Audit driven SAP Substitution

We know SAP end users use SAP Inbox Substitution when they go for vacation. One thing I have noticed and Audit has always been complaining about is why the Substitute approved when he do not have the role to approve or even see the workitem when he should not even have them. We have tried to achieve this using Task Profile but in a company which has so many different types of Workflow it becomes cumbersome for the user to maintain substitute based on Task profile. In order to achieve Task being sent to only a selected few we use General Forwarding not allowed and maintained the role or users there. Even after maintaining that the Substitute receives the workitem as the substitution has been defined ALL in Task Profile. With this enhancement we will achieve what Audit has been asking me for a long time. A thansgiving gift to them and other Users:)

One thing we tend to explaing End User is

SUBSTITUTION DOES NOT ALSO SUBSTITUTE THE SECURITY ROLE

Here is the Task maintained with a user. You can go from PFT and then Agent assignement and maintain or drill down from Workflow Builder

Due to this Task maintenance we have entry in HRP1001 table.

Here is the substitute maintained.

Here is my Workflow Inbox. Here I am the substitute and I should not receive this but I have because I am maintained as Substitute with ALL

Workflow log

How to make sure this does  not happen. In SAP we have a BADI WF_BWP_SELECT_FILTER which we will implement. The method APPLY_FILTER we have to implement.

Here is the code

   method IF_EX_WF_BWP_SELECT_FILTER~APPLY_FILTER.
  data:lv_user type hrp1001–sobid,
        lv_objid type hrp1001–objid,
        wa_worklist type SWR_WIHDR.
  loop at IM_WORKLIST into wa_worklist.
    clear lv_user.
    select single objid into lv_objid
      from hrp1001 where otype = ‘TS’
    and objid = wa_worklist–wi_rh_task+2(8).
      if lv_objid is not initial.
  select single sobid into lv_user
    from hrp1001 where otype = ‘TS’
    and objid = wa_worklist–wi_rh_task+2(8)
    and subty = ‘A007’
    and sobid eq sy–uname.

    if lv_user is not initial.
      append wa_worklist to RE_WORKLIST.
      endif.
      else.
        append wa_worklist to RE_WORKLIST.
      endif.
endloop.
endmethod.

After implementing this code you can see the previous workitem is not showing up.

Hence we achieve this with a small enhancement.