BrowseAll ecosystems
Everything in the atlas
34 of 2341
Domain
Signals
Content: A reference
More: 5
Group by: Capability
Offers A referenceSource SAP Developer CenterSource SAP websiteSource Software-HeroesSource SAP Architecture CenterSource SAP BTP AI Best PracticesClear all
EntryBySignalsLast activity
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
Model Context Protocol (MCP)Model Context Protocol (MCP)Frames the Model Context Protocol as the answer to an M-times-N integration problem: one shared protocol turns M agents and N tools into M plus N connections, and one server can be called by any compliant agent. On SAP BTP its implementation section lists an SAP MCP Hub as a no-code way to expose enterprise tools, SAP Integration Suite's MCP Gateway as what it calls the governed path for exposing SAP and non-SAP APIs as MCP-compliant tools, custom SDK-based servers, SAP's MCP servers for development, and an MCP adapter for CDS as a CAP plugin marked coming soon. That is the ground MCP servers covers; for security it points at a separate page.
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Explore your Hyperscaler data with SAP Business Data CloudExplore your Hyperscaler data with SAP Business Data CloudSAP's map of the ways data held on hyperscaler and partner platforms is joined with SAP data in SAP Business Data Cloud, with a sub-page each for AWS, Azure, Google Cloud, Databricks and Snowflake. It sets four modes side by side: BDC Connect shares data products in both directions over the Delta Sharing protocol from the object store layer, while in the SAP Datasphere layer federation reads remote tables in place, Replication Flows copy SAP data out to stores such as Amazon S3 or Google BigQuery, and Data Flows import files and transform them into Datasphere tables, the last three being the ground loading a warehouse covers. The Snowflake and BigQuery connectors are dated to 2026 releases, and a closing page lists what slows federation, from source and tenant in different regions to queries that do not filter and aggregate at the source.published 2026-05-08
Federated Machine Learning with SAP DatasphereFederated Machine Learning with SAP DatasphereSAP's design for training predictive models on an external machine learning platform against SAP Datasphere data that is not replicated to that platform. The open-source FedML Python library runs in the platform's notebook, connects to Datasphere over Python/SQLDBC and reads the analytic models in which Datasphere unifies SAP and non-SAP sources; a trained model can then be deployed to SAP AI Core, or in several sub-pages to SAP BTP, Kyma runtime, which is the predictive models path where training happens outside SAP. Sub-pages cover Amazon SageMaker, Azure Machine Learning, Google Vertex AI, Databricks, NVIDIA RAPIDS on GPUs and IBM watsonx.published 2025-01-23
Explore your Hyperscaler data with SAP Business Data CloudExplore your Hyperscaler data with SAP Business Data CloudSAP's map of the ways data held on hyperscaler and partner platforms is joined with SAP data in SAP Business Data Cloud, with a sub-page each for AWS, Azure, Google Cloud, Databricks and Snowflake. It sets four modes side by side: BDC Connect shares data products in both directions over the Delta Sharing protocol from the object store layer, while in the SAP Datasphere layer federation reads remote tables in place, Replication Flows copy SAP data out to stores such as Amazon S3 or Google BigQuery, and Data Flows import files and transform them into Datasphere tables, the last three being the ground loading a warehouse covers. The Snowflake and BigQuery connectors are dated to 2026 releases, and a closing page lists what slows federation, from source and tenant in different regions to queries that do not filter and aggregate at the source.published 2026-05-08
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Medallion Reference Architecture for Big Data Processing in SAP HANA CloudMedallion Reference Architecture for Big Data Processing in SAP HANA CloudSAP's medallion layout for SAP HANA Cloud: structured, semi-structured and unstructured data lands raw in HANA Cloud, data lake files as the bronze layer, is cleansed into a common structure in silver, held in data lake files or the HANA database, and is curated and read-optimised in gold, from where it can also be exposed as a Delta Share. The staged path from raw to consumable is the ground loading a warehouse covers, with Spark jobs and SAP Datasphere data flows named as ways to move data between layers and SAP Analytics Cloud among the consumers of gold. It leaves the ingestion method open, to be chosen by source, freshness and performance, and names no pipeline or schedule beyond that.published 2025-04-03
SAP HANA Cloud as an Esri GeodatabaseSAP HANA Cloud as an Esri GeodatabaseSAP's design for running an Esri ArcGIS Enterprise geodatabase inside SAP HANA Cloud, so that geometries and SAP business data sit in one database and are joined in a HANA calculation view, which is the spatial part of graph, spatial and document data. It traces three personas: an analyst in ArcGIS Pro building query layers over that view, a developer whose CAP application models spatial types such as ST_Point in CDS, and an analyst using a Fiori app on top of such an application. The deployment advice stops at placement: ArcGIS Server and HANA Cloud go in the same region and availability zone, because Esri's certified architectures allow under 5 milliseconds of network latency between them.published 2025-03-25
