SAP Says Catalog Agents Clear Security Review Before Reaching Customers

SAP has described the security path every agent in its product catalog follows before reaching a customer landscape: registration with a defined owner, scope, and identity, followed by a formal security review and a staged release that needs a human decision at each step.

When a user calls an agent, the gateway checks whether the user is allowed to reach it and whether it is allowed to use a tool. The target application, such as SAP S/4HANA, then decides whether that user can see the data.

Agents Clear Review Gates Before Entering the Catalog

Each agent receives an automatically generated Software Bill of Materials documenting its components and dependencies. SAP runs an ethics evaluation before development, a threat evaluation during design, and mandatory automated scans for application vulnerabilities, exposed credentials, and weaknesses in third-party libraries.

Agent-to-API permissions are assigned during tenant mapping and provisioned as authorization policies in SAP Cloud Identity Services. All model interactions route through SAP AI Core, where data residency, content filtering, and prompt injection protection can be enforced depending on the agent’s risk profile.

Release moves through development, test, and pre-production with no automated approval path to the customer’s landscape. Before production release, a formal security review also checks the agent’s own logic, access controls, and AI-specific risks on top of the baseline SAP manages for shared infrastructure.

Access Checks Run in Sequence When a User Calls an Agent

Users authenticate through SAP Cloud Identity Services using OIDC or SAML, and every request then enters through the Agent Gateway. A caller must belong to a connected landscape to obtain a valid token, and Authorization Management Service (AMS) policies decide whether that user can invoke that agent. SAP also says runtime verification prevents invocation of agents that are not verified in SAP AI Agent Hub.

The agent then presents its own certificate-bound token, and the gateway checks AMS policies to confirm the agent can call the requested tool. An HR agent, for example, can reach HR systems but cannot call a finance tool it was never granted. The target application then applies its roles, role catalogs, and scopes, and because the agent’s token carries the original user’s context, the action proceeds only if that user can see the data.

Controls Sit Inside SAP Managed Joule and a Growing Roadmap

Under SAP Managed Joule, customers activate agent scenarios through SAP for Me, gated by subscription licenses and landscape prerequisites. SAP patches and operates the Agent Gateway Formation, while customers assign users, approve which integrations an agent can use, and approve where agents run.

SAP announced at SAP TechEd on October 27 that third-party agents can invoke Joule Agents through a governed entry point, and says the agent gateway is generally available.

SAP plans to release the SAP Enterprise AI Gateway in the first quarter of 2027 to consolidate authentication, policy enforcement, and auditing of AI traffic. It is also working with NVIDIA on OpenShell, an open-source runtime that limits what an agent can reach where it runs, and the integration with SAP’s authorization and audit layers is still under development.

What This Means for SAPinsiders

Agent data access rests on existing SAP roles. When a user invokes an agent, the final authorization decision uses the roles, role catalogs, and scopes that customers already maintain in each application. The data the agent can reach is limited to what that user can see.

Responsibility divides along familiar lines. SAP operates the shared infrastructure, the Agent Gateway, and the review of each catalog agent, while customers choose which scenarios to activate, which users get access, and which integrations are approved. SAP says each catalog agent carries a documented chain of custody covering who built it and which security gates it passed.

SAP is tying design-time review to runtime enforcement. SAP describes catalog review, access checks, and Agent Hub verification as operating today, while the Enterprise AI Gateway is planned and the OpenShell integration is still under development. SAP calls the Agent Hub and Enterprise AI Gateway together the layer connecting oversight with enforcement.