A-01 · No
| Field | Value |
|---|---|
| ID | A-01 |
| Category | authorization |
| Severity | error |
| Blocks mode | EVIDENCE_GROUNDED (plan drops to HEURISTIC_DRAFT while the gate is red) |
| Applies to | every CDS node in the plan graph |
| Source | internal/sap/validate/validate.go |
What it checks
Section titled “What it checks”No node carries the annotation access_check: #NOT_REQUIRED. On a business-measure view that value disables the authorization runtime check entirely and cannot be shipped.
When it fires
Section titled “When it fires”Any node in the plan has Annotations["access_check"] == "#NOT_REQUIRED".
Failure detail
Section titled “Failure detail”A-01: one or more views use #NOT_REQUIRED on business-sensitive data.
Resolution
Section titled “Resolution”Change the annotation to #CHECK (add or reference a DCL role — see A-02) or #PRIVILEGED_ONLY as the case requires. See How to resolve a gate.