How SAP Users Are Replacing Manual Work With Intelligent Agents

…and yes, the promotion path from SAP Basis Security Administrator to AI Agent Manager didn’t exist before.

Introduction

Much is written about strategies for adopting GenAI, Agentic Orchestration, and their transformative potential for organizations. But many articles stop short of explaining how to actually start and design high-impact agentic solution. This article gives a practical look at how Workato’s SAP Center of Excellence (CoE) is developing a scalable, end-to-end agentic solution for our internal SAP landscape using the Workato ONE.

⚠️ Disclaimers: 1) Every SAP estate is unique, and what works for us may not be a 1:1 fit for every other organization. 2) Our SAP-focused agentic solution is evolving alongside Workato’s platform capabilities and is in internal beta.

Starting with “Why ?”

Gartner expects that around 40% of agentic AI projects will be canceled by the end of 2027. (Wait … coincidentally, that’s also the deadline for the mainstream support of SAP ECC !) And so before getting to “How”, let’s examine “Why ?”

At Workato, we manage multi SAP ERP systems from an old-fashioned ECC to S/4HANA with latest FPS and we do so across different use cases: demos, POCs, training, development, testing etc. These systems host several CLNTs for Sandbox, Development, QA and so on, and we have all five SAP user types. Many times our end users also don’t need UI access but look for connectivity (RFC, OData …) for their SAP orchestrations.

We do not use SAP GRC, IDM, CUA etc. or any non-SAP tools like SailPoint for centralized user governance across SAP systems. Our objective is to build an Agentic solution, and this fully on Workato’s AI stack with zero custom ABAP coding in SAP ERPs.

The organization has an in-house SAP Basis Administrator responsible for user governance. Our agentic solution – in short SAP Basis Genie – is expected to support a fast-growing SAP user base, and to scale with our organizational needs. Assist in user lifecycle operations and in anomaly detection across SAP user accounts, operate with and w/o human in the loop and serve three personas: A) Users with no SAP skills asking for API access ; B) Users with SAP skills asking for SAP UI and API access ; C) SAP Basis Admin and BT team who need, among others also proactive insights. Ultimately, we want …

• Empower users through conversational AI(self-service scenarios)
• Free up SAP Basis Administrator time for strategic initiatives
• Avoid investing in SAP user governance tools
• AI-driven proactive SAP user sanity checks and alerts

Architecture

Let’s focus on creating an Agentic Solution with scalable, modular, but robust architecture, governance, and potential touchpoints with other Workato projects within the same Workato workspace.

Building blocks :

1. UIs and Agentic Apps. Tailored to end user persona and their user journey. Most users interact with Genie in Workato GO. SAP Basis Administrator has access to all interaction channels and has extra superpowers thanks to MCP.
2. GENIEs. Your are bundling Skills, Grounding and Events with a specific LLM and UI forming your purpose-built Workato Agent. Keep in mind you’ll face some differences in LLM’s performance and in their level of “SAP literacy”. Depending on your end-user persona, user journey, and interaction channel they use (Workato GO, Slack, MS Teams.. ), you might need to maintain multi versions and variations of the same Genie.
3. SKILL Recipes. In my case fully decoupled by design from any direct SAP and non-SAP application connections and orchestration logic. This ensures scalability and a clear separation between your Workato Agentic and Orchestrate layers.
4. KB and EVENT Recipes. Knowledge Base recipes are focused on the primary objective of managing documents in KBs assigned to SAP Basis Genie. App Event recipes have strict focus too. Most interactions are reactive (User to Genie), sometimes Genies act proactively, triggered by events or schedules.
5. API Recipes are MCP-enabled. Exciting part of your solution, the potential of Workato as an MCP server is hugely underrated ! In contrast to the “classic” Workato API recipes, I am approaching MCP API recipes as another set of agent SKILLs. They’re scoped strictly to MCP clients, just like SKILLs are to Workato Genies.
6. FUNCTION Recipes. Primarily driven by your agentic solution requirements, they form the core logic layer designed for maximum reusability across multiple agentic SKILLs and APIs exposed to MCP clients. They are also composable (FUNCTION A called by FUNCTIONs B and C). Example : an atomic check for user account availability in a specific SAP system.
7. UTILITY Recipes. Your fundamental cross-solution helpersused throughout the Workato workspace by multiple projects and builders. Build them by following rigorously the core objective of each UTILITY in mind, and expect consumer recipes to adapt. Use case specific extensions happen outside UTILITIES with bolt-on approach.
8. CONNECTIONs. Your SAP connections are mission-critical. You want to set them up once, to connect and to have them running in a highly stable, highly secure fashion with zero downtimes. Treat them as “VIPs”, segregate for a dedicated administration and governance model.

Practical Advice

1. Keep the whole solution in view. Workato Genies and the Agentic are here for delivering the business value your architecture is designed to achieve.
2. Build your coherent Workato SAP Genie SKILLSET, not isolated SKILLs. Keep an overview on how FUNCTIONs, SKILLs and MCP APIs are interconnected, avoid overlapping skills by identifying shared patterns.
3. Ballance Agentic with Orchestration. If you limit your orchestration layer just to connectivity plumbing, you will end up with duplicated logic across SKILLs making your solution harder to scale and maintain over time. Instead, design a reusable Orchestration foundation that your Agentic can build upon.
4. Create your specialist SAP Genie, not an AGI Agent. Use “What instructions should this genie follow?” in Genie’s profilenot only to specify the role, tone and skills to use, but to specify clear boundaries and define what your SAP Genie won’t do.

Results so Far

Today, our SAP Basis Genie has over 20 curated SAP skills, capabilities include but are not limited to :

• Full lifecycle management of all 5 SAP user types (Dialog, Service, System etc.) across SAP ECC and S/4HANA systems
• User account comparison
• Role and profile assignments
• Bulk user account locking based on risk criteria
• Notifications for dormant accounts, failed logins (SAP_ALL users), unusual login patterns etc.
• Visual dashboards for SAP user activity
• Proactive remediation recommendations

Summary

Interested in building Agentic Solutions for your SAP ecosystem using the Workato ONE platform? Get started today with the Workato Developer Sandbox: 👉 https://www.workato.com/sandbox