If I give a manager the time approval role, he (correctly) is able to approve employee time, without being able...
to update their timesheets. As soon as I give the manager the time entry profile, he can a) approve his own timesheet, and b) update subordinates' time
I suspect that I am using the wrong evaluation path in the structural authorization profile. (I'm using O-S-P, with the HR_GET_MANAGER_aSSIGNMENT function module) .
Is there an evaluation path that begins one level down from the manager's position?
If you are comfortable with code, I would suggest taking a look at the BAdI HRBAS00_STRUAUTH. That should give you the ability to modify what you need.