Controls for agents: permissions, approvals, logs and kill switches

Agents raise the stakes because they act, not just answer. A Joule agent or a custom agent connected through an MCP server can read data, draft documents and, if you allow it, post them. The AI Act's high-risk duties (human oversight, logging, accuracy, robustness) are a good template for any agent that touches business processes, high-risk or not. This lesson turns them into concrete controls an SAP program can design, test and sign off.

Five control families

Permissions

Treat an agent like a new kind of user that needs least privilege. In SAP terms, that means the agent's technical identity (if it has one) goes through the same role design and segregation of duties analysis as a person. Contoso runs SAP Access Control 12.0, so Nadia added agent identities to the access risk analysis: an agent that can create purchase requisitions must not also be able to release them or maintain supplier bank details. Where calls run under the end user's identity, the user's own roles limit the agent, which is the safest default.

Approvals that already exist

Your SAP system already has approval controls; don't let agents route around them. At Contoso, purchase requisitions over $10,000 need release, and purchase orders over $25,000 need approval through flexible workflow. An agent that drafts a $40,000 requisition triggers the same release and approval as a person would. Add agent-specific limits on top where useful, for example a maximum number of documents per hour, or a value ceiling above which the agent must hand over to a person before drafting.

Logging that answers the auditor's question

For any agent action, you should be able to answer: who asked, which agent acted, what it was told, which tool it called with which parameters, what came back, and which SAP document resulted. SAP's architecture guidance recommends logging every tool call with caller identity, redacted parameters, target API, status and latency, and the Agent Gateway design logs interactions for audit through SAP Cloud ALM. For high-risk systems, deployers must keep logs under their control for at least six months; Contoso keeps agent logs for 13 months, matching its audit cycle.

Kill switches and incidents

A kill switch is only real if it has been tested. Design at least two: a fast one that stops the agent from acting (for example, revoking its subscription to the MCP server in Developer Hub, disabling its identity in SAP Cloud Identity Services, or deactivating the agent in its platform) and a slower one that removes its access to SAP data. Document who may pull each switch, at what trigger, and what the fallback process is, then rehearse it like a cutover task.