act on another population. A mid-size instance runs to roughly ninety roles, two hundred grant rules, a hundred and ninety groups, and well over a hundred thousand individual permissions.
And it moves. A group is widened during a rollout. A role picks up a permission for a go-live and nobody takes it away. A grant rule is edited to unblock a ticket. Each change is reasonable on its own; together, across a year, they drift.
Then an auditor asks what the permission model looked like at a date in the past, what has changed since, and who approved it. That question has no native answer, which is why it is usually answered with screenshots, spreadsheets and someone's memory.
Take a snapshot on demand, or let the scheduler capture automatically. Every capture records who ran it and counts roles, rules, groups, permissions and active users.
Select any two snapshots. Every difference across roles, grant rules, permission groups and permissions becomes a drift event, classified unplanned until someone says otherwise.
Record a business justification, the approver and an evidence file. Your governance policy decides which of those are mandatory — and the server enforces it.
Generate a PDF compliance report, versioned and append-only, plus an Excel workbook with the full permission matrix for audit fieldwork.
Comparison is field-level. A widened grant rule does not hide in a generic edit log. The drift event identifies the exact rule and the access and target groups it connects, so you can see precisely where access expanded.
Report versions are append-only. Each PDF is the frozen state of the drift events at the moment it was generated. A later correction adds v5, it does not rewrite v4.
That constraint is the whole point. Evidence a reviewer can see you were able to alter is not evidence, it is an assertion. An append-only record is the difference between a control your auditor tests and one your auditor takes your word for.
Define the permission pairs that must never sit together, with a severity for each. RBP Advisor counts the conflicts on every snapshot, so the number appears beside each capture and the trend is visible across the year.
Conflicts are reported by severity, by role and by affected group, the form an auditor asks for, not a raw list you still have to interpret.
A conflict count that climbs quarter on quarter is a finding waiting to happen. Seeing it on the snapshot list is how you catch it while it is still cheap to fix.
The PDF is the attestation. The Excel workbook is the fieldwork, the complete permission matrix by role, the Segregation of Duties findings, and the detail behind every figure in the report.
Report figures always reconcile to the underlying record. When a reviewer samples a row and traces it back, it matches.
No more exporting six screens and stitching them together the week before fieldwork starts.
Decide what an administrator must supply before a change can be acknowledged, a justification, the admin who made it, an evidence attachment. The policy is enforced server-side, not suggested in the interface, and it can differ per client.
Opens from a custom navigation entry in the SAP SuccessFactors Admin Center. Sign-in is automatic through SAP Identity Authentication. Administrators keep the identity they already have, and your identity team provisions nothing new.
Signs out after 30 minutes of inactivity, matching SAP SuccessFactors. The tool does not become the weakest link in a policy you have already set.
Separate instances, snapshots and governance policies per client, built for implementation partners who need to evidence what changed between two phases of a rollout, across several customers.
A tool that reads your entire permission model is going to be asked hard questions by your security team. Those questions are easier to answer in writing, up front, than in a meeting three weeks into an evaluation.
Hosted on SAP Business Technology Platform, inside the SAP ecosystem your organisation has already assessed, not on infrastructure your team has never heard of.
Single sign-on through SAP Identity Authentication. No separate credential store, no new passwords to rotate, and access is revoked when you revoke it centrally.
RBP Advisor reads your permission configuration to record it. It does not write back to SAP SuccessFactors, so it cannot alter the model it is there to evidence.
The full picture, architecture, data handling, authentication, tenant isolation and retention, written for the person who has to sign off on it. Send it to your security team before the first call, not after.
Read the Security Overview (PDF)Opens in a new tab. Questions it does not answer? Email sales@trimundo.net.
Who own the permission model and get asked to explain it, usually at short notice.
Who need evidence that a control operated across a period, not a screenshot of today.
Who need to show a client exactly what changed between two phases of a rollout.
Licensed through SAP Store, so it goes through a procurement route your organisation has already approved. All plans include unlimited reports and exports.
plus $1,500 setup · 1 year minimum
plus $2,500 setup · 1 year minimum
scoped to your landscape
Prices in USD. A 45-day free trial on a non-production instance is available before any commitment — see the trial terms. SAP Store is the definitive source for current pricing and contract terms.
RBP Advisor is listed on SAP Store, so you can review the full specification, security and compliance details and contract terms in one place, and buy through a channel your procurement team already recognises.
TriMundo LLC is an SAP Partner in the SAP PartnerEdge program. RBP Advisor is built on SAP Business Technology Platform and is available on SAP Store.
A trial on a non-production instance, with your real permission structure. Sample data tells you very little about a governance tool, the value only shows when you compare two captures of your own configuration.
The trial runs for 45 days on a non-production instance, so there is ample time to complete the setup, test connectivity, take captures, and run reports before making a decision.
We are flexible. Regardless of the setup time, you get at least 30 days from your first snapshot. Provisioning delays do not eat your evaluation.
Point it at a test or preview instance. Your security team gets to watch it work before it goes anywhere near live data.
Trial terms are set out in full in our Terms & Conditions.
The fastest way to understand RBP Advisor is to watch it compare two snapshots and produce the attestation.
We will walk you through a live comparison, show you the drift log, the Segregation of Duties findings and the workbook, and answer the questions your audit team will ask before they ask them.
Questions first? Email sales@trimundo.net