Securing and Governing Enterprise AI Agents on SAP BTP: A Production Checklist for 2026
For CISOs, enterprise architects and SAP security leads approving agent go-lives on SAP Business AI Platform and SAP BTP.
Prototypes are easy. Production agents that read and change ERP data are not. At TechEd 2026 SAP put governance front and centre — observability of agent behaviour, model usage and spend in Joule Studio, a governed gateway for third-party agents, new AI Agent Hub and governance capabilities, and the planned SAP Enterprise AI Gateway (general availability planned for Q1 2027) to centralise authentication, policy enforcement, routing and auditing of AI traffic.
Whatever tooling you use, these are the controls we require before any agent we build goes live.
1. Identity: who is the agent acting as?
Decide per tool: user context (principal propagation) for anything user-specific or auditable; technical user only for non-personal, read-only reference data.
Use SAP Cloud Identity Services and XSUAA consistently; propagate identity through the Destination service and Cloud Connector to S/4HANA so backend authorisations still apply.
Never embed long-lived secrets in agent code or prompts; use service bindings and credential stores.
2. Authorisation: least privilege for tools
Expose agents to a dedicated, narrow service — a CAP projection with @restrict rules, or a curated MCP server in Integration Suite with its default authentication, scope and quota policies.
Separate read and write tools; require explicit user confirmation for writes and set business limits (amounts, company codes).
Respect the SAP API Policy and licensing when exposing SAP data to agents.
3. Data protection in the LLM path
Route all model calls through the Generative AI Hub orchestration service so you can apply data masking (pseudonymisation/anonymisation of personal data) before prompts leave your boundary.
Enable input and output content filtering, including prompt-attack detection (prompt shield), to reduce prompt-injection risk.
Treat every tool result as untrusted input: documents, emails and supplier texts can contain injected instructions. Agents must not follow instructions found inside data.
Minimise payloads — send the model only the fields it needs.
4. Reliability guardrails
Max iterations, timeouts and cost limits per run.
Idempotent write operations and clear rollback/compensation paths.
Model choice in configuration, not code — models in the Generative AI Hub are regularly retired and replaced.
A golden evaluation set executed on every prompt, tool or model change (Joule Studio's sandbox and auto-generated tests help for low-code agents).
5. Observability and audit
Log every agent run: user, prompt, tools called, parameters, results summary, decision, model and orchestration request ID.
Decide which layer owns the authoritative audit trail for agent-initiated ERP transactions — Joule, your API/MCP gateway, or the backend — before multi-vendor agents reach production.
Forward logs to SAP Cloud Logging and your SIEM; alert on unusual tool-call volumes.
Track spend: agent executions and premium AI scenarios typically consume SAP AI units.
6. Compliance and responsible AI
Maintain an agent inventory (purpose, owner, data categories, risk class) — SAP AI Agent Hub helps for SAP-registered agents.
Assess obligations under the EU AI Act and local regulation (for Indian customers, the Digital Personal Data Protection Act); SAP has announced an AI Governance Assistant to support EU AI Act compliance.
Keep a human accountable for each agent's decisions, with documented escalation paths.
Be transparent with users that they are working with an AI agent.
7. Go-live gate (copy this)
Identity model documented and tested end to end.
Tools are curated, least-privilege, and built on released APIs (clean core Level A/B).
Masking and filtering enabled in orchestration.
Write actions require confirmation and are idempotent.
Evaluation set passes agreed thresholds.
Logging, alerting and cost monitoring live.
Owner, risk classification and rollback plan signed off.
FAQ
Can third-party agents call Joule Agents securely? SAP announced a governed agent gateway that enforces access control for third-party agents invoking Joule Agents via A2A and MCP.
Is the SAP Enterprise AI Gateway available now? It was announced at TechEd 2026 with general availability planned for Q1 2027; design your logging so it can plug in later.
Get an Agent Security Review
Raven Infotech reviews agent designs on SAP BTP against this checklist and fixes the gaps — identity, MCP/A2A exposure, orchestration guardrails and observability. Request a pre-go-live agent review.
Comments