AGR_1251 table — Authorization field values maintained in a role

One row represents a single value or value-range line maintained for one authorization field within one authorization object inside one PFCG single role. Because a field can be a select-option with several entries (for example three separate company codes), one role/object/field combination can span several rows, each carrying its own LOW and HIGH. This is maintenance data captured on the authorization tab of the role, before or after the role is generated into a runtime profile. It does not by itself describe what a user is currently allowed to do; that depends on generation status, user master comparison, and composite role expansion. Rows exist per client. The table is populated when a role is created, changed, or copied in PFCG, and is read by PFCG itself when rendering the authorization tree and by generation reports when building the profile.

Always filter on MANDT implicitly via the client connection and explicitly on AGR_NAME first; the table spans every role times every object times every field times every value line across the whole system, and an unrestricted select on OBJECT or FIELD alone can return millions of rows in a mature landscape. If searching for who can access a specific value (a company code, a plant, a document type), restrict on OBJECT and FIELD together, then filter LOW/HIGH as a range check rather than an equality check, since a single maintained line can cover a range that silently includes the value being searched for. Expect '*' stored literally as a value meaning full authorization, not an empty field.

Symptom: a user gets an authorization failure for company code 3000 on object F_BKPF_BUK. Pull the user's role list from AGR_USERS for that user and client, then select from AGR_1251 where AGR_NAME is in that role list, OBJECT = 'F_BKPF_BUK', FIELD = 'BUKRS', and LOW <= '3000' <= HIGH (or LOW = '3000' if no range). No matching row across all assigned roles confirms the role design genuinely excludes that company code; a matching row but continued failure points to a stale generated profile instead.

AGR_1251 exists unchanged in S/4HANA and continues to be the same table used by PFCG for maintaining authorization field values in single roles. No compatibility view or replacement is known for it. S/4HANA adds authorization objects and check logic specific to Fiori apps and new transactions, but the mechanics of how a role's field values are stored in this table are the same as in ECC.

Role content and the values maintained in AGR_1251 are owned by the security or identity and access team that builds and maintains PFCG roles. Functional module leads can flag a specific access gap or excess, but changing the values requires the security team, and any question involving segregation of duties analysis on this data typically also involves the GRC Access Control team.

AGR_DEFINE holds the role master record and description; AGR_USERS holds the role-to-user assignment with validity dates; AGR_TCODES holds the transactions attached to the role; AGR_1252 holds organizational level values maintained separately from field-level values; USOBT_C and USOBX_C hold the check indicator proposals from SU24 that determine whether an object is even evaluated for a transaction. PFCG writes AGR_1251 directly; SU24 writes the check indicator tables that influence what PFCG proposes.