SAP HANA Cloud as an Esri GeodatabaseSAP HANA Cloud as an Esri GeodatabaseSAP's design for running an Esri ArcGIS Enterprise geodatabase inside SAP HANA Cloud, so that geometries and SAP business data sit in one database and are joined in a HANA calculation view, which is the spatial part of graph, spatial and document data. It traces three personas: an analyst in ArcGIS Pro building query layers over that view, a developer whose CAP application models spatial types such as ST_Point in CDS, and an analyst using a Fiori app on top of such an application. The deployment advice stops at placement: ArcGIS Server and HANA Cloud go in the same region and availability zone, because Esri's certified architectures allow under 5 milliseconds of network latency between them.published 2025-03-25
Explore your Hyperscaler data with SAP Business Data CloudExplore your Hyperscaler data with SAP Business Data CloudSAP's map of the ways data held on hyperscaler and partner platforms is joined with SAP data in SAP Business Data Cloud, with a sub-page each for AWS, Azure, Google Cloud, Databricks and Snowflake. It sets four modes side by side: BDC Connect shares data products in both directions over the Delta Sharing protocol from the object store layer, while in the SAP Datasphere layer federation reads remote tables in place, Replication Flows copy SAP data out to stores such as Amazon S3 or Google BigQuery, and Data Flows import files and transform them into Datasphere tables, the last three being the ground loading a warehouse covers. The Snowflake and BigQuery connectors are dated to 2026 releases, and a closing page lists what slows federation, from source and tenant in different regions to queries that do not filter and aggregate at the source.published 2026-05-08
Medallion Reference Architecture for Big Data Processing in SAP HANA CloudMedallion Reference Architecture for Big Data Processing in SAP HANA CloudSAP's medallion layout for SAP HANA Cloud: structured, semi-structured and unstructured data lands raw in HANA Cloud, data lake files as the bronze layer, is cleansed into a common structure in silver, held in data lake files or the HANA database, and is curated and read-optimised in gold, from where it can also be exposed as a Delta Share. The staged path from raw to consumable is the ground loading a warehouse covers, with Spark jobs and SAP Datasphere data flows named as ways to move data between layers and SAP Analytics Cloud among the consumers of gold. It leaves the ingestion method open, to be chosen by source, freshness and performance, and names no pipeline or schedule beyond that.published 2025-04-03
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Designing Event-Driven ApplicationsDesigning Event-Driven ApplicationsSAP's guidance for building applications on event-driven architecture with BTP services. It sets out a two-part strategy: SAP Cloud Application Event Hub for events between SAP cloud applications and BTP, and the SAP Integration Suite family for dedicated event brokers in hybrid landscapes. Its sub-pages then cover EDA patterns, design considerations and AWS and Azure IoT integration. The framing is integration between systems; the in-process outbox and queueing inside one CAP service are not its subject.published 2025-10-10
Application to Application IntegrationApplication to Application IntegrationSAP's reference architecture for application-to-application integration, where messages carrying transactional data such as sales orders pass between business applications in near real time and each one triggers the next process step. When the sender's and receiver's APIs do not match, Cloud Integration in SAP Integration Suite sits between them to determine receivers, filter, map structures and convert protocols, which is the ground of integration flows; SAP Connectivity service, Cloud Connector and SAP Destination service reach on-premise receivers, and the edge integration cell runtime keeps processing inside a customer-managed landscape where compliance requires it. Direct exchange without middleware is allowed when the two APIs already align, asynchronous communication is the default the page states, and it is drawn at the level of the pattern, following SAP's Integration Solution Advisory Methodology, without designing any one flow.published 2024-08-01
Business to Business IntegrationBusiness to Business IntegrationSAP's reference architecture for business-to-business integration, the exchange of business documents with customers, suppliers and other trading partners over agreed standards such as EDIFACT, ANSI X.12 and IDoc and protocols such as AS2. Its design-time steps are Cloud Integration in SAP Integration Suite, the predefined content of SAP Business Accelerator Hub, and Integration Advisor, which defines message implementation and mapping guidelines and generates runtime artifacts from them; Trading Partner Management then turns partner profiles into agreements pushed to the Partner Directory, and generic integration flows on Cloud Integration read those agreements at runtime to exchange messages with each partner. The alternatives it names are API-based exchange where an industry has standardised its APIs, and SAP Business Network with the managed gateway for spend management in place of connecting partners one by one.published 2024-08-01
