Securing SAP AI agents — identity, access and the agent gateway
As of 2026-10-16
A security-focused module on how SAP positions AI agents as identities: agent identities stored in SAP Cloud Identity Services beside human ones, user context carried by token exchange instead of token passthrough, and an Agent Gateway that exposes an A2A interface to third-party agents and enforces policy at three points. Every claim is labelled documented (SAP Architecture Center, SAP Help, 12 May to 1 Oct 2026) or catalogue only (nine SAP TechEd 2026 sessions, 27-28 October, including gateway onboarding through SAP for Me). It stays out of prompt injection (M368, C120) and teaches the layer under them: who the agent is, whose authority it carries and where access is decided.
What you will learn
- Draw the hop-by-hop identity chain of an agent call (user, Joule, gateway, agent, backend) and state at each hop which principal the backend authorises
- State what a token exchange (RFC 8693) must carry for an MCP server or agent endpoint, and why token passthrough is forbidden
- Describe how SAP Cloud Identity Services holds agent identities next to human ones and which of its four services does what
- List the three policy enforcement points of the Agent Gateway and the two status caveats SAP's pages carry (H2 2026 enforcement point, bidirectional A2A)
- Label every claim in a client document as documented or catalogue only, citing page or session code and date
Module overview
Who this is for. You advise a customer who wants AI agents (SAP's Joule agents, agents built in Joule Studio, or agents from Microsoft, Google or a partner) to act inside an SAP landscape, and the security lead asks: "Which identity does the agent have, whose authority does it carry, and where is access decided?" This module teaches the identity and access layer. It does not repeat prompt injection, data exfiltration and content filtering (M368, C120), the MCP and A2A protocol mechanics (M327, C132) or Joule activation and roles (M360). Platform vocabulary: the platform underneath is SAP Business AI Platform; services such as SAP Cloud Identity Services keep their names.
Evidence labels used throughout. Documented = stated on an SAP Architecture Center, SAP Help or SAP Learning page we read (16 October 2026). Catalogue only = stated only in an SAP TechEd 2026 session description (27-28 October 2026); a session description is not a product announcement. Terms such as "agent gateway onboarding", "SAP for Me registration" and "formations" are catalogue-only wording; the agent gateway itself is also documented on SAP's architecture pages, with status caveats quoted below.
Prerequisites
- Completion of M360 (Joule Rollout — Activation, Roles, Identity and Tenancy) or equivalent experience with Joule roles and identity
- Working knowledge of MCP and A2A at the level of M327 and of OAuth 2.0 authorization-code flows
- Optional: read-only access to the customer's identity-provider and SAP Cloud Identity Services documentation to ground the trace
Outcomes
- Tell a security lead, with source and date, which parts of SAP's agent identity model are documented and which are only described in the TechEd catalogue
- Produce a hop-by-hop identity trace for one agent scenario with token, issuer, audience, logged identity and revocation per hop
- Review a custom MCP server or agent endpoint against the token-exchange rule before anyone builds it
- Write an agent identity lifecycle card: owner, review date, deprovisioning trigger and revocation steps
- Keep gateway-dependent promises out of client plans until the post-TechEd status is read on 30 October 2026
Full module available to members. The full module adds: the decision framework · the end-to-end scenario walkthrough · the KPI scorecard · the anti-patterns · the code blocks · the knowledge check · the diagrams.