{"ref":"capability:tool-governance","page":"/capabilities/tool-governance","json":"/capabilities/tool-governance.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"tool-governance","name":"Tool governance","domain":"ai-and-agents","ecosystems":["cap","abap","btp"],"universal":true,"description":"Controlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.","short":"Controlling what an agent may call, with an audit trail","core_coverage":{"state":"core-and-community","assessed_at":"2026-09-14","relationship":"unassessed","note":"SAP's [API Management](artifact:btp-api-management) serves CAP and provides it, and community CAP artifacts such as [a2a-plugin](artifact:a2a-plugin) and [cds-agents](artifact:nagarjundas1994-aiagents-cds-agents) provide it too. No SAP page has been checked that states a core position for the CAP runtime itself, so what_core_does is left empty."},"gap":{"open_since":"2026-05-01","note":"Exposing services over MCP is solved. Deciding which agent may call what, as which user, is not."},"coverage_by_ecosystem":{"abap":{"state":"community-only","assessed_at":"2026-09-10","where_it_stops":"At the tools. A guard decides what may be called against which system; it says nothing about whether the call is inside the scope SAP grants the API in the first place — that question is asked on the BTP door.","note":"Community servers decide what an agent may call before the call happens: allow-lists and an audit log in [Maherd18/sap-mcp-server](artifact:maherd18-sap-mcp-server) and [pyrfc-mcp](artifact:yassinbahri-pyrfc-mcp), which system a call reaches and as which user in [arc-mcp-hub](artifact:arc-mcp-hub), and principal propagation in [bw-modeling-mcp](artifact:dnic-dev-bw-modeling-mcp). SAP publishes the policy and the platform this governs; publishing them is not answering this capability."},"btp":{"state":"core-and-community","assessed_at":"2026-09-12","what_core_does":"Integration Suite's MCP gateway puts an agent's calls through the same API Management layer as any other consumer, so security, traffic management and routing are configured on the gateway rather than agreed with each agent.","where_it_stops":"At the gateway. Only what passes through it is governed, and it does not answer whether a call is inside the scope SAP grants the API in the first place.","community_adds":"Servers that decide which system a call reaches and as which user, such as [arc-mcp-hub](artifact:arc-mcp-hub), and an assessment of that scope question, citing what it found and how confident it is; only SAP, a contract or SAP support can decide it bindingly, and the skill here routes the question there rather than answering it.","sources":[{"url":"https://help.sap.com/docs/integration-suite/isuite-integrations-and-apis/model-context-protocol-mcp","title":"MCP Server — SAP Integration Suite, SAP Help Portal","checked":"2026-09-12","quote":"It provides capabilities such as security, traffic management, routing, and multi-protocol connectivity while enabling governed access to enterprise systems"}],"note":"SAP publishes the policy and the platform this governs, and publishing them is not answering this capability. What changed the state is the MCP gateway, which applies the controls to an agent's own calls.","relationship":"unassessed"}},"framing_by_ecosystem":{"abap":{"description":"The governance question in ABAP is which system an agent is pointed at, because the same tool call is routine against Dev and unacceptable against production. [SuperClaude for SAP](artifact:babamba2-superclaude-for-sap) makes the landscape explicit — profiles per system, hot-switched in session — and enforces write protection on QA and production in two places, a client-side hook and a guard inside the MCP server, so defeating one does not defeat the other."},"btp":{"description":"Here the question is not which call is allowed by your systems but which is allowed by SAP: ADT is scoped as development tooling, and MCP servers built on it carry that warning without answering it. [The SAP API Policy Evidence Skill](artifact:marianfoo-sap-api-policy-skill) gathers evidence against the policy from SAP's own sources and returns a sourced assessment with a confidence level."