SAP AI agents authorization and governance: the production questions

As of 2026-11-06

Edited by Cédric Mary · How this page is made

Looking for a SAP AI consultant? Cédric Mary, SAP AI & Analytics Architect & Team Lead, takes SAP Business AI, Joule and Business Data Cloud missions.

Why it matters now

Agents were the single largest subject of SAP TechEd 2026 (Berlin, 27-28 October): 318 of the 956 knowledge units we extracted from the session material mention agents, and 109 of the 531 audience questions did. The governance questions were concrete, not philosophical: how an agent inherits only the end user's authorizations when it reads through a knowledge graph or a vector search; whether tasks and permissions sit on the service instance or on the key; how to see which user or agent is behind an MCP call; how to monitor an agent's behaviour, not only its registration.

The regulatory clock moved but did not stop. The EU Digital Omnibus pushed stand-alone high-risk obligations under Annex III from 2 August 2026 to 2 December 2027, and product-embedded ones to 2 August 2028; the transparency duties of Article 50 have applied since 2 August 2026. Our feed of SAP-related news between 19 October and 5 November 2026 carried 39 items on governance or sovereignty out of 300, including the general availability of Cohere's North agentic AI platform for regulated industries on the SAP Business AI Platform, announced on 3 November.

On the demand side the market has not priced this skill yet: AI governance appears in 0.6 % of the roughly 1,900 live SAP analytics adverts with skills we held on 16 October 2026, against 4.1 % for agentic AI. Whoever learns to design the authorization model of an agent is early.

Decision guide by situation

You deploy an SAP-delivered agent inside a cloud application — The agent runs under the application's own authorization objects; your work is scoping which users may invoke it, reading the AI Agent Hub classification, and confirming which actions are propose-only versus executed.

You build a custom agent in Joule Studio that reads S/4HANA data — Design principal propagation end to end before the first demo: the identity that reaches the backend must be the user's, not a technical user with wide rights. Check the destination configuration and whether the knowledge graph or vector layer filters by that identity.

Your agent writes: creates, posts, releases — Treat it as a transactional interface. Write actions go through released APIs under Clean Core rules, with a human approval step for anything irreversible and a transport story for the agent definition itself.

You run agents from a non-SAP platform against SAP — The agent gateway is the SAP-side control point; MCP and A2A are the protocols. Decide where the audit log lives, because two platforms will each claim half of it.

You are a partner proposing agents in an RFP — Put the guardrail design and the risk classification in the bid. A question from the TechEd floor made the point: transformation risk is fixed at contract stage, not discovered in delivery.

Options compared

Standard agent, used as shipped — Control: SAP's · Effort: configuration and role scoping · Risk: low, but behaviour changes with SAP releases.

Standard agent, extended — Control: shared · Effort: skill design and testing · Risk: medium; the extension inherits the standard's authorization model and must not widen it.

Custom agent in Joule Studio — Control: yours · Effort: tools, destinations, propagation, evaluation, lifecycle · Risk: highest; also the only option that fits a process SAP has not covered.

Third-party agent through the agent gateway — Control: split · Effort: gateway policy, identity federation, dual logging · Risk: medium; strongest when the business already standardised on another agent platform.

What shipped and what is announced

Available: SAP AI Agent Hub in SAP LeanIX (generally available); Joule Studio (GA rolling out in phases).

Announced, not available: SAP Enterprise AI Gateway (GA planned for Q1 2027); AI Governance Assistant in SAP AI Agent Hub (GA planned for Q4 2026); SAP Knowledge Graph on customer data (GA planned for Q1 2027); Design and run n8n workflows in Joule Studio (GA planned for Q1 2027). A date here is a plan, not a commitment.

Slipped or unconfirmed: Agent gateway for third-party agents (A2A) (SAP sources differ: not yet GA (SAP Architecture Center, 26 October 2026), phased (SAP Innovation News Guide, 27 October 2026), GA (SAP News, 28 October 2026)).

In transition: the orchestration service version 1 end date was moved to 31 December 2026 (SAP What's New, 3 November 2026). Custom skills built on the classic Joule Studio edition need a migration decision before then.

Pitfalls

A technical user with broad rights behind the agent because propagation was hard to set up on the demo tenant: the demo works, the audit fails.

Treating the AI Agent Hub registration as governance. It is an inventory and a classification; monitoring of behaviour, permissions and failures is a separate design.

Counting on the Enterprise AI Gateway (GA planned for Q1 2027) for a project that goes live before it. Design on the agent gateway that exists.

