Does the agent need inbound network access to my SAP hosts?

No. The agent is outbound-only. It polls Farrenio over HTTPS for its config and pushes metrics the same way. No new firewall rules, no exposed ports on your SAP boxes.

Can my service desk see alerts without touching production?

Yes. The service_desk role is read-only on alerts and incidents, with no SAP transaction access, no config changes and no token reveal. Granular per-action RBAC means you can carve out exactly what each team sees.

How long does a proof of concept take?

A 30-minute call to scope. We typically have one production SID streaming live metrics within an hour of agent install, and the rest of the landscape follows as fast as you can roll out the package.

Access and roles · 08

Your service desk does not need SAP_ALL

One of the quieter risks in SAP operations is how often broad access is granted simply because it is the easiest way to let someone see something.

Request a demo All insights

Visibility and privilege are different things

The service desk needs to know an alert fired. They do not need to restart an instance. A customer contact needs to see availability for their systems, not anyone else's. A contractor needs their own work and nothing more.

When the only way to give visibility is to give privilege, organisations face a bad choice: restrict visibility and keep production rights holders answering "is it down?" all day, or widen privilege and accept the risk.

What good access design looks like

Read separated from act
Seeing an alert and executing a command are different permissions.
Credentials never shown
Most people who need the status never need a password.
Scoped by customer
Service providers keep each client's data within that client's boundary.
Everything attributable
Each privileged action records who, from where and with what result.

How FCC handles access

Eight built-in roles

From platform owner to read-only alert monitoring.

Granular permissions

Per-action permissions behind every screen and every API call.

Per-customer isolation

For service providers running several clients on one platform.

Audit trail

Who did what, from where, and with what outcome.

The point is not more bureaucracy. When access matches the job, you can safely give more people the visibility they need.

Go deeper

Capability

Security and audit

The role model, access scoping and audit retention.

Use cases

How different teams use the same platform.

Common questions

Can the service desk triage without execution rights?

Yes. A read-only alert monitoring role sees alerts without the right to execute commands or reveal credentials.

Can roles be adjusted?

Permissions are granular and can be delegated, so access can follow your existing separation of duties.

Give more people visibility, with less privilege.

We will map FCC's roles onto your team's responsibilities in a short session. FCC is in Beta.

Request a demo See pricing

"SAP" and SAP product names are used descriptively. Farrenio Cloud Control is a Farrenio product and implies no partnership with or endorsement by SAP.