AGR_TCODES table — Transaction Codes Assigned to a Role

AGR_TCODES holds the transaction code entries that appear on the menu tab of a role in PFCG. Every time a tcode is added to a role's menu tree, PFCG writes a row here linking that role name to that tcode. A single role can have many rows, one per tcode on its menu. Composite roles are handled differently since their menu is built from the single roles they contain, so a composite role name may or may not carry its own direct entries depending on how it was built. The table is populated by role maintenance, not by execution, so it reflects design-time configuration rather than what a user actually ran or is entitled to run.

The table can run into millions of rows in a large landscape because every role-tcode pairing is a separate row. Always filter on MANDT and then on either AGR_NAME or TCODE, never scan without one of those two. Selecting by TCODE alone across all roles is a legitimate and common query when the question is which roles expose a given tcode. Selecting by AGR_NAME alone is the right approach when the question is what a specific role's menu contains. Do not attempt to derive who can execute a tcode from this table alone; that requires the join through AGR_USERS and a check of the generated profile status.

A user reports that transaction ZINV does not show up in their SAP Easy Access menu despite being told the role was assigned. Select AGR_TCODES for MANDT = client and TCODE = 'ZINV' to list every role that has that tcode on its menu. Cross-check the result against AGR_USERS for that user's assigned roles. If none of the user's roles appear in the AGR_TCODES result, the tcode was never added to the role menu, which is a role design gap, not an authorization or user master issue.

AGR_TCODES exists unchanged on S/4HANA. PFCG remains the tool for role maintenance and continues to write to this table exactly as it did in ECC. There is no compatibility view or restructuring known for this table; queries and reports built against it in ECC continue to work the same way after migration.

Ownership sits with the security or access-governance team that maintains roles in PFCG, not with Basis and not with the functional module team requesting access. Any dispute about what a role's menu contains, or why a tcode was added or removed, is a role design decision that belongs to whoever governs the role catalog.

AGR_1251 holds the authorization object values generated for the same role and is the table to check once menu assignment is confirmed. AGR_USERS records which users hold the role and is required to trace from tcode to actual user access. AGR_DEFINE carries the role's own master attributes. PFCG is the transaction that writes and maintains all of these tables together whenever a role is changed and its profile regenerated.