AegisAI

The four facts that shape your decision

2027
ECC mainstream support ends
77%
of AI-active SAP customers run Microsoft Copilot today
3%
use SAP Joule in production
0
ECC support in SAP Joule, today and on the roadmap

Sources: SAP Maintenance and Support Policy, public adoption surveys reported in industry press, SAP API Policy v4.2026a (April 2026).

"AI can assist SAP. But it's not meant to run SAP." — the SAP API Policy v4.2026a in one sentence

What the policy actually permits and forbids

SAP API Policy v4.2026a §2.2.2 reads (excerpt):

"Except through and within the limits of SAP-endorsed architectures, data services, or service-specific pathways expressly identified and intended for such purposes, SAP prohibits API use for: (a) interaction or integration with (semi-)autonomous or generative AI systems that plan, select, or execute sequences of API calls, and (b) scraping, harvesting, or systematic and/or large-scale data extraction or replication."

Allowed: analysing data, supporting decisions, triggering individual defined API interactions. Not allowed: autonomous AI agents that plan, select, and execute sequences of API calls against SAP — unless they go through an SAP-endorsed architecture.

The carve-out is specific: architectures, data services, or service-specific pathways. AegisAI is the architecture leg of that carve-out.

Your three paths, weighed honestly

Path 1 — Don't ship

Wait for S/4HANA migration, then use Joule

Reality: S/4HANA migration projects run 12-36 months. Many ECC shops have a 2027 mainstream-support cliff and an S/4 migration plan in the same calendar. Joule is the SAP-sanctioned answer, but only for S/4.

The cost: your AI roadmap stalls until your migration completes. Competitors who don't run SAP ship AI features now.

Path 2 — Ship and hope

Wire Microsoft Copilot or another AI agent directly into ECC APIs

Reality: 77% of AI-active SAP customers already use Copilot. Many integrations were built before the v4.2026a policy. They now violate §2.2.2 the moment the agent does any kind of multi-step planning.

The cost: contractual exposure to SAP, no audit story your security team can defend, and a fragile integration that breaks every time SAP updates an API.

How AegisAI specifically helps an ECC 6.0 / EHP 8 shop

  1. Trusted RFC + STRUSTSSO2 + SNC: AegisAI uses the exact identity-propagation pattern your BASIS team already knows. The service user (e.g. AEGIS_RFC) gets S_RFCACL for the AegisAI source system ID with Type = Trusted System; the end user's SAP identity flows via RFC_USER; SAP's AUTHORITY-CHECK evaluates against the end user's actual roles — not a service account.
  2. Documented BAPIs only: BAPI_USER_GET_DETAIL, SUSR_GET_PROFILE_AUTH_OBJECTS, plus customer Z-RFCs through an explicit extension point. No undocumented endpoints, no reserved-namespace calls, no ODP large-scale extraction.
  3. Audit chain that satisfies your compliance team: HMAC-SHA256 chained, SELECT ... FOR UPDATE row-locked, integrity-probed. Every AI-agent call records the user, the intent, the SAP authority result, and the masked response — with cryptographic tamper evidence.
  4. Survives S/4 migration: when you finally move to S/4HANA (Cloud or on-prem), AegisAI re-wires to SAML Bearer Assertion / Principal Propagation in a config change. The control plane stays the same; the identity-propagation channel changes underneath.
  5. Sole-arbiter posture: AegisAI does not make authorisation decisions about your data. It propagates identity and lets SAP decide. We've written this down formally as ADR 0002 — your BASIS team can read it and recognise the pattern as the safe one.

A realistic 14-day pilot timeline

  1. Day 1: NDA signed. Sandbox ECC 6.0 / EHP 8 endpoint identified.
  2. Day 2-3: Your BASIS team configures Trusted RFC + SNC on the sandbox (the checklist is in deploy/render/OPERATIONS.md §4.3; about 90 minutes of BASIS work).
  3. Day 4: AegisAI deployed via Helm into your Kubernetes cluster (or our Render-hosted pilot if you'd rather not bring up k8s for the pilot).
  4. Day 5: Your Copilot / ChatGPT / Claude wired through AegisAI. First successful query against ECC sandbox with full audit trail.
  5. Days 6-13: Real users in your sandbox, real intents, real SAP authority checks, real audit chain accumulation.
  6. Day 14: Pilot readout. Audit-chain export. Go/no-go on a paid engagement.

Common questions ECC customers ask

"Does AegisAI need access to our SAP data?"

No. AegisAI runs in your Kubernetes cluster (or your AWS/Azure/GCP account in BYOC mode). Your data never leaves your environment. The AegisAI vendor sees aggregated telemetry only, not row-level data. The commercial models are: vendor-hosted Pilot (sandbox data only), self-hosted Helm in your k8s (the production model), or BYOC managed in your cloud account (premium tier).

"Will we still need Joule when we get to S/4HANA?"

Joule is SAP's first-party AI assistant for users inside the SAP UI. AegisAI is the control plane for AI agents accessing SAP data from outside the SAP UI — Copilot, ChatGPT, Claude, custom RAG pipelines. The two solve different problems. Most customers will run both: Joule for SAP-native moments, AegisAI for everything else. We have a Joule connector kit too; the architectural posture is the same as for Copilot.

"How is this different from just writing our own BTP middleware?"

You could. Many customers do. The trade-off is that the 9-stage pipeline we ship (rate limiting, request ceilings, JWT verification, identity propagation, adaptive trust, deterministic policy, parameterised query planning, MODE-gated execution, schema-driven response masking, HMAC audit chain) is meaningful engineering — roughly 12 person-months to replicate at production quality. You can build it; the question is whether building it is the highest-leverage use of your team's time given the 2027 calendar.

"What if SAP relaxes §2.2.2?"

The published policy is final. SAP has acquired Dremio and Prior Labs (announced 2026) to build their own AI-data path, but those acquisitions don't close until late 2026 at the earliest, and the integrated product is 2-3 years out. The carve-out for "SAP-endorsed architectures" is the only currently-available legal path. If SAP eventually relaxes the policy or ships a Dremio-backed alternative, AegisAI's identity-propagation, audit, and policy-engine work stays useful as a defense-in-depth layer in front of whatever SAP ships.

"Who is this for, specifically?"

SAP ECC 6.0 / EHP 8 customers in regulated industries (manufacturing, energy, financial services, pharma) whose security and compliance teams want a defensible audit story for AI access to SAP data, and whose business teams have a real AI use case they need to ship in 2026.

Next step

If you run SAP ECC and your AI agents need to access SAP data, the conversation we want is short: a 30-minute architecture review where we walk your BASIS engineer through the Trusted RFC pattern, your security team through the audit chain, and your business sponsor through the 14-day pilot. There's nothing to install for the review.

Book a 30-min ECC architecture review   Read the technical whitepaper

Source notes. SAP API Policy v4.2026a quoted from the version-of-record published April 2026; full citation in whitepaper §9. Adoption figures (77% / 3%) are widely-reported industry estimates as of Q2 2026; we do not claim them as SAP-published numbers. The ECC support timeline is per SAP's published maintenance policy. AegisAI's architectural alignment with the emerging SAP + BTP + Agentic AI Reference Architecture pattern (AI Control & Mediation Layer with Policy Enforcement, Orchestration & Guardrails, Observability & Audit) is by independent convergence; we recognised the same problem shape and arrived at the same answer.