AI Agents Need Guardrails When They Act
SAP's TechEd announcements make a useful distinction between documenting an AI agent and enforcing its permissions when it runs. US businesses can use that distinction across vendors.
Security, architecture and risk leaders
5 min read
30 October 2026
2 sources
Register
Owner + purpose
→Identify
Agent + user
→Check
Tool + permission
→Enforce
Allow or deny
→Trace
Review + revoke
A control only protects the paths through which it is actually enforced.
A risk assessment in a spreadsheet cannot stop an agent from calling a tool at 2 a.m.
- 01Inventory each agent's owner, tools, data and intended authority.
- 02Enforce permissions where calls happen, not only during design review.
- 03Keep an emergency disable path and review actual behaviour.
What the announcement reveals
At SAP TechEd, SAP described a connection between agent inventory, verification and runtime enforcement, alongside an enterprise AI gateway. On 30 October it outlined controls including authentication, routing, monitoring and audit. These are vendor descriptions; coverage and interoperability must be tested in the buyer's own environment.
The architectural idea travels beyond SAP: approval before deployment and enforcement during execution are distinct jobs. A documented policy that an agent must never export a customer list is only useful if the export path actually checks and enforces that policy.
Build a control around an action
Consider a US distributor using an agent to investigate late shipments. Register its owner, approved data sources, service identity and tool permissions. Let it read shipment status for authorised accounts, but block bulk customer exports and require a separate approval for changes to delivery commitments.
At the gateway or the underlying service, validate identity, scope, rate and permitted operation on every call. Log the request, policy decision, tool result and correlation ID, taking care not to put sensitive payloads into unrestricted logs. Make sure an operator can revoke access without waiting for a model vendor.
Test the gaps between systems
An agent can reach an action through more than one integration. Map direct API access, plugins and service accounts; a gateway cannot enforce a rule on a path that bypasses it. Test denied calls, expired credentials, retries and prompt injection from documents the agent reads.
Monitor denied and successful actions, unexpected tools, cost and incident response time. Governance needs an owner who can investigate exceptions, not just a dashboard that accumulates them.
Use this before approving the work.
- 01Inventory agents and every route to sensitive tools.
- 02Assign an owner and a least-privilege service identity.
- 03Enforce and test restrictions at execution time.
- 04Revoke access and trace a transaction during an exercise.
Research and references supporting this article. Interpretation and recommendations are Thalenor’s.
The distributor scenario and proposed controls are Thalenor's analysis, not claims about a specific SAP deployment.
Published and reviewed on 30 October 2026. This article provides general technology and operational information, not legal, tax, medical or regulatory advice.