From 087bd998d28573013ee09d265c84fbf5ded61ab8 Mon Sep 17 00:00:00 2001 From: Daniel Hutzel Date: Mon, 21 Sep 2026 16:42:29 +0200 Subject: [PATCH] SAP API Policy also applies to cap/agents --- guides/ai/cap-agents.md | 10 ++++++++++ guides/ai/cap-mcp.md | 5 ++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/guides/ai/cap-agents.md b/guides/ai/cap-agents.md index 8d6dce35b..ddc07993b 100644 --- a/guides/ai/cap-agents.md +++ b/guides/ai/cap-agents.md @@ -5,6 +5,9 @@ Simply annotate a CAP service with [`@agent`](#declare-agent-services) to do so. The plugin uses state-of-the-art agent harness frameworks like [_LangChain_](https://www.langchain.com) or [_Pi_](https://pi.dev) internally. {.abstract} +> [!caution] SAP API Policy Applies! +> CAP-level agents are intended only for exposing _custom_ CAP application services. They are **_NOT_**{.red} an SAP-endorsed architecture or pathway for exposing, proxying, or providing agentic access to _SAP Application APIs_ as referred to in the [_SAP API Policy_](https://help.sap.com/doc/sap-api-policy), section 2.2.2. -> Read section [_SAP API Policy_](#sap-api-policy) below! + [[toc]] @@ -573,3 +576,10 @@ See section [_Telemetry \> MLflow_](#mlflow) above for details. A record of the quotas configurations, specifying limits on resource usage such as API calls, execution time, and memory consumption. See section [_Quotas_](#quotas) above for details. + + +## SAP API Policy + +> [!caution] +> CAP-level agents as documented herein must not be used as gateways or proxies for SAP Application APIs. The _cap/agents_ plugins are not an SAP-endorsed architecture, data service, or service-specific pathway under section 2.2.2 of the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy) and is not an endorsed mechanism for exposing, proxying, or providing agentic access to SAP Application APIs. +> Any use of SAP Application APIs must be in accordance with the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy). For SAP-endorsed patterns on agentic access to SAP Application APIs, consult the [_SAP Architecture Center_](https://architecture.learning.sap.com/docs/ref-arch/98efa0) reference architectures. \ No newline at end of file diff --git a/guides/ai/cap-mcp.md b/guides/ai/cap-mcp.md index 9f2d8e5d5..aa9b54b3d 100644 --- a/guides/ai/cap-mcp.md +++ b/guides/ai/cap-mcp.md @@ -514,11 +514,14 @@ Future versions of the adapter may add support for data changes using CREATE, UP > Agents can potentially be manipulated by data returned from the service to execute unintended actions. For any deployment ensure you use infrastructure and practices that mitigate prompt injection risks and connect only to trusted MCP agents (e.g., Joule). -## SAP API Policy +### API Governance > [!caution] > The adapter itself does not provide any built-in governance features: there is no automatic rate limiting, no specific audit logging of agent actions, no approval workflows for sensitive operations, and no policy enforcement layer. Before using MCP in a productive environment, put appropriate controls for example by using MCP Gateway of SAP Integration Suite or integrate with SAP Agent Gateway (not GA yet). + +## SAP API Policy + > [!caution] > The CAP MCP adapter must not be used as a gateway or proxy for SAP Application APIs. The adapter is not an SAP-endorsed architecture, data service, or service-specific pathway under section 2.2.2 of the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy) and is not an endorsed mechanism for exposing, proxying, or providing agentic access to SAP Application APIs. > Any use of SAP Application APIs must be in accordance with the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy). For SAP-endorsed patterns on agentic access to SAP Application APIs, consult the [_SAP Architecture Center_](https://architecture.learning.sap.com/docs/ref-arch/98efa0) reference architectures. \ No newline at end of file