/* TARGET OBJECT : access control ZR_CHANGEAPPROVAL - README step U10, UI leg
   abap: URI     : abap:/repotree-v1/0M7DEJI/System%20Library/ZLOCAL/ZARENA_PLM/Core%20Data%20Services/Access%20Controls/ZR_CHANGEAPPROVAL/zr_changeapproval.dcls.acds
   ACTION        : create empty via ADT MCP (objectType DCLS/DL, README U10), replace entire content, save, then activate
                   (view ZR_CHANGEAPPROVAL must be active).
   Full access rule: read access is governed by the IAM app / business catalog (ADR-002); SAP delivers no full-access
   roles but customers may use them [source: abap-docs /abap-docs-cloud/ABENCDS_DCL_ROLE_GRANT_RULE, verified 2026-09-15].
   @MappingRole: true assigns the role to every user [source: abap-docs /abap-platform-rap-opensap/week2/unit7, verified 2026-09-15].
   Tighten later with a custom authorization object + pfcg_auth condition if per-user data restrictions are needed. */
@EndUserText.label: 'Access control for ZR_CHANGEAPPROVAL'
@MappingRole: true
define role ZR_CHANGEAPPROVAL {
  grant select on ZR_CHANGEAPPROVAL;
}