}},"coverage_by_flavor":{"abap-cloud":{"state":"community-only","assessed_at":"2026-09-14","where_it_stops":"At the tools, exactly as in standard ABAP: [SuperClaude for SAP](artifact:babamba2-superclaude-for-sap) names S/4HANA Cloud Public and Private Edition in the same sentence as the on-premise profiles it also covers, and its two-layer guard blocks writes by system profile rather than by development model, so ABAP Cloud does not change who may call what.","sources":[{"url":"https://github.com/babamba2/superclaude-for-sap","title":"babamba2/superclaude-for-sap — README","checked":"2026-09-14","quote":"Claude Code plugin for SAP ABAP development — SAP ECC / S/4HANA On-Premise / S/4HANA Cloud (Public & Private)"}],"note":"The provider is independent, the same one and the same claim as standard ABAP: nothing in its README describes different guard behaviour for ABAP Cloud, so the door's assessment carries over rather than narrowing to not-applicable, which is reserved for a concern the flavor does not have at all. No SAP source was found stating a position on this concern for ABAP Cloud specifically; what ABAP Cloud restricts is which objects and APIs exist to call in the first place ([abap-extensibility](capability:abap-extensibility)), not who may call them or from which system, and that stays open ground here as it does for standard ABAP."}},"normative_relevance":[{"instrument":"instrument:sap-api-policy-v4-2026a","prominence":"prominent","sections":["1.1","1.2","2.2.2","3"],"applies_when":"An agent tool calls SAP APIs, or a governance workflow assesses whether a proposed SAP API use is within the policy's documented-use boundary.","note":"Technical controls decide what an agent can call; the SAP API Policy separately governs whether the API is published for the intended use and identifies special AI-call and extraction cases. An evidence-gathering tool can assess against that policy but cannot issue a binding compliance decision.","applies_to":{"ecosystems":["btp"]},"sources":[{"url":"https://help.sap.com/doc/sap-api-policy/latest/en-US/API_Policy_latest.pdf","title":"SAP API Policy v.4.2026a","checked":"2026-09-16","quote":"verify that each endpoint for Documented Use is a Published API"}]}],"history":[{"date":"2026-09-10","field":"ecosystems","from":"cap","to":"cap, abap, btp","reason":"Two governance answers entered from the sap-ai-mcp-servers sweep — a two-layer write guard on ABAP system profiles, and an evidence-based assessment against the SAP API Policy — and the capability existed on the CAP door alone."},{"date":"2026-09-10","field":"description","from":"Controlling which CAP services an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.","to":"Controlling what an agent may call, with which authorisations, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.","reason":"The first clause said \"which CAP services\", which was true when CAP was the only door. Governing what an agent may call is the concern; which CAP services is one ecosystem's version of it."},{"date":"2026-09-12","field":"coverage_by_ecosystem.btp","from":"community-only, one independent provider","to":"core-and-community, with what_core_does from the Integration Suite MCP gateway","reason":"SAP Integration Suite entered the corpus with a tool-governance edge, so community-only was no longer a true reading of the door. The evidence sentence that was in where_it_stops describes the community skill and moved to community_adds, where the core's own boundary can be stated."},{"date":"2026-09-14","field":"core_coverage","from":"unmapped","to":"community-only","reason":"The validator now rejects an unmapped reading on a door with its own providers, and two independent CAP artifacts provide this capability. The Node.js map read them as present while the door showed a gap."