BrowseAll ecosystems
Everything in the atlas
12 of 2341
Domain: Security & Compliance
Signals
Content
More: 3
Group by: Capability
Domain Security & ComplianceSource Software-HeroesSource YouTube — SAP Developers playlistsSource SAP Developer CenterClear all
EntryBySignalsLast activity
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.
Use mocking to embrace auth in your domain model from the outsetUse mocking to embrace auth in your domain model from the outsetMock users locally so authorization is modelled from the first commit instead of retrofitted — the argument being that auth added late reshapes a domain model rather than sitting on top of it.SAP
BTP - Authorization ObjectBTP - Authorization ObjectWalks through building a classic ABAP authorization object for the ABAP environment — an authorization field, the object itself created in ABAP Development Tools rather than the classic SU21 transaction, and its activities (01 create, 02 change, 03 display, and others) — then wires it into a CDS role's access control with the pfcg_auth aspect on the WHERE condition, which is authorization's ABAP form: CDS access control limiting what a view entity returns to the conditions in a CDS role. The check inherits down to a consumption view and even the Data Preview, and the piece notes the WITH PRIVILEGED ACCESS addition developers use in the SQL console to bypass it while testing.Björn S., published 2026-08-07
BTP - Restriction TypeBTP - Restriction TypeWalks through creating a Restriction Type and Restriction Field for an ABAP RAP authorization object, so the values an IAM app would otherwise fix as static entries can instead be maintained per Business Role in the Fiori Launchpad. Read and Write access on the restriction still follow the activities defined on the authorization object itself (03 for read, 01/02/06 for write), and the piece shows the effect end to end: a Fiori app narrowed to only the business partners assigned on the role. This is the ABAP door's authorization mechanism made dynamic — an access decision moved from the IAM app's fixed values onto the role, without touching the underlying CDS access control.Björn S., published 2026-08-11
Developing authorizations for business users in SAP Business AI Platform, ABAP environmentDeveloping authorizations for business users in SAP Business AI Platform, ABAP environmentA Devtoberfest 2026 session that walks the places an authorization check has to be written when a RAP business object is implemented, which is the whole of the authorization edge: read restrictions as DCL access controls that become a filter at query time, a child entity inheriting its parent's conditions through an association, the projection layer inheriting rather than changing them, and the same check repeated on the draft side. The ABAP CDS edge holds on that draft half — until 2608 a draft query view was needed above the draft table so a DCL had something to attach to, while a draft table entity is already on CDS level and takes the DCL directly, as long as the associations used in the inherited conditions are redefined on it. Create, update and delete are then taken handler by handler, including the trap that instance authorization reads the buffer and so cannot see the new value a pre-check would reject, and the session closes on in local mode and privileged EML calls.published 2026-10-12
RAP - Feature Control (Part 2)RAP - Feature Control (Part 2)Implements a reusable AUTHORITY-CHECK wrapper class and wires it into a RAP behaviour implementation's Feature Control, both the static global check on Create and the instance-based, partner-scoped checks on Update and Delete, so that an authorization decision greys out an action in the Fiori UI rather than only rejecting it after the save. Part two of the author's Sales App series, it also flags a newer, more strictly typed Feature Control flag SAP introduced since the first article, since using the older type produces a warning and can leave a flag silently without effect.Björn S., published 2026-08-14
CAP: The Road Ahead - Simplicity in an AI EraCAP: The Road Ahead - Simplicity in an AI EraDevtoberfest 2026 session CAP10, from the head of SAP's Cloud Application Programming Model: forty minutes of live building rather than slides, on the argument that the cheapest code in an AI project is code nobody has to generate. Claude Code builds an invoice-matching workspace from cds init onwards, and each step is one the framework answers rather than the agent: a 42-line domain model that @sap/cds serves as OData and Fiori elements with a status flow, data privacy and change-tracking annotations that produce audit log entries in the console and would reach the SAP Audit Log service once deployed, an imported S/4HANA supplier data product, and semantic matching from a local embedding model after @cap-js/ai is added. The last three steps are annotations: @mcp beside @odata turns the service into an MCP server that a second Claude session queries through @cap-js/mcp, an agent annotation adds the A2A protocol with an agent card and an audit log entry for the agent task, and a skill file gives the agent the matching policy.SAP Developers, published 2026-09-25
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
🔴 Your Agent Wants to Call SAP. Now What?🔴 Your Agent Wants to Call SAP. Now What?Devtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API Management inside SAP Integration Suite, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCP and Rate limiting hold. For totals across all sales orders they send the agent to SAP Business Data Cloud instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.SAP Developers, published 2026-09-30
Create an MCP Server for Enterprise AI AgentsCreate an MCP Server for Enterprise AI AgentsWraps the preceding supply-risk graph from API Composition as an MCP server in Integration Suite, with API Management activated as a prerequisite. The walkthrough selects retrieval tools, deploys on Integration Cell, publishes a product in Developer Hub, creates an agent subscription and invokes the tools in MCP Inspector; its companion tutorial uses mock backends.Shyam, published 2026-09-23
MCP Gateway in Practice: Architecture, configuration, and hands-onMCP Gateway in Practice: Architecture, configuration, and hands-onA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration Suite: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API Management, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systems edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.SAP Developers
Powering Enterprise-Ready Agentic AI with SAP Integration SuitePowering Enterprise-Ready Agentic AI with SAP Integration SuiteA Devtoberfest 2026 session (INT-31) from SAP Integration Suite product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API Management, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposure and the tool governance the edges rest on. Three AI features inside Cloud Integration follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.SAP Developers, published 2026-10-07