Tool governance
Here the question is not which call is allowed by your systems but which is allowed by SAP: ADT is scoped as development tooling, and MCP servers built on it carry that warning without answering it. The SAP API Policy Evidence SkillSAP API Policy Evidence SkillAssesses whether a described SAP API usage aligns with the SAP API Policy, gathering live evidence from SAP's own sources and returning a sourced assessment with a stated confidence — and routing the legal questions away from itself.independent, btp gathers evidence against the policy from SAP's own sources and returns a sourced assessment with a confidence level.
Overview
Integration Suite's MCP gateway puts an agent's calls through the same API Management layer as any other consumer, so security, traffic management and routing are configured on the gateway rather than agreed with each agent.
Not covered: At the gateway. Only what passes through it is governed, and it does not answer whether a call is inside the scope SAP grants the API in the first place.
SAP publishes the policy and the platform this governs, and publishing them is not answering this capability. What changed the state is the MCP gateway, which applies the controls to an agent's own calls.
Servers that decide which system a call reaches and as which user, such as arc-mcp-hubarc-mcp-hubA hub on SAP BTP that puts several arc-1 instances, one per SAP system, behind one login and a route each, exchanging the caller's token through a destination so each system still sees the real user.independent, btp, and an assessment of that scope question, citing what it found and how confident it is; only SAP, a contract or SAP support can decide it bindingly, and the skill here routes the question there rather than answering it.
Policy
PolicySAP API Policy 4.2026a§ 1.1, 1.2, 2.2.2, 3AlwaysAn agent tool calls SAP APIs, or a governance workflow assesses whether a proposed SAP API use is within the policy's documented-use boundary.
- § 1.1 Published APIs. Published APIs are made available for the documented purposes identified by SAP, including integration, extensions and data exchange.
- § 1.2 Non-Published APIs. Customer and third-party applications must not access non-published APIs except where documentation permits it or SAP otherwise authorizes it.
- § 2.2.2 AI call sequences and data extraction. Outside SAP-endorsed architectures, data services or expressly identified pathways, the policy prohibits specified agentic API use and systematic or large-scale extraction.
- § 3 Monitoring and remedies. SAP states that it may monitor API use and take enforcement actions when use does not comply with the documentation and policy.
Technical controls decide what an agent can call; the SAP API Policy separately governs whether the API is published for the intended use and identifies special AI-call and extraction cases. An evidence-gathering tool can assess against that policy but cannot issue a binding compliance decision.
SAP API Policy 4.2026a →Artifacts
Content
Group by18 of 18 pieces
Piece, what it offers
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
From APIs to Agent Tools: How MCP Gateway changes what Integration meansFrom APIs to Agent Tools: How MCP Gateway changes what Integration meansThe opening session of the Devtoberfest 2026 integration track, in which two product managers for SAP Integration Suite set out why the suite puts an MCP gateway between agents and backend systems, and then build one. The demo turns an HTTP endpoint and its OpenAPI specification into MCP tools on the integration cell runtime, does the same on top of an existing API-centric integration, and shows the policies tab where authentication through an external provider, quotas, spike arrest and IP filtering sit, plus the trace of the JSON-RPC calls in monitoring and the agent they are earmarked against in analytics. That is where the serve your application over MCP and tool governance edges hold; RFCs and BAPIs as sources are stated as supported, and MCP federation, custom domains and edge integration cell as roadmap.SAP Developers, published 2026-09-23
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Show 10 more
Building MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectBuilding MCP Servers with SAP Integration Suite: What to Design, Not Just How to ConnectArgues that the tool design, not the connection, is the hard part of putting an API in front of an agent. Works one request — create a customer — through eight endpoint-shaped tools, where the agent carries ids between calls and rebuilds the business rules each run, then through a single intent-shaped create_customer that hides the sequence; and says what separates the two: a business operation for a name, parameters a caller can supply without a lookup, the rules in the server rather than the prompt, and a description written for an agent choosing a tool. The SAP Integration Suite half is short — three creation paths, an iFlow behind the API artifact when a tool has to cross systems — and it closes on a checklist to run before publishing.published 2026-07-07