},{"date":"2026-09-14","field":"coverage_by_flavor.abap-cloud","from":null,"to":"community-only","reason":"SuperClaude for SAP's own flavors entry states abap-cloud with the identical quote it states standard-abap with, and its README describes no guard behaviour that differs between the two, so the ABAP door's community-only reading carries over to the flavor. The concern is not classic-only — unlike SAP GUI screens or unreleased objects, which system to call is a question ABAP Cloud is asked too — so not-applicable does not fit, and the validator forbids it on a flavor a stated provider covers."},{"date":"2026-10-26","field":"description","from":"with which authorisations, with which authorisations,","to":"with which authorisations,","reason":"Reassessed against the graph (check:capabilities): a duplicated clause removed."},{"date":"2026-10-26","field":"core_coverage.state, core_coverage.note","from":"community-only; Two independent CAP artifacts provide it; the note that was unmapped predates their entry...","to":"core-and-community; SAP's API Management serves CAP and provides it, and community CAP artifacts such as a2a-plugin and cds-agents provide it too...","reason":"Reassessed against the graph (check:capabilities): API Management, an SAP-official provider, serves the CAP door, so community-only no longer holds; the note also counted providers."},{"date":"2026-10-26","field":"coverage_by_ecosystem.abap.note","from":"One provider and it is independent, so community-only is a assessment of the corpus...","to":"Community servers decide what an agent may call before the call happens: allow-lists and an audit log, which system a call reaches and as which user, principal propagation...","reason":"Reassessed against the graph (check:capabilities): the note counted providers; the state stays community-only and the note now names the kinds the fresh providers add."},{"date":"2026-10-26","field":"coverage_by_ecosystem.btp.community_adds","from":"An assessment of that scope question, citing what it found...","to":"Servers that decide which system a call reaches and as which user, such as arc-mcp-hub, and an assessment of that scope question...","reason":"Reassessed against the graph (check:capabilities): a per-system, per-user gate is a kind the text did not name."},{"date":"2026-10-26","field":"framing_by_ecosystem.btp.description","from":"several servers in this corpus carry that warning","to":"MCP servers built on it carry that warning","reason":"Reassessed against the graph (check:capabilities): a count of providers removed."},{"date":"2026-10-26","field":"coverage_by_flavor.abap-cloud.note","from":"One provider and it is independent, the same one and the same claim as standard ABAP...","to":"The provider is independent, the same one and the same claim as standard ABAP...","reason":"Reassessed against the graph (check:capabilities): a count of providers removed."}],"drafted_with_ai":true},"sap_delivery":{"door":"cap","all":null,"by_flavor":{"node":null,"java":null}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:a2a-plugin","name":"a2a-plugin","json":"/artifacts/a2a-plugin.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:btp-api-management","name":"API Management","json":"/artifacts/btp-api-management.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:arc-mcp-hub","name":"arc-mcp-hub","json":"/artifacts/arc-mcp-hub.json","ecosystem":"btp","origin_ring":"independent"},{"ref":"artifact:dnic-dev-bw-modeling-mcp","name":"bw-modeling-mcp","json":"/artifacts/dnic-dev-bw-modeling-mcp.json","ecosystem":"btp","origin_ring":"independent"},{"ref":"artifact:nagarjundas1994-aiagents-cds-agents","name":"cds-agents","json":"/artifacts/nagarjundas1994-aiagents-cds-agents.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:maherd18-sap-mcp-server","name":"Maherd18/sap-mcp-server","json":"/artifacts/maherd18-sap-mcp-server.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:yassinbahri-pyrfc-mcp","name":"pyrfc-mcp","json":"/artifacts/yassinbahri-pyrfc-mcp.