SAP tableObjectTACTModuleSECURITY_GRC

TACT table — Activity Text Table for Authorization Codes

TACT is the cross-client text table that translates the two-digit activity codes (01, 02, 03, 06, 16, and so on) carried in the ACTVT field of authorization objects into readable descriptions such as Create, Change, Display, Delete, Execute. It is used purely to render text in PFCG, SU21 and SU24; it does not decide which activities are valid or perform any authorization check.

This page covers TACT, the small cross-client lookup table behind the ACTVT activity codes used in almost every SAP authorization object. It focuses on the recurring confusion between missing activity text (a display gap) and missing authorization (a check failure), since these two get mixed up constantly in role and authorization troubleshooting.

Reviewed by an ERPClimb SAP consultant on 15 Sept 2026· 974 words

What it stores

One row in TACT represents the language-specific text for a single activity code. Activity codes are the two-digit values held in the ACTVT field, which is present in a very large share of SAP authorization objects because it is the field that says whether a given authorization check permits create, change, display, delete, execute, and so on. TACT is not part of the authorization check itself. It exists so that PFCG, SU21 and related maintenance transactions can show a human-readable label instead of a raw two-digit number whenever an ACTVT value has to be displayed to an administrator building or reviewing a role. Standard activity codes (01, 02, 03, 06, 16, 08, and others) are delivered with SAP content; the customer-reserved range in the 90s is left for local extensions and is where text gaps most often appear.

Key fields

  • SPRAS - language key, determines which translated text is returned for a given activity
  • ACTVT - the two-digit activity code, the same value that appears in the ACTVT field of authorization objects and in role authorization data
  • ACTVT_NAME - the descriptive text for the activity in the language given by SPRAS (field name not fully confirmed, verify structure before relying on it in a program)

How it joins the data model

  • AGR_1251-ACTVT = TACT-ACTVT, restricted by TACT-SPRAS, to turn the raw activity values stored against a role's authorization object into readable text
  • Authorization object definitions that list which activity codes are permitted for a given object join to TACT on the activity code to obtain its description for display in SU21
  • USOBT_C and USOBX_C carry ACTVT as one of the values proposed for a transaction's default authorizations; TACT supplies the text when those proposals are shown, it does not supply the value itself
  • No join to user master tables is needed here; TACT sits entirely on the authorization-object side of the model, never on the user-assignment side

How to read it safely

TACT is cross-client and tiny, on the order of a few hundred rows covering roughly ninety activity codes across the installed languages, so there is no performance concern in selecting from it directly. The only thing worth restricting on is SPRAS, because selecting without a language filter returns one row per language for the same activity code and produces duplicates in a report or a join. There is nothing to tune here; if a select against TACT feels slow, the problem is in what it is being joined to, not in TACT itself.

How to prove it in the data

Symptom: a role shows a blank or unreadable label next to an activity value in PFCG's authorization data screen. Select from TACT where ACTVT equals the code shown in the role (for example 90) and SPRAS equals the logon language. No row returned confirms the code simply has no maintained text in that language; the authorization itself, and its check at runtime, is completely unaffected by this gap.

ECC vs S/4HANA

TACT continues to exist in S/4HANA in the same cross-client, text-table shape. The concept of a two-digit activity code driving the ACTVT field across authorization objects is unchanged from ECC, so TACT keeps exactly the same supporting role in PFCG and SU21 rendering. There is no compatibility view replacing it and no structural change to plan for.

Common pitfalls

  • Treating a blank or wrong activity description in PFCG as an authorization defect. It is a text lookup miss in TACT, cosmetic only, and has no bearing on whether SU53 or the authorization trace shows the check passing or failing.
  • Believing that maintaining a TACT entry will make a custom activity code valid for an object. Validity of an activity for a given authorization object is controlled by the object's own definition, not by whether TACT has a text row for that code.
  • Adding a custom activity in the 90-99 range and forgetting to add its TACT text, then spending time on a phantom authorization bug when the real symptom is only a display label.
  • Confusing TACT with USOBT_C or USOBX_C. Those tables decide which values SU24 proposes as default authorizations for a transaction; TACT only supplies the readable name once a value like ACTVT is already present.
  • Editing TACT as a first response to an authorization failure. It changes nothing about what is checked at runtime and will not resolve an SU53 trace showing a missing authorization.
  • Assuming a translation gap in TACT is a security exposure. It affects what an administrator sees in the UI, not what the authorization check enforces.

Whose problem this is

Questions about missing or wrong activity text belong to whoever owns authorization object design, usually the security or GRC team maintaining custom objects, not Basis and not a business data owner. Any fix means adding or correcting a text entry as part of the same change process used for the authorization object itself, since the two are maintained together.

Related SAP objects

Reviewed pages this object connects to in the ERPClimb knowledge graph.

Source: ERPClimb — https://erpclimb.com/sap-tables/tactERPClimb is an independent platform and is not affiliated with SAP SE. Reference pages are written and reviewed by SAP consultants for learning and troubleshooting.