SAP Fiori Roles and Templates

Hi,

We are currently setting up a central hub deployment for our Fiori apps.

Unfortunately, due to security standards, SAP Standard Fiori roles cannot be granted to the users, together with several /IW* templates.

Is there an alternative way to attain these roles or compose similar roles?

Our security consultant suggested to trace the authorization for these roles, but how can we trace the authorization which Fiori apps use?

Since Fiori applications are not like SAP GUI transaction which we can trace, is there any tool for this?

Thanks,

Gin