Connect Business Processes with SAP Master Data IntegrationConnect Business Processes with SAP Master Data IntegrationSAP's reference architecture for keeping master data such as materials, business partners and cost centres consistent across applications with SAP Master Data Integration, a central hub that stores every change in an event log and distributes it to the solutions that consume it. Cloud Integration in SAP Integration Suite carries what the hub does not reach, SAP solutions it does not yet support and third-party or on-premise systems, through an SAP Master Data Integration adapter, which is where the design meets integration flows; newer SAP S/4HANA releases connect to the hub without it. Consolidation, data quality and central governance are outside the architecture and left to SAP Master Data Governance, and SAP Master Data Integration itself has no entry in the atlas yet.published 2024-08-01
Edge Integration Cell on HyperscalersEdge Integration Cell on HyperscalersSAP's architecture for Edge Integration Cell, the runtime of SAP Integration Suite that executes integration flows in a Kubernetes cluster the customer runs, while design, monitoring and governance stay on SAP BTP and the runtime reaches BTP over outbound-only channels. The main page gives the reasons SAP names for it: data residency, security policies that forbid inbound access, and latency to a distant BTP region. Three sub-pages draw the same setup on AWS, Azure and Google Cloud, each with a private network across three availability zones, a managed Kubernetes cluster, managed PostgreSQL and Redis, sizing left to an SAP Note, and each says it outlines a small production deployment to be treated as a starting point.published 2025-04-18
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform LayerThe platform layer of SAP's North Star architecture, the chapter that says where agents run and what a developer builds them with. It names an AI Golden Path built on the SAP Cloud Application Programming Model, the ABAP Cloud development model with RAP and the SAP Fiori design system, and a managed agent runtime on SAP BTP that is designed to provide software development kits for building agents in any framework, an agent sandbox, container-hosted execution, a skills registry and continuous evaluations, which is the ground agent tooling covers. Agents are extended without changing their code through four patterns, the first of them tool extensibility through the Model Context Protocol, the concern MCP servers is named for; the process-layer chapter adds that a pro-code path with a standardised agent SDK and a prompt-driven path through the Joule Studio solution produce the same code artifact on the same runtime. It describes a design SAP intends rather than products that exist, and the SDK and the registry it names have no entry here yet.published 2026-05-13
AI-native North Star architecture — Platform Layer
Agent tooling changed in @cap-js/agents 0.9.1, 2026-08-14. Affects A reference.
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
Data MaskingData MaskingData masking replaces identifiable or confidential text in a prompt with placeholders such as <Person_0> or <Organization_1> before it reaches a large language model, using pattern matching and machine learning to find what to replace. The page states SAP AI Core supports it as a feature and sets out five steps for applying it, defining the masking scope, choosing a technique, preserving the prompt's intent, checking compliance and risk, then testing and monitoring the result. That is the shape data masking takes on the BTP door.
SAP Document AISAP Document AISAP's reference architecture for SAP Document AI, first as SAP composes the service on BTP for document extraction: OCR, pretrained models, customer-defined schemas and LLM calls through SAP AI Core and its Prompt Registry in one pipeline, with tenant-isolated persistence in SAP HANA Cloud, PostgreSQL and an object store. Its scenario pages then lay out a solution in three layers: intake through Outlook and SharePoint inbound channels, the workspace UI, the Joule Work mobile app or the upload API; classification and extraction with a confidence score per field, automatic confirmation above a threshold and review of the rest in the workspace; and posting through outbound channels, directly to a REST API, through an SAP Integration Suite flow, or through a CAP service that maps the fields and calls SAP S/4HANA over OData. Enrichment beyond the service's own master data lookup is left to a CAP application or an Integration Suite flow triggered from an outbound channel, and direct API posting leaves error handling, retries and monitoring to the application.published 2026-06-03
Data MaskingData MaskingData masking replaces identifiable or confidential text in a prompt with placeholders such as <Person_0> or <Organization_1> before it reaches a large language model, using pattern matching and machine learning to find what to replace. The page states SAP AI Core supports it as a feature and sets out five steps for applying it, defining the masking scope, choosing a technique, preserving the prompt's intent, checking compliance and risk, then testing and monitoring the result. That is the shape data masking takes on the BTP door.
