[{"data":1,"prerenderedAt":300},["ShallowReactive",2],{"blog-\u002Fblog\u002Fai-agents-in-sap-what-actually-posts":3,"blog-related-\u002Fblog\u002Fai-agents-in-sap-what-actually-posts":276,"blog-surround-\u002Fblog\u002Fai-agents-in-sap-what-actually-posts":299},{"id":4,"title":5,"audience":6,"body":11,"cluster":236,"conversionGoal":237,"cornerstone":238,"date":239,"description":240,"draft":238,"extension":241,"factCheckedAt":237,"faq":242,"featured":238,"language":237,"meta":255,"minRead":256,"navigation":257,"order":258,"originalAsset":237,"path":259,"pillar":260,"primaryKeyword":261,"publicationOrder":262,"relatedProject":237,"releaseScope":237,"reviewCycle":263,"reviewMethod":264,"reviewStatus":265,"reviewedAt":239,"reviewedBy":266,"searchIntent":267,"seo":268,"sources":237,"stem":269,"tags":270,"type":274,"updated":239,"__hash__":275},"blog\u002Fblog\u002Fai-agents-in-sap-what-actually-posts.md","AI Agents in SAP: What Actually Lands in the System",[7,8,9,10],"enterprise-architect","financial-controller","business-analyst","transformation-lead",{"type":12,"value":13,"toc":226},"minimark",[14,22,30,35,38,45,48,57,63,67,70,73,76,82,93,99,107,111,117,125,133,141,149,153,156,167,178,184,188,191,194,202,206,209,212],[15,16,17,21],"p",{},[18,19,20],"strong",{},"An AI agent in SAP is judged by what it leaves behind: the user ID on the document, whether the posting went through the release path, and what the change record shows at period end."," Everything else in the discussion — which assistant, which model, which platform — is replaceable. Those three artefacts are what the control environment reads, what the auditor samples, and what someone will reconstruct from in a year.",[15,23,24,25,29],{},"Almost every article about AI agents in S\u002F4HANA finance describes what an agent ",[26,27,28],"em",{},"can do",". Very few describe what actually lands. This one is about the second, from eighteen years in SAP FI and TRM — the posting architecture, the release strategies, the business partner data behind a payment, and the change documents that make any of it provable afterwards.",[31,32,34],"h2",{"id":33},"role-aware-is-not-segregation-safe","\"Role-aware\" is not segregation-safe",[15,36,37],{},"The reassurance you will read most often is that an agent operates within the authorizations of the user it acts for, so it cannot do anything that user could not. That is true, necessary, and not the control people take it for.",[15,39,40,41,44],{},"Segregation of duties is not a statement about any single action. It is a statement about ",[26,42,43],{},"combinations",": create a vendor and release a payment to it; enter an invoice and approve it; maintain a bank detail and initiate a transfer against it. A ruleset does not forbid either half. It forbids one identity holding both.",[15,46,47],{},"Now consider what an agent asked to carry a process end to end actually needs. Not one role — the union of every role that process touches. Each individual authorization check passes. The combination is the one the ruleset was written to prevent. The control has not been bypassed; it has been satisfied step by step while being defeated across the sequence.",[15,49,50,51,56],{},"This is the same failure mode as ",[52,53,55],"a",{"href":54},"\u002Fblog\u002Faccess-management-and-user-provisioning-treasury","access creep",", arriving all at once instead of over five years. And it is why the design question is not \"does the agent have permission\" but \"what is the union of what this agent may do, and would a person holding that union pass the SoD review\". Run the agent's composite through the ruleset you already own. That is a report you can produce this week.",[58,59,60],"pull-quote",{},[15,61,62],{},"Every authorization check passes. The combination is the thing the ruleset forbids — and nothing checks combinations except the review nobody ran on a non-human user.",[31,64,66],{"id":65},"the-document-is-the-evidence-so-the-identity-is-the-design","The document is the evidence, so the identity is the design",[15,68,69],{},"What lands on an FI document is a small number of fields, and they carry the entire accountability chain: who created it, who changed it, who released it, and when. A treasury or controlling person reads those fields the way a developer reads a stack trace.",[15,71,72],{},"A shared technical user destroys all of it in one decision. It is the default in most integrations because it is administratively simple, and it means the document says the interface did it. There is nowhere to go from there.",[15,74,75],{},"Three arrangements, and their consequences on the document:",[15,77,78,81],{},[18,79,80],{},"Agent posts as a shared technical user."," Attribution gone. Revocation is all-or-nothing. The SoD review does not see it because technical users are usually excluded from the human access review.",[15,83,84,87,88,92],{},[18,85,86],{},"Agent posts as the requesting user."," Attribution points at a person who may not know the posting exists, and inherits every permission that person has accumulated — which is ",[52,89,91],{"href":90},"\u002Fblog\u002Fsegregation-of-duties-in-treasury-systems","almost always more than the task needs",".",[15,94,95,98],{},[18,96,97],{},"Agent has its own identity, scoped to the task, with the requesting human recorded."," More work. The only one where the document answers both questions an investigation asks: what acted, and on whose behalf.",[15,100,101,102,106],{},"The third is the same conclusion as ",[52,103,105],{"href":104},"\u002Fblog\u002Fagent-identity-and-permissions","agent