authorisation check in custom programs

hi experts,

what is the best practise to follow auth check for a custom report. Say if we have a auth object Z_PROG with fields PROGRAM ACTVT WERSK BUKRS and so on.. can we give ACTVT = 16 for users in production? What is the best way to apply authorisation check ?

Regards

Aditya