From 55b74df262d868e0c7694d8dc8fe8930a2091fc8 Mon Sep 17 00:00:00 2001 From: Daniel Hutzel Date: Mon, 21 Sep 2026 14:58:20 +0000 Subject: [PATCH 1/2] SAP API Policy also applies to cap/agents (#2911) --- guides/ai/cap-agents.md | 10 ++++++++++ guides/ai/cap-mcp.md | 5 ++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/guides/ai/cap-agents.md b/guides/ai/cap-agents.md index 8d6dce35b..ddc07993b 100644 --- a/guides/ai/cap-agents.md +++ b/guides/ai/cap-agents.md @@ -5,6 +5,9 @@ Simply annotate a CAP service with [`@agent`](#declare-agent-services) to do so. The plugin uses state-of-the-art agent harness frameworks like [_LangChain_](https://www.langchain.com) or [_Pi_](https://pi.dev) internally. {.abstract} +> [!caution] SAP API Policy Applies! +> CAP-level agents are intended only for exposing _custom_ CAP application services. They are **_NOT_**{.red} an SAP-endorsed architecture or pathway for exposing, proxying, or providing agentic access to _SAP Application APIs_ as referred to in the [_SAP API Policy_](https://help.sap.com/doc/sap-api-policy), section 2.2.2. -> Read section [_SAP API Policy_](#sap-api-policy) below! + [[toc]] @@ -573,3 +576,10 @@ See section [_Telemetry \> MLflow_](#mlflow) above for details. A record of the quotas configurations, specifying limits on resource usage such as API calls, execution time, and memory consumption. See section [_Quotas_](#quotas) above for details. + + +## SAP API Policy + +> [!caution] +> CAP-level agents as documented herein must not be used as gateways or proxies for SAP Application APIs. The _cap/agents_ plugins are not an SAP-endorsed architecture, data service, or service-specific pathway under section 2.2.2 of the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy) and is not an endorsed mechanism for exposing, proxying, or providing agentic access to SAP Application APIs. +> Any use of SAP Application APIs must be in accordance with the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy). For SAP-endorsed patterns on agentic access to SAP Application APIs, consult the [_SAP Architecture Center_](https://architecture.learning.sap.com/docs/ref-arch/98efa0) reference architectures. \ No newline at end of file diff --git a/guides/ai/cap-mcp.md b/guides/ai/cap-mcp.md index 9f2d8e5d5..aa9b54b3d 100644 --- a/guides/ai/cap-mcp.md +++ b/guides/ai/cap-mcp.md @@ -514,11 +514,14 @@ Future versions of the adapter may add support for data changes using CREATE, UP > Agents can potentially be manipulated by data returned from the service to execute unintended actions. For any deployment ensure you use infrastructure and practices that mitigate prompt injection risks and connect only to trusted MCP agents (e.g., Joule). -## SAP API Policy +### API Governance > [!caution] > The adapter itself does not provide any built-in governance features: there is no automatic rate limiting, no specific audit logging of agent actions, no approval workflows for sensitive operations, and no policy enforcement layer. Before using MCP in a productive environment, put appropriate controls for example by using MCP Gateway of SAP Integration Suite or integrate with SAP Agent Gateway (not GA yet). + +## SAP API Policy + > [!caution] > The CAP MCP adapter must not be used as a gateway or proxy for SAP Application APIs. The adapter is not an SAP-endorsed architecture, data service, or service-specific pathway under section 2.2.2 of the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy) and is not an endorsed mechanism for exposing, proxying, or providing agentic access to SAP Application APIs. > Any use of SAP Application APIs must be in accordance with the [_SAP API Policy_](https://help.sap.com/docs/business-accelerator-hub/sap-business-accelerator-hub/sap-api-policy). For SAP-endorsed patterns on agentic access to SAP Application APIs, consult the [_SAP Architecture Center_](https://architecture.learning.sap.com/docs/ref-arch/98efa0) reference architectures. \ No newline at end of file From 51cb58722f76665cb9cc248f87ef1584c4bf099d Mon Sep 17 00:00:00 2001 From: Mahati Shankar <93712176+smahati@users.noreply.github.com> Date: Mon, 21 Sep 2026 17:15:09 +0200 Subject: [PATCH 2/2] update package version --- package-lock.json | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 153748b08..9125abf9f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@capire/docs", - "version": "2026.6.0", + "version": "2026.6.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@capire/docs", - "version": "2026.6.0", + "version": "2026.6.1", "license": "SEE LICENSE IN LICENSE", "devDependencies": { "@cap-js/cds-typer": "^0", diff --git a/package.json b/package.json index 254c6031c..a169a7d28 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@capire/docs", - "version": "2026.6.0", + "version": "2026.6.1", "description": "Capire on VitePress", "type": "module", "scripts": {