Which dedicated administrative roles should replace using SAP* with SAP_ALL?

What is an authorization, and what does it mean that the SAP model is positive?

What is a composite role, and what can't you do with its authorizations?

How do transported roles reach production, and what two steps must happen before users get the new authorizations?

What two authorization checks happen when a transaction is called?

How are authorizations bundled, and how are profiles created in the modern model?

Which background job keeps role assignments current, and why schedule it?