AI governance for SAP and Microsoft, founder-led
Before an AI agent changes your SAP data, a person says yes.
We design where your agents' risky SAP actions are held, using SAP's own gateway hooks plus an approver who is not the requester, and the record that is kept.
And we secure SAP and Microsoft as one landscape: Joule and Copilot, Entra, Sentinel and Purview.
For CISOs, SAP security leads and GRC owners.
Illustration, made-up data.
Mainstream maintenance ends in 2027. Extended costs more.
ECC 6.0 (EHP 6 to 8), SAP Access Control 12.0 and SAP Identity Management 8.0 leave mainstream maintenance in 2027.
Moving to S/4? Move access and GRC once, with your program, for people and for agents.
Staying on ECC? Your access data can still be made ready for AI agents.
How we design it
Catch every action before it runs. Decide. Keep the record.
We design the control itself: where a risky action stops, who sees it, who may approve it, and the record that is kept. For SAP agents we build it on SAP's own gateway hooks, with an approver who is not the requester.
- 01Agent asks
- 02Held
- 03Approved
- 04Recorded
-
Agents follow segregation of duties, like people
We set up every Joule agent with an SAP role, privileged access rules and SoD checks before it goes live. No badge, no access.
-
Every action is auditable
We set up monitoring of what agents actually do, not only what they may do. If Joule reads payroll data at 3 AM, there is a log, and a control that flags it.
-
Zero Trust by default
We set agents up with temporary, scoped credentials that expire, and no standing access: the same Zero Trust model, applied to AI.
One landscape
SAP and Microsoft, secured as one landscape, by one team.
Joule and Copilot reach the same business data. Identity, monitoring and evidence cross from one side to the other. Usually this is split across two teams. We place the controls where the crossings happen.
Architecture briefRead our architecture direction: how an autonomous agent can be designed with industry practice such as NIST Zero Trust.
Earned AutonomyServices
Where we help, before and after your agents go live.
Most clients start with a vCISO conversation. From there: governing your AI agents, keeping SAP access sound on ECC or S/4, and watching SAP month after month.
Start here: vCISO Advisory
Security leadership for the AI era. Where most clients start.
Govern your AI agents
Which agent may do what in SAP, who must approve before it acts, and how it fits your business.
SAP access and GRC, on ECC or S/4
Access, SoD and GRC kept sound, whether you stay on ECC or move to S/4HANA.
- SAP Security and GRC, 2027 to 2030Mainstream maintenance ends in 2027. Lay out your ECC, GRC and identity dates and options, and leave with a decision memo.
- Access and SoD for Your S/4HANA MoveYour S/4HANA move changes every role. It starts with a fixed-scope assessment and plan for access, SoD and audit evidence; the build is scoped per process area.
- SAP IDM Exit: SAP Cloud Identity ServicesSAP Identity Management 8.0 leaves mainstream maintenance in 2027. We plan the move to SAP Cloud Identity Services and its Authorization Management Service (AMS) for policy-based access in the cloud, with Entra ID federation where you use it.
Keep SAP watched
SAP watched, and the evidence kept current, month after month.
- SAP Security RunA monthly rhythm for SAP security: patch-day triage, critical access review, monitoring that reaches your security team, and evidence filed as you go.
- GRCIQ evidenceSAP GRC, ECC and S/4HANA table extracts turned into dollar exposure, risk and control coverage an auditor can follow. Shown today with demo data.
GRCIQ, our own product
GRCIQ: value from the SAP data you already have.
GRCIQ puts SAP risk in dollars: exposure by business process on an Executive Dashboard, and your IT general controls tracked in an ITGC Monitor. It reads SAP GRC, ECC and S/4HANA data. We built it, and we run it on Azure and Fabric. Shown today with demo data.
Explore GRCIQ- Read-only
- It reads SAP GRC, ECC and S/4HANA table extracts. It never connects to SAP, and never changes it.
- Deterministic
- The same data gives the same answer, every run.
- Audit-grade
- Built so the numbers can be traced and defended.
- Delivered on Microsoft
- Fabric and Azure, with control evidence from SharePoint.
Screens from GRCIQ, shown with demo data.
Insights and Architecture Briefs
What we've learned running the controls.
Earned autonomy
Permission lists were built for people and services that don't change. Agents do. Every kind of act starts on probation, passes a checkpoint the agent cannot skip, and earns its way to acting alone, one small class at a time.
AARM explained
The Cloud Security Alliance's runtime specification for AI agent actions, explained for leaders, and where to start.
Can Jev tell you the question was wrong?
We tested four of our own checking tools and found that not one had ever been tested to see if it could fail.
Non-human identity attendance
A problem SAP teams have carried for twenty years, sitting in production, with nobody taking attendance since go-live.
More from the blog
Before your AI agent acts, who says yes?
If Joule, Copilot or your own agents are reaching SAP data, on ECC or S/4, start with a conversation about where the holds belong and who should own them.
Or write to support@ux4tech.com