How ERP Risk Advisors Determines JDE World Access Security

Why JDE World Access Is Uniquely Complex

In JD Edwards World, user access is not determined by a single role, report, or table.

Effective access is the result of multiple security layers working together, including:

• Production user scoping
• Base menus, profiles, and menu masks
• Menu Hierarchies
• Action code security for interactive programs

Failing to look at all these components in aggregate can create false negative or false positive results. On paper, users may seem locked down or over-privileged, while their real, day-to-day access tells a very different story.

ERP Risk Advisors designed a JDE World scanning engine that mirrors how JDE World actually evaluates access, producing results that reflect real, usable access, not theoretical program access.

What the Scanning Engine Is Designed to Do

The engine accurately determines effective user access in Production and translates that access into:

• Sensitive Access (SA) results
• Segregation of Duties (SoD) conflicts

All results are aligned to ERP Armor: Rules for JDE World, ensuring consistency with financial reporting, fraud, and compliance expectations. We can also scope any additional custom programs at no additional cost.

Simplified Version of How the Engine Works

1. Start with the Right Population

The scan begins by identifying only users with Production access. This ensures results are relevant for SOX, audit, and security testing and that there is no noise from non-production users.

Outcome: A clean, defensible population of in-scope users.

2. Apply the Same Menu Mask Logic as JDE World

For each user, the engine evaluates:

• Base menu
• Assigned profile
• Authorization and Knowledge menu masks

The engine takes this information in aggregate to help determine each user’s access and automatically applies the more restrictive menu mask, exactly as JDE World does, ensuring access is evaluated accurately.

Outcome: A user’s base menu, profile, and appropriate menu mask is applied before any access is inferred.

3. Crawl Menus to Determine Access

Using the user’s base menu, the engine walks the full menu hierarchy:
Base Menu → Submenus → Programs

A result is generated only if:

• The program is reachable through the menu structure, and
• The user’s menu mask allows interaction

This prevents false positives that would be reported if menu masking was not considered.

Outcome: A resolved list of programs each user can truly access.

4. Evaluate Action Code Security Only When It Matters

For interactive programs only, the engine evaluates action-level access (Add, Change, Delete) using JDE World’s full action code hierarchy.

Key safeguards:

• Action code security is evaluated only after menu access is confirmed
• Access is never inferred solely from action code tables
• Defaults are applied only when JDE World would apply them

Outcome: Clear visibility into what users can actually do with interactive programs, not just what they can see.