Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 3 of 6

The SAP API Policy and agents: reading section 2.2.2

9 min

Listen to this lesson

0:00 / 10:11

On April 27, 2026, SAP published a new SAP API Policy, version v.4.2026a. It is a two-page document on the SAP Help Portal that forms part of the documentation for SAP solutions. For agent architects, one clause dominates: section 2.2.2. This lesson reads the policy's structure, then that clause, then what SAP has said about applying it, and finally the questions that remain open. It is not legal advice; your contract and your counsel decide how the policy applies to you.

How the policy is structured

SectionWhat it covers, in plain words
1.1 Published APIsAPIs on the SAP Business Accelerator Hub or identified in product documentation may be used for their documented purposes, such as integration, extensions and data exchange.
1.2 Non-Published APIsCustomer and partner applications must not use APIs that aren't published (internal, private or bound to SAP-reserved clients), unless documentation or SAP allows it. Customer-built ABAP interfaces in private cloud and on-premise remain allowed.
2.1 Specific API controlsPer-API rate limits, quotas, deprecation schedules, data egress limits and bulk extraction preconditions, documented with each API.
2.2.1 General controlsNo API use for competitive analysis, for undocumented scenarios without authorization, or in ways that risk performance, stability or security.
2.2.2 AI and extractionRestrictions on AI systems that orchestrate API calls and on large-scale extraction, except through SAP-endorsed pathways (next section).
3 Monitoring and remediesSAP may monitor usage and throttle, suspend or terminate access; controls must not be circumvented, including through proxies, gateways or custom code.
4 ComplianceThe policy doesn't limit legally required data export or portability.

SAP API Policy v.4.2026a at a glance (paraphrased).

Section 2.2.2 in plain words

Section 2.2.2 says that, except through and within the limits of SAP-endorsed architectures, data services or pathways expressly intended for the purpose, SAP prohibits API use for two things. Point (a) is interaction or integration with autonomous or semi-autonomous AI systems, or generative AI systems, that plan, select or execute sequences of API calls. Point (b) is scraping, harvesting, or systematic or large-scale data extraction or replication.

Read the structure carefully. It is a prohibition with an exception, not a ban on agents. An agent that decides by itself which SAP APIs to call, in what order, is in scope of point (a). The way to be compliant is to route that agent through an endorsed pathway. SAP's May 2026 overview deck for user groups names the endorsed patterns: AI agent integration through A2A (the Agent Gateway), governed MCP access (the MCP Gateway in SAP Integration Suite), and data sharing through zero-copy data services, with details in the SAP Architecture Center and SAP's AI Golden Path.

How section 2.2.2 sits on top of the published-API rules. This is a reading aid, not a legal determination.
The Sign-Off Table · thesignofftable.com/academy/sap-ai-205

What SAP has said about applying it

  • Dialogue first. SAP's deck says enforcement prioritizes dialogue, reviewing the use case with the customer before restrictive measures, with no automatic blocks or penalty model, and that existing integrations using published APIs for their documented purpose are not expected to be affected.
  • Your own namespace is fine. Custom RFCs, BAPIs, OData services and CDS views in Z or Y namespaces remain permitted. But calls from that custom code into SAP's APIs must still comply, and custom code must not be used to get around the controls.
  • Third-party AI platforms are allowed through endorsed routes. The deck's FAQ summary says customers can use any third-party AI platform if it connects through an endorsed architecture using open protocols such as A2A and MCP.
  • One named unpermitted interface. ODP-RFC is the first interface SAP classified as unpermitted for third-party data egress, with a security patch shipped on June 9, 2026 and a temporary opt-out available until December 31, 2026 for impacted customers moving to a target architecture.
  • Automated checks are coming. SAP plans to extend the Cloudification Repository with classifications so ATC checks can flag non-compliant API usage.
Scripted, transactionalA reviewed script calls a published API for its documented use. Ordinary integration; specific controls apply.
Agent, transactionalAn agent picks which SAP APIs to call. In scope of 2.2.2(a): route through an endorsed pathway.
Scripted, bulkA job replicates large data sets. In scope of 2.2.2(b): use SAP-endorsed data services.
Agent, bulkAn agent harvests data at scale. Highest risk on both counts; redesign before building.
Where scenarios land against section 2.2.2.
The Sign-Off Table · thesignofftable.com/academy/sap-ai-205

What would you do?

Theo proposes a quick win: an open-source MCP server running on a team laptop that wraps Contoso's published sales order OData API, so a Copilot agent can answer order questions for Fleet Sales. What should Nadia say?

Key points
  • SAP API Policy v.4.2026a was published on April 27, 2026; section 2.2.2 is the clause that matters for agents.
  • 2.2.2 prohibits AI systems that plan, select or execute API call sequences, and large-scale extraction, except through SAP-endorsed pathways.
  • SAP names A2A via the Agent Gateway, the MCP Gateway and zero-copy data services as endorsed patterns, and says enforcement starts with dialogue.
  • Developer tooling scope and commercial terms are debated in community sources; confirm with SAP and counsel.

Check your understanding · not graded

Lesson check

  1. 1. What does section 2.2.2(a) of SAP API Policy v.4.2026a address?

  2. 2. Under the policy, how can an agent that orchestrates SAP API calls be compliant?

  3. 3. Which statement about customer-namespace code is consistent with SAP's overview deck?

  4. 4. Which interface did SAP name as unpermitted for third-party data egress?