Confusing the two gateways in a proposal. They are two products with different scopes; their exact relationship is not published.

Leaving the write path undefined. An agent that can post documents without a released API or an approval step is a Clean Core violation with an AI label.

Letting the agent definition live only on a tenant: versioning and promotion across development, test and production were asked about at TechEd because they are not solved by default.

What to do Monday morning

List every agent in use or in pilot, with the identity it runs under and the actions it can execute; this inventory is the first artefact a regulator or an auditor will ask for.

For each custom agent, write the authorization path on one page: user, Joule, gateway, destination, backend, and where it narrows.

Decide the approval rule for write actions and encode it in the agent, not in a policy document.

Put the orchestration version 1 deadline of 31 December 2026 and the Enterprise AI Gateway status (GA planned for Q1 2027) in the programme plan, as dates to verify monthly.

Name the owner of the agent log. Then read our module on securing SAP AI agents and the concept on agent identity and the gateway, both linked below.

What we cannot assert

SAP has not published how the agent gateway and the Enterprise AI Gateway relate at runtime, nor a consumption rate for gateway traffic. At TechEd SAP named the Integration Suite enhanced and premium editions for the Enterprise AI Gateway; SAP's price list has not confirmed it in writing. The EU dates come from legal commentary on the adopted Omnibus; confirm them in the Official Journal before putting them in a contract.

Frequently asked

Does an SAP agent automatically respect the end user's authorizations?

Not automatically for custom agents. SAP-delivered agents run inside the application's authorization model; a custom agent respects the user's rights only if identity is propagated to the backend and the grounding layer filters by it. That design is the customer's.

Is the AI Agent Hub the same as the agent gateway?

No. The hub inventories and classifies agents from SAP and other vendors; the gateway is the runtime control point for identity and policy between agents and tools. A third product, the Enterprise AI Gateway in Integration Suite, is announced (GA planned for Q1 2027).

Do we need a separate licence for agent governance?

Asked at TechEd (ST104V): SAP's answer was that the AI Agent Hub is included for all Joule Studio customers by default and that the Enterprise AI Gateway comes with the Integration Suite enhanced and premium editions. This is a speaker's answer, not a price list; get the entitlement in writing before the design depends on it.

What changes with the EU AI Act delay?

The stand-alone high-risk dates moved to December 2027 and August 2028; transparency duties have applied since August 2026. The delay buys design time, not exemption, and most SAP agents sit outside Annex III anyway.

Engage the editor

This guide is written by Cédric Mary, SAP AI & Analytics Architect & Team Lead. 27 years of SAP — Datasphere, Business Data Cloud, SAC Planning, Joule. Freelance or permanent · Hybrid / remote · Anywhere in EMEA.

Profile and contact

What this page is built on

• Agent identity, trust & the agent gateway in SAP — what is documented and what TechEd 2026 describes
• SAP AI Agent Hub — Vendor-Agnostic Agent Governance
• Joule Guardrails — SAP's Trust Layers for Joule and the Orchestration Service
• Agent Communication in SAP — MCP vs A2A, Hop by Hop
• EU AI Act + Schrems-II for Joule Deployments
• SAP Empowers AI Developers to Build What Matters (SAP News, 27 October 2026)
• SAP TechEd in 2026: SAP Tells Developers You Can Build the Autonomous Enterprise (SAP News, 28 October 2026)
• Agent Gateway and third-party agents, reference architecture (SAP Architecture Center, last updated 26 October 2026)

External sources

• SAP Empowers AI Developers to Build What Matters (SAP News, 27 October 2026)
• SAP TechEd in 2026: SAP Tells Developers You Can Build the Autonomous Enterprise (SAP News, 28 October 2026)
• Agent Gateway and third-party agents, reference architecture (SAP Architecture Center, last updated 26 October 2026)
• SAP Architecture Center — AI Agent Identity & Governance in SAP Landscapes (updated 12 May 2026)
• SAP Architecture Center — Agentic AI & AI Agents on SAP Business AI Platform (Agent Gateway, status caveats)
• SAP Architecture Center — SAP AI Agent Hub for Enterprise AI Governance (updated 1 Oct 2026)

Read next

• Agent identity, trust & the agent gateway in SAP — what is documented and what TechEd 2026 describes
• Securing SAP AI agents — identity, access and the agent gateway
• Joule Agents in Production — Testing and Lifecycle
• SAP AI agents: what ships, what is roadmap, and what you build
• SAP AI Agent Hub — Vendor-Agnostic Agent Governance

The other eleven challenges