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:marianfoo-sap-api-policy-skill","name":"SAP API Policy Evidence Skill","json":"/artifacts/marianfoo-sap-api-policy-skill.json","ecosystem":"btp","origin_ring":"independent"},{"ref":"artifact:babamba2-superclaude-for-sap","name":"SuperClaude for SAP","json":"/artifacts/babamba2-superclaude-for-sap.json","ecosystem":"abap","origin_ring":"independent"}],"samples":[],"explained_by":[{"ref":"content:devtoberfest-2026-int-31-agentic-ai-integration-suite","name":"Powering Enterprise-Ready Agentic AI with SAP Integration Suite","json":"/content/devtoberfest-2026-int-31-agentic-ai-integration-suite.json"},{"ref":"content:devtoberfest-2026-from-apis-to-agent-tools-mcp-gateway","name":"From APIs to Agent Tools: How MCP Gateway changes what Integration means","json":"/content/devtoberfest-2026-from-apis-to-agent-tools-mcp-gateway.json"},{"ref":"content:abap-mcp-let-ai-do-real-development-in-your-sap-system","name":"ABAP + MCP: Let AI Do Real Development in Your SAP System","json":"/content/abap-mcp-let-ai-do-real-development-in-your-sap-system.json"},{"ref":"content:ac-agentic-ai-and-ai-agents","name":"Agentic AI & AI Agents","json":"/content/ac-agentic-ai-and-ai-agents.json"},{"ref":"content:mcp-servers-are-the-new-z-tables","name":"MCP Servers are the New Z-Tables","json":"/content/mcp-servers-are-the-new-z-tables.json"},{"ref":"content:from-sap-integration-suite-iflow-to-mcp-tools-exposing-odata-apis-to-ai-agents","name":"From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI Agents","json":"/content/from-sap-integration-suite-iflow-to-mcp-tools-exposing-odata-apis-to-ai-agents.json"},{"ref":"content:building-mcp-servers-with-sap-integration-suite","name":"Building MCP Servers with SAP Integration Suite: What to Design, Not Just How to Connect","json":"/content/building-mcp-servers-with-sap-integration-suite.json"},{"ref":"content:ac-hana-ai-toolkit-local-mcp-server","name":"HANA AI Toolkit — Local MCP Server","json":"/content/ac-hana-ai-toolkit-local-mcp-server.json"},{"ref":"content:arc-1-on-sap-btp-secure-abap-agentic-development-beyond-the-laptop","name":"ARC-1 on SAP BTP: Secure ABAP Agentic Development Beyond the Laptop","json":"/content/arc-1-on-sap-btp-secure-abap-agentic-development-beyond-the-laptop.json"},{"ref":"content:introducing-arc-1-a-secure-adt-mcp-server-for-enterprise-sap-development","name":"Introducing ARC-1: A Secure ADT MCP Server for Enterprise SAP Development","json":"/content/introducing-arc-1-a-secure-adt-mcp-server-for-enterprise-sap-development.json"},{"ref":"content:abap-and-agentic-ai-the-hidden-problem-in-real-projects","name":"ABAP and Agentic AI: The Hidden Problem in Real Projects","json":"/content/abap-and-agentic-ai-the-hidden-problem-in-real-projects.json"},{"ref":"content:building-an-enterprise-ready-sap-ai-agent-with-open-source","name":"Building an Enterprise-Ready SAP AI Agent with Open Source","json":"/content/building-an-enterprise-ready-sap-ai-agent-with-open-source.json"},{"ref":"content:ac-agentic-engineering-for-sap-btp-extensions","name":"Agentic Engineering for SAP BTP Extensions","json":"/content/ac-agentic-engineering-for-sap-btp-extensions.json"},{"ref":"content:ac-third-party-mcp-server-access-to-sap-solutions-on-btp","name":"Third-Party MCP Server Access to SAP Solutions on BTP","json":"/content/ac-third-party-mcp-server-access-to-sap-solutions-on-btp.json"},{"ref":"content:btp-ai-bp-agentic-ai-security-governance","name":"Agentic AI Security & Governance","json":"/content/btp-ai-bp-agentic-ai-security-governance.json"},{"ref":"content:teched-2026-ct1207","name":"OData entity as a governed query surface for agents, not a tool","json":"/content/teched-2026-ct1207.json"},{"ref":"content:teched-2026-in200","name":"Govern AI-supported actions across enterprise systems","json":"/content/teched-2026-in200.json"},{"ref":"content:teched-2026-in261","name":"Model context protocol (MCP) unlocked: Enable governed access to AI agents","json":"/content/teched-2026-in261.json"},{"ref":"content:teched-2026-in813","name":"Intelligent, governed, and agentic integrations with SAP Integration Suite","json":"/content/teched-2026-in813.json"},{"ref":"content:teched-2026-xp101","name":"Building trusted applications on SAP Business AI Platform by design","json":"/content/teched-2026-xp101.json"}],"normative_context":[{"ref":"instrument:sap-api-policy-v4-2026a","name":"SAP API Policy","json":"/instruments/sap-api-policy-v4-2026a.json","prominence":"prominent","sections":["1.1","1.2","2.2.2","3"]}]}}