Is it safe to connect an AI agent to a live SAP system?

Why the fear is reasonable — and where it's misdirected

An AI agent with a live connection to the ERP that runs finance, orders, and payroll is exactly the kind of thing a CISO should be nervous about. The nervousness is healthy; it is just usually aimed at the wrong risk. The danger is not that intelligence is involved — it is an ungoverned connection: broad authorizations, a write-capable path, and a system reachable from outside your network. Strip those three away and an agent reading SAP is no more dangerous than the read-only reporting user your BI team has run for years.

So the useful move is to stop asking whether AI should touch SAP and start interrogating the connection itself. The four questions that decide safety are: through what interface, under which authorizations, from where, and can it write. A responsible vendor answers all four in writing, and every answer is one your security team can verify before the first call.

Read-only, enforced in code — not just promised

"Read-only" is worth nothing as a marketing line; it has to be enforced where it cannot be bypassed. The strong version is a write-keyword blocklist in the connector itself: before any statement reaches SAP, it is inspected, and anything that could change data or definitions is rejected outright. Read-only becomes a property of the code path, not a setting someone can toggle or a prompt someone can jailbreak.

This matters because language models are probabilistic and prompts can be adversarial. You do not want the guarantee that the system stays untouched to depend on the model behaving. You want it to depend on a gate the model cannot open — a deterministic check that fails closed. That is the difference between an agent that is trusted to be careful and an agent that is architecturally incapable of writing.

Least privilege, SAP's own interface, and no internet exposure

Three more controls turn a read connection from acceptable to auditable:

• Scoped authorizations — the connection runs under a least-privilege role, not SAP_ALL. The authorization profile is exported so your security team can review exactly what it can and cannot see before you connect.
• SAP's supported interface — analysis reads through the ADT (ABAP Development Tools) surface SAP already exposes, not a back-door table scrape or screen-scrape. You are using a door SAP built and your Basis team already governs.
• Inside your network — the connector is deployed within your own environment (a private VPC or on-prem), so your SAP is never opened to the public internet. The agent reaches SAP the way your internal tools do, behind your perimeter.

Reading and writing are two different trust decisions

The single most important design choice is that reading and writing are separated, not bundled. Fit-to-standard analysis — inventorying custom code, quantifying clean-core fit, mapping processes — is a pure read and is production-safe today precisely because it can never change anything. Configuration write-back is a completely separate, opt-in path: a human issues a single-use approval token, the agent drafts the change as a governed customizing transport in a development client, and your change board decides whether it ever moves toward production. It never touches production on its own.

One honest boundary: the automated functional-testing agent that would validate a reconfigured process end to end is in build and design preview, not shipped. Until it is, validation of any change stays a human step — which is the conservative default, and another reason the read path (which needs no such validation because it writes nothing) is the safe place to start.

What a governed read actually gives you

None of this is safety for its own sake — the read is what produces the decision you need. Running read-only against a live system, an agent quantifies fit object by object and returns a clean-core score, a retirement list, and a business case with the evidence attached to each finding. On a reference estate (a live ECC system, not a specific customer's result), an evidence-weighted read found 44% of custom objects were retirement or standardization candidates and surfaced $1.9M in avoidable annual carry cost. A customer's numbers come from reading their own system; the point is that a safe, read-only connection is enough to size an entire migration — you do not need write access, or any risk to production, to get the answer that matters.