Concept card

Agent identity, trust & the agent gateway in SAP — what is documented and what TechEd 2026 describes

As of 2026-10-16

Edited by Cédric Mary, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is Agent identity, trust & the agent gateway in SAP?

SAP's reference architecture treats an AI agent as an identity in SAP Cloud Identity Services, propagates the user context by token exchange rather than passthrough, and routes third-party agents through an agent gateway with policy checks. The identity model is documented on SAP pages (12 May to 1 Oct 2026); the gateway onboarding flow (SAP for Me, 'formations', discovery) appears only in nine TechEd 2026 catalogue sessions (27-28 Oct) and is preview wording, not an announcement.

Status first: documented architecture versus catalogue wording

This card mixes two kinds of evidence and labels each. Documented: SAP's Architecture Center pages on agent identity, the SAP AI Agent Hub and agents on SAP Business AI Platform, plus the SAP Help Portal description of SAP Cloud Identity Services. Catalogue wording only (preview): what nine SAP TechEd 2026 sessions say about an "agent gateway", onboarding through "SAP for Me", "formations" and discovery. The SAP TechEd 2026 catalogue lists XP202 "SAP-managed agent access, trust, and discovery" (27 Oct), XP268 "Govern the agent economy: Secure A2A using SAP’s agent gateway" (27 Oct) and XP112 "How SAP secures enterprise AI agents with identity propagation" (28 Oct). A session description is not a product announcement: no general availability date, price or entitlement for the gateway onboarding flow is published in what we read (16 October 2026).

Why agents are a new identity problem

A human user signs in, holds roles and is accountable. An AI agent acts continuously, calls tools and other agents, and can chain actions no single role was designed for. The catalogue session XP105 "AI-powered security: Managing risks of nonhuman identities" (27 Oct) frames the risk in those words: agents and nonhuman identities create new risks and attack surfaces, and SAP Enterprise Threat Detection is named as the application used to monitor, detect and investigate suspicious AI-driven activity. That is the abstract's claim; we found no SAP documentation describing agent-specific detection use cases in Enterprise Threat Detection, so treat it as a question for the session, not a capability to sell.

Why it matters

SAP's reference architecture puts agents in the same directory as people (SAP Cloud Identity Services), so existing joiner-mover-leaver and review processes can extend to agents instead of a parallel scheme.
Token exchange instead of token passthrough is the design rule that keeps the user context, names the agent and limits scope; it is where audits and breaches are decided.
Nine TechEd 2026 sessions (27-28 Oct) are listed on this theme, but the agent gateway onboarding flow is described only in abstracts; client plans must separate documented architecture from catalogue wording until 30 October.

Key points

Documented: SAP Cloud Identity Services is the identity hub for humans and agents; agents get their own identity in the Identity Directory (SAP Architecture Center, updated 12 May 2026).
Documented rule: an MCP server must not proxy the caller's token downstream; it exchanges it (RFC 8693) for a scoped token carrying the agent identity and the user context.
Documented: the Agent Gateway has an external A2A interface for third-party agents and an internal role wrapping Joule-to-agent traffic, with three policy enforcement points.
Status caveats on SAP's pages: the enforcement point between agents and APIs, tools or MCP is stated as H2 2026; bidirectional third-party A2A through the gateway is 'not yet supported'.
Catalogue wording only (preview): registration through SAP for Me, 'formations' and agent discovery (XP202), and bringing a Google agent in over A2A (XP268).
Out of scope here: prompt injection and content filtering (M368, C120); this card is about who the agent is and what it may reach.
After TechEd (30/10): re-read the gateway status, token flow, revocation and Enterprise Threat Detection coverage in SAP's own words.

Terms used on this page

Non-human identity: An identity held by software (service account, workload, AI agent) rather than a person; it needs an owner, scope and lifecycle like a user.
Agent identity: In SAP's reference architecture, the identity artifacts that let an agent be authenticated, authorised and governed; stored in the Identity Directory next to human identities.
Token exchange (RFC 8693): An OAuth 2.0 mechanism to swap one token for another with different audience, scope or identity; the alternative to forwarding a received token.
Principal propagation: Carrying the end user's identity through each hop so the backend authorises the user, not a shared technical account.
SAP Agent Gateway: Per SAP's architecture pages: the A2A interface for third-party agents and the policy-enforced path for Joule-to-agent traffic. Onboarding details are catalogue-only.
App2App trust: An SAP Cloud Identity Services (IAS) trust relationship between Joule and a pro-code agent server, required for Joule to call an A2A agent.
Policy enforcement point (PEP): A place where an access decision is applied; SAP's page lists gateway entry, agent hand-off and the target application.
Formation (preview wording): Term used in the XP202 abstract for what establishes trust between agents; not defined in the SAP primary pages read.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks · the facts worth quoting.

Open in the app →