Role Access Visibility

Includes:

Pack In to help know what objects are linked to directly from the main menu.
SQL to Disable Menu Processes for a Specific Role.

Removing window access for a specific role is easy and obvious. You simply deactivate the record in Role => Window Access. If you deactivate all windows, the user will not show any windows the next time they log in. Process access is a little challenging. Simply deactivating all process access from a role can have unintended consequences. There are situations where the system will not perform as expected (fail), and it may not be obvious as to why. For example, if you disable all processes for a user, they will not be able to print because print formats are executed through "Report & Process". It would be very convenient to know what processes are directly linked to from the main menu (AD_Menu). This discussion includes a plugin that does two things:

Tells you what processes, workflows, etc.. are linked to from the main menu.
Tells you the menu name for the process - note they are often not the same. This fact makes mapping harder. The plugin makes this process much easier.

In addition to adding the Menu name to the Process Access list, you can deactivate only the processes that are called directly from the menu. The below SQL will help you accomplish this task. Simply replace the XXXXXX with the ad_role_id of your role and execute the below statement. You can find the role id by:

opening the Role window
navigating to the desired role
clicking on the X/X row count in the upper right corner of the window
the popup window will tell you the ad_role_id

--remove all processes linked to by the menu
update AD_Process_Access
set isactive = 'N'
where ad_role_id = XXXXXX
and ad_process_id in
(
select ad_process_id from ad_menu
)
;

Reference: Role creation demonstration by Jan