Application roles consist of duty and data roles. How are application roles assigned to users?

• A. First, you assign data and duty roles to a job-specific role, called a group. Then, you map the group to users.
• B. You assign data and duty roles to each user directly.
• C. You assign the subject area to the user.
• D. Only data roles are assigned to users.

Answer: (A)

Application roles in Oracle Fusion are composed of both duty roles (what you can do) and data roles (what data you can see). To grant these effectively, you don’t assign them to individual users. Instead, you create a job-specific group, assign the needed data and duty roles to that group, and then map the group to users. When a user becomes a member of that group, they inherit all the roles contained in the group; removing them from the group revokes the access. This approach keeps administration centralized and scalable—update the group’s roles in one place and all its members follow suit. Assigning roles directly to users is less scalable and harder to maintain, and assigning only data roles or relying on subject areas does not provide the complete security granted by the full application role.