How can you control data access of a business user?

Comprehensive and Detailed Explanation from Exact Extract:

In ABAP Cloud / RAP, authorization control follows a structured approach:

Read access → can be controlled implicitly via an Access Control object (D).

Create, Update, Delete access → can be controlled both:

Explicitly with AUTHORITY-CHECK (B),

Or implicitly through Access Control object definitions (C).

General implicit control via Access Control (A) or explicit checks for Read (E) are not correct because the system differentiates access levels precisely.

This ensures that business users can only access the data they are authorized for, following RAP’s security-by-default principle.

Verified Study Guide Reference: RAP Security & Access Control Documentation – Authorization in RAP BOs.