Document GroundingDocument GroundingDocument Grounding is a managed retrieval-augmented-generation service under the Generative AI Hub on BTP, which SAP's page on SAP AI Core places inside that service: it ingests documents from Amazon S3, SharePoint, SAP Document Management Service, SAP Work Zone or an SFTP server, and handles chunking, embedding and retrieval itself, refreshing content automatically when a source document changes. The page states this managed path is recommended for most enterprise scenarios because it covers the whole lifecycle end to end, and offers a separate Document Grounding Vector API for data that is already chunked and embedded, for cases that need finer control over chunking and metadata.
Generative AI on SAP BTPGenerative AI on SAP BTPThe reference shape for a generative AI application on BTP: a CAP backend, SAP HANA Cloud holding data and embeddings for similarity search through its vector engine, and the Generative AI Hub in SAP AI Core as the single access point to foundation models. It shows retrieval-augmented generation on that stack and names the CAP plugins and SDKs that connect the pieces, for both Cloud Foundry and Kyma.published 2025-09-02
Generative AI on SAP BTP
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A reference.
Prompt TemplatingPrompt TemplatingPrompt templating replaces a static prompt with a structured, reusable template whose placeholders are filled in at runtime, which the page says helps LLM responses stay consistent and lets the same instructions be adapted across tasks. On SAP AI Core this is implemented through the Prompt Registry, and the page states that storing prompts as plain strings in code is possible but not recommended. That is prompt management as a stored and managed object rather than a string embedded in the caller.
Federated Machine Learning with SAP DatasphereFederated Machine Learning with SAP DatasphereSAP's design for training predictive models on an external machine learning platform against SAP Datasphere data that is not replicated to that platform. The open-source FedML Python library runs in the platform's notebook, connects to Datasphere over Python/SQLDBC and reads the analytic models in which Datasphere unifies SAP and non-SAP sources; a trained model can then be deployed to SAP AI Core, or in several sub-pages to SAP BTP, Kyma runtime, which is the predictive models path where training happens outside SAP. Sub-pages cover Amazon SageMaker, Azure Machine Learning, Google Vertex AI, Databricks, NVIDIA RAPIDS on GPUs and IBM watsonx.published 2025-01-23
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Prompt TemplatingPrompt TemplatingPrompt templating replaces a static prompt with a structured, reusable template whose placeholders are filled in at runtime, which the page says helps LLM responses stay consistent and lets the same instructions be adapted across tasks. On SAP AI Core this is implemented through the Prompt Registry, and the page states that storing prompts as plain strings in code is possible but not recommended. That is prompt management as a stored and managed object rather than a string embedded in the caller.
Document GroundingDocument GroundingDocument Grounding is a managed retrieval-augmented-generation service under the Generative AI Hub on BTP, which SAP's page on SAP AI Core places inside that service: it ingests documents from Amazon S3, SharePoint, SAP Document Management Service, SAP Work Zone or an SFTP server, and handles chunking, embedding and retrieval itself, refreshing content automatically when a source document changes. The page states this managed path is recommended for most enterprise scenarios because it covers the whole lifecycle end to end, and offers a separate Document Grounding Vector API for data that is already chunked and embedded, for cases that need finer control over chunking and metadata.
Generative AI on SAP BTPGenerative AI on SAP BTPThe reference shape for a generative AI application on BTP: a CAP backend, SAP HANA Cloud holding data and embeddings for similarity search through its vector engine, and the Generative AI Hub in SAP AI Core as the single access point to foundation models. It shows retrieval-augmented generation on that stack and names the CAP plugins and SDKs that connect the pieces, for both Cloud Foundry and Kyma.published 2025-09-02
Generative AI on SAP BTP
LLM integration changed in @cap-js/ai 1.0.0, 2026-04-28. Affects A reference.
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
Agentic AI Security & GovernanceAgentic AI Security & GovernanceNames seven threat categories agentic AI introduces beyond ordinary application security: prompt injection, excessive agency, supply-chain and model-integrity compromise, memory poisoning, improper output handling, resource abuse and agent-to-agent communication poisoning. Its answer is a defence-in-depth structure of security controls, input validation, privilege management, supply-chain checks, memory segmentation, output validation, execution quotas, secure communication, paired with governance and oversight: audit logging, explainability, human-in-the-loop review, fairness assessment and continuous monitoring. States the reason plainly: an agent decides, chains actions across turns, keeps memory between them and can act on real systems, a different risk profile from a single request-response call. That is the authorisation and audit-trail question tool governance is named for.
