SAP outlines governance controls for autonomous agents

Autonomous AI agents introduce security risks through the actions they can execute in finance, HR and supply chain processes. SailPoint findings indicate that 80% of organizations had experienced unintended agent actions, including unauthorized system access. Deloitte found in 2026 that only 1 in 5 companies have a mature governance model for autonomous agents, while 74% plan moderate or extensive agentic AI deployment within two years.

SAP outlines obligations covering agent permissions, prompt manipulation, sensitive data interactions, auditability and regulatory readiness. Each agent should have a named identity, narrowly scoped permissions and a traceable activity record rather than shared access credentials. Application-level business rules and approval hierarchies should determine whether model-generated proposals can trigger actions. Audit trails must capture resulting business changes, not merely API calls.

SAP says its governed orchestration layer mediates interactions between customer data and external models. Its policy states that customer data processed by third-party hosted foundation models is not stored, retained or used for model training. SAP Business AI has achieved ISO/IEC 42001 certification, covering Joule, SAP AI Core and SAP AI Launchpad. Certification provides governance evidence but does not replace EU AI Act-specific conformity assessment. Organizations remain responsible for configuring agent authorization, approvals and audit scope within their own environments.