identity generally",", and SAP makes it concrete: there is a field, it will be filled with something, and you are choosing what.",[31,108,110],{"id":109},"post-through-the-front-door-or-not-at-all","Post through the front door or not at all",[15,112,113,114],{},"The strongest architectural rule I would apply, and the one that resolves most design arguments quickly: ",[18,115,116],{},"an agent should be able to do nothing a person could not do through the normal transaction path, by that same path.",[15,118,119,120,124],{},"A direct write to the tables behind a document — ",[52,121,123],{"href":122},"\u002Fblog\u002F02-bkpf-bseg-join","BKPF and BSEG for an FI posting",", or the position and flow tables behind a treasury deal — produces a row that looks right and is invisible to everything that makes a posting trustworthy. It skips validations and substitutions. It skips the release strategy. It skips number range assignment. Most importantly it skips the change document, so nothing records that it happened or who did it.",[15,126,127,128,132],{},"The result is the worst possible combination: correct-looking data with no control history. It will reconcile. It will also be undefendable the first time anyone asks how it got there, and ",[52,129,131],{"href":130},"\u002Fblog\u002Fsap-trm-accounting-and-posting-architecture","the posting architecture"," is exactly where that question lands.",[15,134,135,136,140],{},"That rule is also the reason ",[52,137,139],{"href":138},"\u002Fblog\u002Fconnecting-ai-agents-to-your-erp","an agent should not be connected to the ERP directly"," — the operations it may call have to be a list you wrote, not an interface surface it discovers.",[15,142,143,144,148],{},"Same reasoning applies to the master data behind a payment. ",[52,145,147],{"href":146},"\u002Fblog\u002Fbusiness-partner-configuration-sap-treasury","Business partner and standing-instruction changes"," are the actual fraud path in treasury — the settlement account matters more than the deal — and an agent with write access there needs the four-eyes control that data already has, not a new one invented in the agent layer.",[31,150,152],{"id":151},"where-an-agent-genuinely-helps-and-where-it-stops","Where an agent genuinely helps, and where it stops",[15,154,155],{},"None of the above argues against using them. It argues for putting them on the right side of a line that already exists in the system.",[15,157,158,161,162,166],{},[18,159,160],{},"Reading is where the value is, and it is underrated."," Most of the friction in an SAP finance process is not the posting — it is finding out why something is the way it is. Which document cleared this item, why this valuation moved, what the open items against this counterparty look like, where in the ",[52,163,165],{"href":164},"\u002Fblog\u002Fsap-treasury-tables","treasury tables"," a number came from. An agent that answers those from the system of record, quickly, with the document numbers attached, removes real hours and cannot corrupt anything.",[15,168,169,172,173,177],{},[18,170,171],{},"Proposing is the useful middle."," Draft the posting, propose the clearing, prepare the payment run — and stop. A human releases. This is the \"propose, never post\" boundary the ",[52,174,176],{"href":175},"\u002Fblog\u002Fai-workflow-teardown-bank-reconciliation","bank reconciliation teardown"," settles on, and it holds in SAP for the same reason: the release path is where the control lives, so proposals can be generated freely as long as the release stays human.",[15,179,180,183],{},[18,181,182],{},"Posting directly is a narrow case, not a default."," It can be right — high-volume, low-value, fully deterministic postings with a tested reversal path and a reconciliation that would catch a bad run. That is a small set, and it is not where most programmes start. It is also not where the benefit is, which is worth saying because the instinct is to measure success by how much got automated.",[31,185,187],{"id":186},"what-a-period-end-conversation-looks-like","What a period-end conversation looks like",[15,189,190],{},"The test I would apply before go-live is not a demo. It is a conversation rehearsed in advance: sit with whoever signs the close and answer the questions they will actually ask.",[15,192,193],{},"Show them a document the agent posted. Who does it say created it. What approval is attached. If they sampled thirty of these, could they tell which were agent-originated — and can you produce that population, completely, or only the ones you happen to have logged. If a posting was wrong, what reverses it, and does the reversal carry the same accountability. If the agent were disabled this afternoon, could the process still run on Monday.",[15,195,196,197,201],{},"Those questions are not about AI. They are the questions ",[52,198,200],{"href":199},"\u002Fblog\u002Foperational-readiness-and-acceptance","operational readiness"," has always asked, and an agent that cannot answer them is not blocked by its model quality. It is blocked by an integration decision someone made early, usually the shared technical user, usually because it was the easy way to get a proof of concept working.",[31,203,205],{"id":204},"what-i-would-decide","What I would decide",[15,207,208],{},"Post through the transaction path, never into the tables. Give the agent its own identity and record the requesting human on the document. Run the agent's composite authorizations through the existing SoD ruleset and treat a conflict as a design defect rather than an exception to be approved. Keep release human for anything