Concept card

Joule Guardrails

As of 2026-07-24T14:00:00Z

Edited by Cédric-Olivier Mâry, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is Joule Guardrails?

Guardrails aren't an add-on layered onto Joule agents — they're the mandatory default wrapper around every single invocation, which is precisely what lets them double as EU AI Act Articles 9/13/14 evidence.

Joule Guardrails is the governance layer that sits between every Joule agent and the model that powers it. It is not a plug-in a customer chooses to enable — it is the default execution wrapper around every Joule Skill invocation, every call to the Model Gateway, and every workflow built in Joule Studio. Understanding Guardrails matters because, in an SAP shop, it is the single most concrete artefact you can point to when a client asks "how do we know the AI agent won't do something wrong, and how do we prove it to a regulator?"

The framework has three layers that work together.

Layer 1: content filtering

Every input into a Joule agent — the user's question plus whatever grounding context the agent pulls in — passes through SAP's content-safety classifiers before it ever reaches the underlying language model. These classifiers look for prompt injection (text designed to override the agent's instructions), jailbreak patterns, and personal data that should never enter an LLM context in the first place. The same classifiers run again on the way out, checking the agent's proposed response or action for harmful content, leaked personal data, and — critically for regulated deployments — answers that exceed the agent's declared risk tier (a "limited-risk" HR agent, for instance, should never produce something that reads as individualised legal or medical advice).

Layer 2: human-in-the-loop escalation

Why it matters

Input classifiers catch prompt injection and jailbreak attempts before the grounding context ever reaches the LLM call
A human approver sees the agent's recommended action, supporting Knowledge Graph evidence, and confidence score — and can approve, reject, or delegate
Every HITL interaction is logged to a tamper-resistant audit journal, generating oversight evidence automatically rather than after the fact

Key points

Three-layer framework: content filtering (input + output classifiers) → HITL escalation engine → Audit Journal (tamper-resistant log per inference).
Default execution wrapper — not optional; applied to every Joule Skill, Model Gateway call, and Joule Studio workflow run.
EU AI Act mapping: Art. 9 (risk management) + Art. 13 (transparency) + Art. 14 (human oversight) — all three satisfied by the three guardrail layers.
From 2026-08-02: Annex III high-risk Joule agents without active guardrails = regulatory violation; penalty up to 3% global turnover / €15M.
Prompt injection defence: input classifiers block adversarial prompt injection attempts before they reach the Model Gateway.
HITL failure mode: escalation queue staffing is a business change management deliverable, not a technical one — unstaffed queues are the most common production failure.
Audit Journal retention: minimum 10 years for high-risk system evidence per EU AI Act Art. 9(7).
Joule Guardrails is mastered only when it changes a named buyer decision.
Start with the semantic contract and control model before demonstrating the tool.
Use current SAP, analyst, study, KG, and news signals as evidence, not decoration.

Terms used on this page

Content filtering: Automated classification of AI inputs and outputs against a policy list (harmful content, PII, prompt injection, jailbreak patterns) — applied before and after the Model Gateway LLM call by the Joule Guardrails framework.
Prompt injection: An adversarial attack where an attacker embeds instructions in user-submitted content (a job application, a supplier form, a customer complaint) designed to override the agent's system prompt and cause it to take unintended actions.
HITL (Human-in-the-Loop) escalation engine: The Joule Guardrails component that detects HITL conditions defined in the Joule Studio workflow, pauses agent execution, routes the pending action to a human approver queue, and logs the human decision in the Audit Journal.
SAP Audit Journal: Tamper-resistant log service on SAP BTP that records every Joule agent invocation event — input, Prompt Registry reference, model used, content filter verdicts, HITL events, and action taken; queryable for EU AI Act compliance evidence.
EU AI Act Art. 14 (human oversight): Obligation for high-risk AI system deployers to implement effective oversight mechanisms enabling humans to detect, prevent, or intervene in situations where the system behaves contrary to its intended purpose — the HITL escalation engine is the primary SAP implementation of this obligation.
Decision owner: The accountable person who accepts the trade-off and funds the next action.
Semantic contract: The shared definition of business terms, metrics, entities, and access rules used by tools and teams.
Control plane: The layer that applies policy, access, lineage, monitoring, and escalation across the operating model.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks · the facts worth quoting.

Open in the app →