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the LaptopARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the LaptopThe BTP deployment of ARC-1: one Cloud Foundry app per SAP system, reached by MCP clients through XSUAA and reaching the backend through the SAP Destination service, the SAP Connectivity service and Cloud Connector, with a BasicAuth destination for startup probing and a Principal Propagation destination for per-user requests, and SAP_PP_STRICT=true so a propagation problem fails instead of falling back to the shared user. Tool governance is the three gates it spells out, the server ceiling set by environment variables, the user's permission from XSUAA role collections, OIDC scopes or API-key profiles, and the SAP backend authorisation, all of which must allow an action, and the staged rollout from read-only to writes in $TMP, then selected packages, then transport writes. It recommends the MTA deployment over Docker on Cloud Foundry or a buildpack push, treats BTP ABAP Environment as a separate service-key scenario with no Cloud Connector, and is not a full setup guide: the commands are left to the ARC-1 deployment docs.published 2026-04-29
ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the Laptop
arc-1 has been through 3 major lines since this was published: 0.8 (2026-05), 0.9 (2026-05), 1 (2026-07). Affects A recipe.
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Agentic AI Security & GovernanceAgentic AI Security & GovernanceNames seven threat categories agentic AI introduces beyond ordinary application security: prompt injection, excessive agency, supply-chain and model-integrity compromise, memory poisoning, improper output handling, resource abuse and agent-to-agent communication poisoning. Its answer is a defence-in-depth structure of security controls, input validation, privilege management, supply-chain checks, memory segmentation, output validation, execution quotas, secure communication, paired with governance and oversight: audit logging, explainability, human-in-the-loop review, fairness assessment and continuous monitoring. States the reason plainly: an agent decides, chains actions across turns, keeps memory between them and can act on real systems, a different risk profile from a single request-response call. That is the authorisation and audit-trail question tool governance is named for.
OData entity as a governed query surface for agents, not a toolOData entity as a governed query surface for agents, not a toolAn OData entity, generated from the annotations a service already carries, as the surface an agent queries over SAP data: filterable, selectable and sortable fields, authorisation injected on the server side, and a bound query cost, instead of the entity as a tool. SAP's abstract sets this against the MCP gateway in SAP Integration Suite, where exposing an API is the easy part and getting an agent to pick the right one is not, which is the tool governance concern read through OData. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Aleksandr Ivanov and Evgenii Shirokikh, written here from SAP's abstract; the recording is not yet published.
Govern AI-supported actions across enterprise systemsGovern AI-supported actions across enterprise systemsGoverning what an AI agent may do once it takes business actions across enterprise systems, which is the Tool governance concern, with SAP Integration Suite as the place it is enforced. The abstract lists the mechanisms, scoped APIs, event-driven workflows, runtime policy enforcement, exception handling and observability across SAP and third-party systems, and names no Integration Suite feature behind any of them. A TechEd 2026 session (Tuesday 27 October, Berlin; also IN200V, virtual), presented by Finny Babu and Piyush Gakhar, written here from SAP's abstract; the recording is not yet published.
Model context protocol (MCP) unlocked: Enable governed access to AI agentsModel context protocol (MCP) unlocked: Enable governed access to AI agentsThe MCP Gateway in SAP Integration Suite: the place policy, security and analytics are applied to a curated set of MCP tools before an AI agent reaches enterprise tools and APIs through it, tool governance done in the integration layer and agent access to your systems routed through one gateway. The abstract names the gateway and its three functions and does not say how tools are curated, which policies exist or how the agent authenticates. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Bruno Renzo, Emily Mui, Markus Winter and Sunny Kapoor, written here from SAP's abstract; the recording is not yet published.
