There are the Security Guides, which describe which options exist - but which often do not tel about recommended settings.
The "RunSAP Security Standard" tries to narror down this gap. However, it covers mostly security settings but does not dig into details of authorization concepts. Anyway, you might want to give it a try. Have a look to https:// service.sap.com/sos as a starting point.
Kind regards
Frank Buchholz