Agentic Engineering for SAP BTP ExtensionsAgentic Engineering for SAP BTP ExtensionsAn agent harness coordinates code generation across isolated Git worktrees, using a skills registry, SAP CAP MCP Server, Fiori MCP Server and UI5 Web Components MCP Server for development context. The diagram shows LiteLLM as a model proxy in front of SAP AI Core, while automated checks and review gate the generated changes. The worked scenario is CAP-based extensions on BTP, with specifications written before generation and reusable skills governed across teams.
HANA AI Toolkit — Local MCP ServerHANA AI Toolkit — Local MCP ServerAn MCP server that turns the hana-ml Python library into governed tools an agent can call against a HANA Cloud instance, shipped in the hana-ai toolkit and exposed over stdio, SSE and streamable HTTP. Its one firm rule is attributable execution: an audit module writes the MCP-side identity — agent, model, session, tool, redacted arguments — into the HANA connection before any SQL runs, and fails the call if that write fails. A worked example of governance on an MCP tool surface, from SAP's data side rather than CAP's.published 2026-06-15
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
Agentic AI & AI AgentsAgentic AI & AI AgentsSAP's target picture for AI agents: Joule as the engagement layer — Joule Work, Joule Assistants, Joule Agents — with custom agents from customers, partners and SAP teams connecting through A2A for agent-to-agent collaboration and MCP for tool connectivity, on the SAP Business AI Platform. It says up front that parts are not generally available yet, in particular bidirectional communication with third-party agents through the Agent Gateway, so it reads as direction with the building blocks named rather than a design to copy today.published 2026-08-27
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko Günther
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Transforming Enterprise Data Strategy with SAP Business Data CloudTransforming Enterprise Data Strategy with SAP Business Data CloudSAP's layered picture of SAP Business Data Cloud, from lake storage and compute up to a knowledge core and agents, with eight sub-pages that each work one part through. The data products page is the cataloguing and lineage part: datasets described by Open Resource Discovery metadata, listed in the BDC catalog and shared over Delta Sharing to SAP Databricks and SAP HANA Cloud, with SAP Datasphere as a consumer on the intelligent content page; other pages install intelligent content, bring SAP BW data in through the Data Product Generator, provision groups by SCIM from Cloud Identity Services into SAP Databricks, which is identity provisioning, and train predictive models in SAP Databricks that SAP AI Core then serves for batch and real-time scoring. The main page states direction more than mechanism, and the BW page marks SQL Share for derived and OData for analytical data products as to be available.published 2026-05-12
Transitioning Architectures from SAP NetWeaverTransitioning Architectures from SAP NetWeaverA community contribution from Glencore, an SAP customer, on what replaces NetWeaver-based products as their standard maintenance ends in 2027: the scenarios where NetWeaver-era solutions fall short — integration with cloud-based landscapes, extensibility — and the successor options per use case, pointing at SAP's product availability matrix and note 1648480 for the official successors. Customer-authored, so the framing is a migration decision rather than a product description.published 2025-08-02
Architecting Multi-Region HA/DR resiliency patternsArchitecting Multi-Region HA/DR resiliency patternsPatterns for running BTP applications across regions when the default multi-availability-zone resilience is not enough: DNS-based load balancing across regional endpoints with Azure Traffic Manager, Route 53 or Cloud DNS, replication of data and configuration between regions, and the fundamentals of single-region versus multi-region resiliency in its sub-pages. BTP services are multi-AZ by default; a multi-region setup is something the customer architects, and this is SAP's description of how.published 2025-02-19
DevOps with SAP BTPDevOps with SAP BTPHow SAP frames a delivery pipeline for applications on BTP Cloud Foundry: continuous integration through the SAP Continuous Integration and Delivery service and its pipeline templates for CAP and Fiori, transport and change management across environments, and a section on reasonable alternatives for teams with existing CI infrastructure. Culture first, tools second, and explicit that the setup differs on other BTP environments.published 2025-06-06
Multitenant SaaS Application using CAPMultitenant SaaS Application using CAPSAP's reference architecture for a multitenant SaaS application on BTP built with CAP: one deployment serving many tenants with logically separated data, the subscription and onboarding flow, and the BTP services the design leans on. Written for partners and line-of-business teams building on BTP, and it is SAP's own side of the shape multitenancy takes on BTP.published 2025-01-31
