Governing AI Access in SAP Landscapes: S/4HANA, Business AI, and Hybrid Risk

This advisory post describes risks and best practices for governing AI agents in SAP landscapes (S/4HANA, BTP, Ariba, SuccessFactors). It explains three AI integration patterns, recommends representing AI agents as first‑class SAP identities with dedicated AI roles, subjecting them to SoD and access reviews, and managing them through standard Joiner–Mover–Leaver workflows, automated provisioning/deprovisioning, and monitoring to maintain least‑privilege and auditability.