How to ensure that security Roles created in SAP BW are also inherited in SAC stories

We have SAC with live connection to SAP BW on-premise . We have implemented all the security on BW with different roles. I want to ensure that the same data security is also reflected when user is viewing a SAC story. I understand that I need to have a single sign on.Do I need to create the same users in SAC and SAP BW so as to ensure that the roles applied in BW are effective in SAC ? How will I ensure the data security in SAC is exactly same as defined in SAP BW?