I have some problems with Authorization management sytem with baan ERP.

I want to define, for role, an access to a complete package except one session. The only way i found is to give access to all modules except the one that contain the session. And give access to all session in this module except the one i don't want. It is really time consuming and not very easy to maitain.

We tried to create 2 roles : first one give full access to package (tc for example) and second one forbid access to one session of tc. We have assign these two role to a user and he still can access to the forbidden session.

Is there any easy way to says : role have access to this package except this session?

The trick with tools roles is that if you assign them in a serial way (the second one is the sub role from the first one) then the most restrictive authorisation is applied.
If you assign roles in parallel then the most open authorisation is applied.

Rgrds,
Han