Concept card

Secure-by-Default for SAP Analytics Delivery (the S in GSTACK)

As of 2026-07-23

Edited by Cédric-Olivier Mâry, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is Secure-by-Default for SAP Analytics Delivery (the S in GSTACK)?

Secure-by-default is a pattern library, not a principle — every default (RLS on, public sharing off, watermarked exports, TLS on every RFC) pairs with a named override path and a gate that catches deviations at write time.

The pattern library

Each pattern is a one-liner default that a consultant applies on every Datasphere / BDC / SAC / BW/4HANA engagement, plus the gate that catches the override.

Datasphere

Datasphere
Pattern	Default	Override requires
Row-level security	ON for every fact view	sign-off + reason in `model.security filter off reason`
Consumption role	consume-only (no edit on production view)	architect explicit grant
Public sharing	OFF	data-classification re-review
Federated source PII	data-mask layer required	InfoSec review
Audit-log on view read	ON	none — never off

Business Data Cloud (BDC)

Business Data Cloud (BDC)
Pattern	Default	Override requires
Iceberg writes	staged with provenance metadata (table + commit)	architect sign-off + post-write audit-log entry
Joule enterprise agent	guard-rails: data-scope = caller's session role	InfoSec review for elevated scope
Cross-tenant join	DENY	per-tenant explicit grant + data-classification re-review
Lakehouse object-store ACL	least-privilege, principal-aware	platform-team approval

SAP Analytics Cloud (SAC)

SAP Analytics Cloud (SAC)
Pattern	Default	Override requires
Story workspace	private until reviewed	story-publish approval
Embedded export	watermarked	export-policy sign-off
Public link	OFF	data-owner approval + expiry stamp
Live connection roles	least-privilege, scoped to dataset	architect grant
Drill-through to federated source	RLS verified at every hop	re-test on every model edit

BW/4HANA

Why it matters

Row-level security defaults ON for every Datasphere fact view; turning it off requires sign-off and a reason logged in the model's security-filter field — not a silent choice.
SAC story workspaces default private until reviewed and embedded exports default watermarked — publication and export both require explicit sign-off to override.
The gate contract catches overrides at write time via pre-commit hooks for code-defined controls and postbuild audits — not at audit time, months later.

Key points

Default = safe path. Override = explicit cost + sign-off.
Pattern library covers Datasphere · BDC · SAC · BW/4HANA — four products, ~20 default patterns.
Every pattern carries a gate: pre-commit / postbuild / live-origin probe.
Audit ledger captures overrides, not heroics. Trail of consent ≠ trail of guesses.
Maps to canonical skill `security-best-practices`. Refresh quarterly.
Secure-by-Default for SAP Analytics Delivery (the S in GSTACK) is mastered only when it changes a named buyer decision.
Start with the semantic contract and control model before demonstrating the tool.
Use current SAP, analyst, study, KG, and news signals as evidence, not decoration.
Separate verified facts from directional trends and modeled assumptions.
Define owner, metric, threshold, support path, and rollback before scaling.

Terms used on this page

Choice architecture: The structure of options presented to the user, designed so the safe path is the default. Coined by Thaler/Sunstein.
Pre-commit hook: Audit gate that runs locally before a commit lands — catches overrides at write time, not audit time.
Postbuild audit: Audit gate that runs after the build produces an artefact — catches content-level overrides like SAC story public links.
RLS: Row-level security — restricts which rows a user can see in a query, typically based on attributes of the user (country, role, employer).
Decision owner: The accountable person who accepts the trade-off and funds the next action.
Semantic contract: The shared definition of business terms, metrics, entities, and access rules used by tools and teams.
Control plane: The layer that applies policy, access, lineage, monitoring, and escalation across the operating model.
Evidence grade: A label that separates verified fact, directional signal, modeled assumption, and field observation.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks.

Open in the app →