AI governance for SAP and Microsoft, founder-led
Before an AI agent changes your SAP data, a person says yes.
We design where your agents' risky SAP actions are held, using SAP's own gateway hooks plus an approver who is not the requester, and the record that is kept.
And we secure SAP and Microsoft as one landscape: Joule and Copilot, Entra, Sentinel and Purview.
For CISOs, SAP security leads and GRC owners.
Illustration, made-up data.
Mainstream maintenance ends in 2027. Extended costs more.
ECC 6.0 (EHP 6 to 8), SAP Access Control 12.0 and SAP Identity Management 8.0 leave mainstream maintenance in 2027.
Moving to S/4? Move access and GRC once, with your program, for people and for agents.
Staying on ECC? Your access data can still be made ready for AI agents.
How we design it
Catch every action before it runs. Decide. Keep the record.
We design the control itself: where a risky action stops, who sees it, who may approve it, and the record that is kept. For SAP agents we build it on SAP's own gateway hooks, with an approver who is not the requester.
- 01Agent asks
- 02Held
- 03Approved
- 04Recorded
-
Agents follow segregation of duties, like people
We set up every Joule agent with an SAP role, privileged access rules and SoD checks before it goes live. No badge, no access.
-
Every action is auditable
We set up monitoring of what agents actually do, not only what they may do. If Joule reads payroll data at 3 AM, there is a log, and a control that flags it.
-
Zero Trust by default
We set agents up with temporary, scoped credentials that expire, and no standing access: the same Zero Trust model, applied to AI.
One landscape
SAP and Microsoft, secured as one landscape, by one team.
Joule and Copilot reach the same business data. Identity, monitoring and evidence cross from one side to the other. Usually this is split across two teams. We place the controls where the crossings happen.
Architecture briefRead our architecture direction: how an autonomous agent can be designed with industry practice such as NIST Zero Trust.
Earned AutonomyServices
Where we help, before and after your agents go live.
Most clients start with a vCISO conversation. From there: governing your AI agents, keeping SAP access sound on ECC or S/4, and watching SAP month after month.
Start here: vCISO Advisory
Security leadership for the AI era. Where most clients start.
Govern your AI agents
Which agent may do what in SAP, who must approve before it acts, and how it fits your business.
- Joule GuardrailsJoule can read your SAP data. We set what it may do with it, and the risky actions wait for the owner's yes.
- AI Security and Agentic GovernanceAI agents are the new privileged users. We apply the Agentic Trust Framework: unique identities, JIT credentials, session isolation and full audit trails.
- Joule Implementation and Agent StrategyWe architect Joule end to end: AI Unit sizing, role-specific assistants, Joule Studio agents, and SAP Enterprise AI Gateway (MCP) for non-SAP connectivity.
- Joule Studio Agent DesignJoule is where your people meet SAP's AI. We set up Joule agents in Joule Studio and design them around your business workflow, starting with a look at how the work runs today to decide where AI or ML fits.
SAP access and GRC, on ECC or S/4
Access, SoD and GRC kept sound, whether you stay on ECC or move to S/4HANA.
- Access and SoD for Your S/4HANA MoveYour S/4HANA move changes every role. It starts with a fixed-scope assessment and plan for access, SoD and audit evidence; the build is scoped per process area.
- SAP GRC 2026 ModernizationAccess Control and Process Control to GRC 2026, or access governance to IAG in the cloud, with the controls you need, not the ones you inherited.
- SAP IDM Exit: SAP Cloud Identity ServicesSAP Identity Management 8.0 leaves mainstream maintenance in 2027. We plan the move to SAP Cloud Identity Services and its Authorization Management Service (AMS) for policy-based access in the cloud, with Entra ID federation where you use it.
- Identity and Access ManagementFrom SAP Cloud Identity Services to Entra ID federation, we design Universal Identity architectures that make identity the control plane.
- GRC Investment OptimizationUpgrade, extend, or wait? A straight answer about your SAP GRC spend, including what AI agents will add.
Keep SAP watched
SAP watched, and the evidence kept current, month after month.
- Microsoft Sentinel for SAPYour SOC monitors everything except the system that holds your most critical data. We make SAP a first-class citizen in your security operations center.
- Microsoft Purview AI ComplianceEvery AI interaction touching your SAP data needs a record you can defend. We set up Purview to produce that evidence for the AI activity it can see.
- GRCIQ evidenceSAP GRC, ECC and S/4HANA table extracts turned into dollar exposure, risk and control coverage an auditor can follow. Shown today with demo data.
GRCIQ, our own product
GRCIQ: value from the SAP data you already have.
GRCIQ puts SAP risk in dollars: exposure by business process on an Executive Dashboard, and your IT general controls tracked in an ITGC Monitor. It reads SAP GRC, ECC and S/4HANA data. We built it, and we run it on Azure and Fabric. Shown today with demo data.
Explore GRCIQ- Read-only
- It reads SAP GRC, ECC and S/4HANA table extracts. It never connects to SAP, and never changes it.
- Deterministic
- The same data gives the same answer, every run.
- Audit-grade
- Built so the numbers can be traced and defended.
- Delivered on Microsoft
- Fabric and Azure, with control evidence from SharePoint.
Screens from GRCIQ, shown with demo data.
Insights and Architecture Briefs
What we've learned running the controls.
Earned autonomy
Permission lists were built for people and services that don't change. Agents do. Every kind of act starts on probation, passes a checkpoint the agent cannot skip, and earns its way to acting alone, one small class at a time.
AARM explained
The Cloud Security Alliance's runtime specification for AI agent actions, explained for leaders, and where to start.
Can Jev tell you the question was wrong?
We tested four of our own checking tools and found that not one had ever been tested to see if it could fail.
Non-human identity attendance
A problem SAP teams have carried for twenty years, sitting in production, with nobody taking attendance since go-live.
More from the blog
About UX4Tech
Cloud-native security and AI safety, with deep SAP roots.
UX4Tech is a cloud-native security and AI safety organization. Our roots are in SAP security, more than twenty-five years of it, and we work just as deeply in Microsoft security.
We are founder-led. You work directly with a founder who holds CISSP, TAISE and CCZT, and who builds the agent controls we recommend.
We treat SAP and Microsoft as one landscape, because that is how your data, your identities and your agents already move.
About UX4Tech and how we workHow an engagement runs
-
Assess
Audit your SAP landscape, AI agent inventory, security posture and compliance gaps, aligned with CSA Zero Trust maturity models.
-
Architect
Design governance frameworks: identity policies, AI agent enrollment and monitoring infrastructure, based on NIST Zero Trust and the CSA Agentic Trust Framework.
-
Activate
Deploy, test, hand off. Then, if you want us to, we keep reviewing the controls as your SAP landscape and your agents change.
Before your AI agent acts, who says yes?
If Joule, Copilot or your own agents are reaching SAP data, on ECC or S/4, start with a conversation about where the holds belong and who should own them.
Or write to support@ux4tech.com