Multitenant SaaS Application using CAPMultitenant SaaS Application using CAPSAP's reference architecture for a multitenant SaaS application on BTP built with CAP: one deployment serving many tenants with logically separated data, the subscription and onboarding flow, and the BTP services the design leans on. Written for partners and line-of-business teams building on BTP, and it is SAP's own side of the shape multitenancy takes on BTP.published 2025-01-31
DevOps with SAP BTPDevOps with SAP BTPHow SAP frames a delivery pipeline for applications on BTP Cloud Foundry: continuous integration through the SAP Continuous Integration and Delivery service and its pipeline templates for CAP and Fiori, transport and change management across environments, and a section on reasonable alternatives for teams with existing CI infrastructure. Culture first, tools second, and explicit that the setup differs on other BTP environments.published 2025-06-06
Establish a central entry point with SAP Build Work ZoneEstablish a central entry point with SAP Build Work ZoneSAP's reference architecture for a business site in SAP Build Work Zone, standard edition or SAP Build Work Zone, advanced edition as one entry point to business applications, processes, information and communication, on the web or in the Joule Work mobile app. Three of its eight flow steps are how content gets in, the ground launchpad and site content covers: custom apps through the channel to the subaccount's SAP HTML5 Application Repository service for SAP BTP, other content through content providers that expose it over APIs from cloud or on-premise systems and content packages uploaded as files, and SAP Cloud Transport Management or manual export and import to move it between environments. Users and role assignments come from Cloud Identity Services, and the components inside the subscription, among them Notifications, SAP Mobile Services and UI Theme Designer, cannot be decoupled from the product, so a custom mobile app needs its own SAP Mobile Services subscription.published 2026-05-22
Establish a central inbox with SAP Task CenterEstablish a central inbox with SAP Task CenterSAP's reference architecture for SAP Task Center as one inbox for the tasks of several SAP applications, opened in the Task Center web app or as To-Dos in SAP Start and SAP Mobile Start, which is the inbox half of task and approval UIs. It rests on Cloud Identity Services: every task provider must work with Identity Authentication, its users must carry the Global User ID and so must the recipients of each task, and sign-on between the provider and Identity Authentication is what lets a user navigate from Task Center into the provider. Task Center reaches providers through destinations in a customer subaccount, with Cloud Connector for on-premise SAP S/4HANA.published 2025-02-11
Integrate and Extend with SAP Build Process AutomationIntegrate and Extend with SAP Build Process AutomationSAP's reference architecture for SAP Build Process Automation integrating and extending SAP and non-SAP solutions in cloud and hybrid landscapes, the ground process automation covers. Processes start from events, APIs, schedules or forms, the forms built in SAP Build Process Automation, as UI5 applications or in SAP Build Apps; they reach other systems through the SAP Connectivity service with actions over APIs from sources that include CAP and RAP OData destinations and SAP Business Accelerator Hub specifications, and users reach them through SAP Build Work Zone and SAP Mobile Start, with SAP Task Center as the place tasks are managed. Decisions, Process Visibility, Processes and Automations come inside the one subscription and cannot be decoupled from it; CAP appears only as a source of API actions, and the examples are business scenarios such as mass job requisitions in SAP SuccessFactors.published 2025-05-14
Under no capability
API Managed IntegrationAPI Managed IntegrationSAP's reference architecture for API-managed integration, which puts the API Management capability of SAP Integration Suite in front of business applications as API proxies that intercept each call to apply security policies, transformations and governance and to collect usage metrics. SAP defines it as a pattern that complements the other integration patterns, and draws three routes behind the proxy: a managed API forwarded to its provider for simple transformations and protocol adaptations, the Graph capability exposing data from several sources as one connected API, and Cloud Integration for mediation beyond API Management's scope, with the edge integration cell runtime for managing APIs in a customer-managed Kubernetes environment. SAP states that it delivers no predefined scenarios for this pattern, so the proxies and policies are the customer's or partner's to build.published 2024-08-01
API Policy - FAQAPI Policy - FAQSAP’s June 2026 FAQ, version 1.3, explains the scope and use conditions of the SAP API Policy, including published and non-published APIs, ADT developer access, AI-driven usage and third-party MCP servers. It also addresses data extraction and the responsibilities of customers and partners. The FAQ is informational: it does not modify contracts, and applicable agreements and product documentation prevail if they conflict with it.