Lesson 1 of 6
Why review changes when agents write code
8 min
Listen to this lesson
Kenji's ABAP team at Contoso now writes a growing share of its code with AI help: SAP Joule for Developers in ABAP Development Tools proposes code and ABAP Unit tests, and some developers drive a coding agent through SAP's ABAP MCP server. Theo's integration team uses AI to draft Groovy scripts and mappings for the move from Process Orchestration to SAP Integration Suite. The BTP team generates CAP services and UI5 apps. The output arrives faster than anyone can read it line by line. That moves the weight from the author to the quality gates: automated checks every change must pass, plus a focused human review of what the checks can't judge.
This course defines those gates for AI-generated ABAP, CAP, UI5 and integration content, wires them into the agent's own loop and turns the results into release evidence. It assumes you know ATC (sap-abp-204) and ABAP Unit (sap-abp-205); sap-aiq-201 covers a coding agent's guardrails in a test repository.
How AI-generated SAP code goes wrong
| Failure pattern | ABAP example | CAP, UI5 or integration example | Caught by |
|---|---|---|---|
| Invented API | Calls a class or method that doesn't exist, or a BAPI not released for ABAP Cloud | Imports a UI5 module path that doesn't exist | Syntax check, ATC, lint |
| Non-released or deprecated API | Reads table VBAK directly in ABAP Cloud code | Uses a UI5 API deprecated before UI5 2.x | ATC cloud readiness checks, UI5 linter |
| Missing authorization | A new method skips the authority check its siblings have | A CAP entity without @restrict or @requires | Review, tests as different users |
| Wrong transaction handling | COMMIT WORK inside a RAP behavior implementation | Side effects in a CAP read handler | ATC, review |
| Hard-coded org data | Company code 1710 written into logic | A destination name or URL hard-coded | Review, ATC custom checks |
| Tests that prove nothing | ABAP Unit test that asserts the result equals itself, or only that no exception occurred | A CAP test that checks only the HTTP status | Review, mutation check |
| Weakened tests | An agent edits a failing assertion to pass instead of fixing the code | Deleted test files in a diff | Diff review, protected test paths |
| Mapping edge cases | Not applicable | Empty segments, date and time zones, decimal separators, namespaces | Mapping simulation, payload regression |
Eight failure patterns in AI-generated SAP code and where each is caught.
None of these are new; human developers make every one of them. What changes is volume and fluency. Generated code looks clean, is formatted well and comes with tests, which makes reviewers trust it more than they should. SAP's own guidance for its ABAP Unit test generation is blunt: Joule doesn't know what the tested code should do, so review the generated tests carefully against the specification and keep them only if they match.
What a human reviewer still owns
- Intent: does the change do what the requirement asked, and nothing else? Agents add unrequested "improvements".
- Authorization and data access: who can call this, and what can they see or change?
- Test meaning: would the tests fail if the behavior were wrong?
- Diff hygiene: deleted or weakened tests, new exemptions, pragmas or pseudo-comments that silence checks.
- Business semantics: for mappings, does each field mean the same thing on both sides?
What would you do?
An agent-written change to the core agreement behavior pool ZBP_R_CMC_COREAGREEMENT passes syntax check, ATC with no priority 1 or 2 findings, and 14 new ABAP Unit tests. The developer asks Kenji to approve it quickly. What should Kenji focus his review on?
- When agents write more code, automated gates carry more weight, and human review concentrates on what gates can't judge.
- AI-generated SAP code fails in familiar ways: invented or non-released APIs, missing authorization, bad transaction handling, hard-coded values, weak or weakened tests.
- Use defense in depth: agent self-checks, independent pipeline gates, focused review, downstream tests.
- Reviewers own intent, authorization, test meaning, diff hygiene and business semantics.
Check your understanding · not graded
Lesson check
1. Why do quality gates carry more weight when agents write more of the code?
2. What does SAP say about Joule's knowledge when it generates ABAP Unit tests?
3. Which failure pattern is a reviewer best placed to catch, rather than ATC?
4. In the defense-in-depth model, why rerun checks in the pipeline when the agent already ran them?