Why should you copy standard SAP roles into the customer namespace instead of editing them directly?

What are the five SAP user types and the key distinction among them?

What is the "ghost logon" risk tied to the standard user SAP*, and why disable rather than delete it?

What are authorization profiles in relation to roles, and how are generated profiles named?

What does the ACTVT field mean, and which activity values are universal?

What problem does Central User Administration (CUA) solve, and what's its basic architecture?

What are three ways to discover which authorization objects and values a task requires?