Why does SAP recommend splitting the system-administrator and authorization-administrator roles?

What is an authorization, and what does it mean that the SAP model is positive?

What is a composite role, and what can't you do with its authorizations?

How do transported roles reach production, and what two steps must happen before users get the new authorizations?

What two authorization checks happen when a transaction is called?

How are authorizations bundled, and how are profiles created in the modern model?

Which background job keeps role assignments current, and why schedule it?