irreversible. And put the agent on reading and proposing first, where the value is real and the blast radius is small.",[15,210,211],{},"The failure I would expect to see most often is not a bad model. It is a technically successful pilot that posted under a service account, which nobody notices until an auditor asks a question the system can no longer answer.",[15,213,214],{},[26,215,216,217,221,222,92],{},"See also ",[52,218,220],{"href":219},"\u002Fblog\u002Fenterprise-ai-agent-security-boundaries","security boundaries for enterprise AI agents"," and ",[52,223,225],{"href":224},"\u002Fblog\u002Fwhy-enterprise-ai-is-an-architecture-problem","why enterprise AI is an architecture problem",{"title":227,"searchDepth":228,"depth":228,"links":229},"",2,[230,231,232,233,234,235],{"id":33,"depth":228,"text":34},{"id":65,"depth":228,"text":66},{"id":109,"depth":228,"text":110},{"id":151,"depth":228,"text":152},{"id":186,"depth":228,"text":187},{"id":204,"depth":228,"text":205},"architecture",null,false,"2026-08-19","Role-aware is not segregation-safe. What an agent posting in S\u002F4HANA leaves on the document, in the release path, and in front of the auditor at period end.","md",[243,246,249,252],{"question":244,"answer":245},"Is an AI agent working within a user's SAP authorizations safe?","Being role-aware is necessary and not sufficient, and the distinction matters more than it sounds. Running inside a user's authorizations means the agent cannot exceed what that user may do. But an agent asked to carry a process end to end needs the union of the roles that process touches — create the vendor, enter the invoice, release the payment — and that union is precisely the combination a segregation-of-duties ruleset is written to forbid. The authorization check passes on each step while the control the ruleset exists to enforce is defeated across them.",{"question":247,"answer":248},"What user ID appears on a document an AI agent posted in SAP?","Whatever identity the agent authenticated as, and that is a design decision with consequences you cannot fix afterwards. If it posts under a shared technical user, the document's created-by field names the technical user and the chain to a responsible person is broken at the source. If it posts under the requesting user's ID, the document says a person did something they may not know about. The workable arrangement gives the agent its own identity and records the requesting human alongside it, so both are recoverable from the document.",{"question":250,"answer":251},"Should an AI agent post directly to SAP tables or use the normal transaction path?","The normal path, always. A direct write to the tables behind a document skips the validations, substitutions, release strategy, number ranges and change records that the transaction path applies — which is why the posting looks correct and behaves as if it never happened for every control that matters. The rule that holds across every integration I have reviewed is simpler than it sounds: an agent should be able to do nothing a person could not do through the front of the system, by the same route.",{"question":253,"answer":254},"What does an auditor see when an AI agent posts in SAP?","The same fields they always sample: who created the document, who changed it, who released it, when, and against what approval. Nothing about the agent changes what is examined; it changes whether those fields still mean anything. If the answer to all of them is one technical user, the auditor's next question is how the company demonstrates that initiation and approval were separated — and the honest answer at that point is usually that it cannot.",{},7,true,2.4,"\u002Fblog\u002Fai-agents-in-sap-what-actually-posts","enterprise-ai-systems","AI agents SAP posting",219,"Trigger-based: SAP's AI capabilities and their authorization model change faster than an annual cycle. This page deliberately argues from the posting and authorization architecture rather than from product feature lists, but re-check the authorization claims whenever the agent framework's identity model changes.","editorial","reviewed","Tan Gravam","informational",{"title":5,"description":240},"blog\u002Fai-agents-in-sap-what-actually-posts",[271,272,273],"enterprise-ai","ai-agents","sap","text","Qv5lgy6o9GLoJyyLfeKRRdel7dxcZc0JXV3z9GyzMic",{"related":277,"prev":289,"next":292,"hasOrder":257,"place":294},[278,281,285],{"path":219,"title":279,"description":280},"Security Boundaries for Enterprise AI Agents","An agent that reads untrusted content can be instructed by it. What the boundaries are, which of them hold under pressure, and which are theatre.",{"path":282,"title":283,"description":284},"\u002Fblog\u002Ffour-eyes-and-segregation-of-duties-for-ai-agents","Four-Eyes and Segregation of Duties for AI Agents","A human clicking approve on an agent's proposal is not a second pair of eyes. What independence requires when one of the two parties is a model.",{"path":286,"title":287,"description":288},"\u002Fblog\u002Fcan-an-ai-agent-approve-its-own-payment","Can an AI Agent Approve Its Own Payment?","It is not a new question. It is a release strategy — and the per-transaction limit everyone reaches for is the one an agent defeats first.",{"path":290,"title":291,"type":274,"language":237},"\u002Fblog\u002Fthe-enterprise-ai-control-layer","The Enterprise AI Control Layer",{"path":104,"title":293,"type":274,"language":237},"Agent Identity: Who Is the AI Acting As?",{"label":295,"position":296,"total":297,"hub":298},"Architecture",5,6,"\u002Ftopics\u002Fenterprise-ai-systems",[],1787169866218]