Guardrails for AI Coding Agents on SAP Systems: Authorizations, Transports, Hooks and Audit Trail

Keep this: job aid

Coding agents on SAP: guardrail checklist

• Threats: prompt injection, over-broad access, secret leakage, unreviewed change, data exposure, supply chain.
• Identity: per-developer agent users in development only; no shared users; no SAP_ALL.
• Agent role: package-limited S_DEVELOP, no debug change, S_TRANSPRT 01 and 02 only, limited table display, no user admin.
• ADT MCP server: access restrictions on (projects and packages); token kept out of repositories and regenerated if exposed.
• Agent settings (managed): Manual as starting mode (auto has been Claude Code's built-in start since v2.1.283), bypass and, if policy says so, auto disabled, deny-first rules for ADT tools, approved MCP servers by URL or command, managed hooks only.
• CLAUDE.md and AGENTS.md guide; permissions, sandbox, hooks and SAP authorizations enforce.
• Release and import stay with people; ATC exemptions are human decisions.
• Audit trail: ticket, request, object versions, session id and tool calls, review, checks, imports, test sign-off; test it monthly.
• Legal: API Policy sections 1.2 and 2.2.2, data protection, provider training and retention terms; counsel decides.
• Policy: tiers, testable lines, incident steps (lock agent user, regenerate token, preserve logs), quarterly review.