Intelligent, governed, and agentic integrations with SAP Integration SuiteIntelligent, governed, and agentic integrations with SAP Integration SuiteSAP Integration Suite positioned as the control plane that connects and governs agentic workflows across SAP and third-party systems, set against the abstract's claim that exposing back ends directly to AI brings security, compliance and cost risks. That governing role is the Tool governance concern; the abstract promises recent innovations and names none. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Finny Babu and Piyush Gakhar, written here from SAP's abstract; the recording is not yet published.
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07
Graph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphGraph on Integration Suite: Simplifying Multi-API Data Retrieval with Unified Business Data GraphA hands-on walkthrough of Graph, the API Management feature of SAP Integration Suite also called Business Data Graphs, which exposes several OData APIs as one connected data model behind a single OData V4 or GraphQL endpoint. It covers enabling the capability and its Graph.KeyUser and GraphNavigator.Viewer role collections, creating BTP destinations and a service key for an S/4HANA system, then building a Business Data Graph over the Sales Order and Business Partner APIs so a mirrored SoldToParty association returns both in one call, in place of the two OData requests a Cloud Integration Content Enricher would otherwise merge.published 2026-01-09
SAP PI Migration to BTP Integration Suite Patterns and learning experiencesSAP PI Migration to BTP Integration Suite Patterns and learning experiencesWalks through the integration patterns an SAP PI migration project moved onto SAP Cloud Integration iFlows — API Management proxies fronting calls into on-premise SAP systems over XI/SOAP via Cloud Connector, SFTP transfers, and eventing routes — and the operational lessons from running it: sizing JMS queues, choosing exactly-once JMS queues over Cloud Integration's Data Store for XI receiver adapters and at-least-once JMS for XI sender adapters, and workarounds for gaps in the migration tooling. The API Management proxies handle JWT validation against a non-SAP identity provider, IP filtering and OData-to-OpenAPI conversion in front of the iFlows.saikrishna_kalivarapu2, published 2024-12-04
Show 2 more
Information Map – Introduction Series: Graph in SAP Integration SuiteInformation Map – Introduction Series: Graph in SAP Integration SuiteIntroduces Graph, an enhancement to API Management within SAP Integration Suite that gives developers a single API onto an organisation's business systems, modelled as one semantically connected business data graph, later renamed API Composition. Splits the work between an administrator, who enables SAP BTP destinations to the backend systems and builds the business data graph, and a developer, who explores it in the Graph Navigator tool and builds an application against the resulting Graph API.published 2024-02-21
Road map for SAP Integration Suite: What ships next across all capabilitiesRoad map for SAP Integration Suite: What ships next across all capabilitiesSAP's road map for SAP Integration Suite across its capability areas: API Management, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.
A Clearer View of Your SAP Integrations Under the New API PolicyA Clearer View of Your SAP Integrations Under the New API PolicyThe SAP API Policy Evidence Skill assesses one SAP interface or usage pattern at a time against SAP API Policy v.4.2026a, reading evidence from five MCP servers, among them servers for the Business Accelerator Hub and SAP Notes, mcp-sap-docs and a read-only ARC-1, and returns one of four labels with a confidence level, an evidence table, residual risk and questions for SAP. It gives no compliant or not compliant answer on purpose, because SAP's FAQ (Q49) declines to publish a binding decision matrix, and it sends legal, commercial and roadmap questions to SAP and lowers its confidence when a source is not connected. Four sample runs show the method, among them ODP-RFC extraction labelled likely not aligned under SAP Note 3255746 and the same API_SALES_ORDER_SRV assessed differently for an autonomous agent behind a custom gateway and for a Boomi middleware flow; the SAP Notes and Business Accelerator Hub servers read SAP sites through a browser login, which the post says to use at your own risk.published 2026-06-02
Details
Coverage
Designs that place it
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform Layersingle governed gateway for agent traffic
For your agent
- Ref
capability:tool-governance- JSON
- /capabilities/tool-governance.json
- MCP
- Connecting an agent