The [standard authorization concept|http://help.sap.com/saphelp_nw70/helpdata/EN/52/67167f439b11d1896f0000e8322d00/frameset.htm] is based on the ABAP statement [AUTHORITY-CHECK|http://help.sap.com/abapdocu/en/ABAPAUTHORITY-CHECK.htm] and roles.
If you like to use it you would create some customer authorization objects with corresponding authorization fields, use [AUTHORITY-CHECK|http://help.sap.com/abapdocu/en/ABAPAUTHORITY-CHECK.htm] and work with roles to assign authorizations to users.
You describe another approach: "The user should be able to open the transaction only if the value is 'Y' in the database table for the user."
Well, there exist applications for which is the correct technique: If the data already exist than it is ok to check these database entries. (Example: Everyone is allowed to maintain his or her own data.)
However, if an administrator has the task to maintain the permission assignments, than I recommend to go for the standard authorization concept.
Kind regards
Frank Buchholz
