💰 OasisPro · Permission Project Cost · Budget · PermissionWorks
Data migration: budgeted.
Permissions: forgotten.
Look at your 26R2 budget. It almost certainly has line items for data migration, integrations, training, maybe a contingency buffer. Does it have one for IFS Cloud permission project cost? Most don't, and that's not because permissions are cheap. It's because they get treated as a configuration afterthought instead of the workstream they actually are.
Here's what happens instead: week six arrives, someone realizes every Applications 10 permission set has to be redesigned against the Projections and Actions model, not copied over, and suddenly there's an unplanned cost sitting in the middle of a timeline that had no room for it.
Here are the 6 numbers that actually predict this cost, so it's a planned line item instead of a mid-project surprise.
Permission project cost isn't driven by how many employees you have. It's driven by how many distinct jobs they do. A thousand users doing forty roles costs roughly what a hundred users doing the same forty roles costs.
Once that's clear, the estimate stops being a guess based on headcount and starts being a number based on the actual design and testing work required, which is exactly the number your budget needs.
The 6 numbers that actually determine IFS Cloud permission project cost
- 1. Number of distinct roles or job functions. The real driver of how many Permission Sets need designing, not how many people are on payroll.
- 2. Number of Projection and Action combinations per role. This is where hours actually accumulate, and it's invisible until someone actually maps it.
- 3. Segregation of duties conflict count. Every conflict found triggers a redesign cycle, not a simple flag-and-move-on. Budget for the redesign, not just the discovery.
- 4. Number of legacy Applications 10 permission sets being replaced, not mapped. This is redesign work. Anyone quoting it as translation work is quoting the wrong job.
- 5. Testing cycles required per role. A role isn't done when it's designed. It's done when it's been tested against real scenarios, and that's recurring cost across the project, not a one-time cost.
- 6. How much of steps 1 through 5 gets automated versus done by hand. This is the single biggest lever on your final number. Automated discovery and testing tools cut the manual hour count dramatically. Fully manual design does not.
Why headcount is the wrong number to budget from
A thousand users in forty roles need forty Permission Sets designed. Ten thousand users in the same forty roles need the same forty. Design cost scales with role complexity, not payroll size.
Why SoD conflicts cost more than they look like
Finding a conflict is fast. Redesigning around it, without breaking someone's ability to do their actual job, is the part that takes real hours, and it's the part most estimates undercount.
Why testing is recurring, not one-time
Every redesign, every SoD fix, every scope adjustment triggers another test pass. Budget for the cycle, not a single testing phase that never actually gets revisited.
The lever that actually moves the number
Automation. Manually mapping Projection and Action combinations across dozens of roles, then manually testing each one, is where most of the hours in a fully manual project go. Tools that automate discovery and testing don't remove the need for human judgment on redesign decisions, but they remove a large share of the mechanical hour count around them.
When to actually budget for this
Alongside the technical migration scope, not after it. Permission redesign runs in parallel with data migration and integration work in every successful project we've seen.
Get the role count and legacy permission set count early. Those two numbers alone give you a directionally accurate estimate before a single hour of design work starts. The IFS Community forum is a useful sanity check on how other teams have scoped this.
Revisit the estimate once SoD conflicts are actually identified, since that number is impossible to predict accurately until someone's actually looked.
A 26R2 budget with no line item for permissions isn't lean. It's a discovery waiting to happen in week six.
What a properly budgeted permission project looks like
A role count and legacy permission set count established in week one, not discovered mid-project.
SoD conflicts surfaced early enough that redesign is planned work, not a fire drill against a deadline.
An automation decision made deliberately, weighed against the manual alternative, instead of defaulted into because nobody asked.
We'll give you a real number, not a guess.
PermissionWorks maps your distinct roles, Projection and Action combinations, and SoD conflicts, then gives you a cost estimate built on your actual environment, with the automation option priced alongside the manual one.
Understand the mechanism this cost is built onGet your permission project budgeted before it becomes a surprise.
Send us your current role list and legacy Applications 10 permission sets, and we'll return a real cost estimate built on your actual role count and complexity, not a per-user rate.
Why does permission project cost get left out of IFS Cloud upgrade budgets so often?
Because it looks like a configuration task, not a project, right up until someone realizes every Applications 10 permission set has to be redesigned against the Projections and Actions model, not copied over. That realization usually lands mid-project, which is the most expensive time to discover a missing line item.
What actually drives permission project cost more than anything else?
The number of distinct roles or job functions that need a Permission Set designed, tested and signed off, not the number of users. A thousand users doing forty distinct jobs costs roughly the same to design for as a hundred users doing the same forty jobs.
How much does automation actually change the total cost?
Meaningfully. Manually mapping Projection and Action combinations, testing every role scenario, and re-checking segregation of duties by hand is the most labor-intensive part of the whole project. Tools that automate discovery and testing remove a large share of that manual hour count, though the redesign decisions themselves still need a person.
Should permission cost be estimated before or after the technical migration is scoped?
Alongside it, not after. Permission redesign runs in parallel with the technical migration in most successful projects. Treating it as a cleanup task at the end is exactly how it becomes an unplanned cost and a timeline risk.
Budget the workstream, not the afterthought
Permissions are not a checkbox at the end of a 26R2 project. They're a workstream with a real, predictable cost, once you know which six numbers actually drive it.
Get the numbers early. Budget for them like the real project they are. Decide on automation deliberately instead of by default.