{"slug": "memo-the-agent-isn-t-the-asset-the-access-grant-is", "title": "Memo: The Agent Isn't the Asset. The Access Grant Is.", "summary": "SAP's API Policy v4/2026, Section 2.2.2, prohibits API use for \"interaction or integration with (semi-)autonomous or generative AI systems that plan, select, or execute sequences of API calls\" outside SAP-endorsed pathways, and SAP began enforcing the clause technically on 9 June 2026 with a security patch that blocks ODP calls from applications not recognized as SAP systems, documented in SAP Note 3255746. SAP's API Policy FAQ names three endorsed architectures for agentic access — the MCP Gateway on SAP Integration Suite, SAP-provided MCP servers through Joule Studio, and the A2A protocol — and SAP made Joule Studio 2.0 free through 31 December 2026, with the 2027 commercial model for Joule Studio, the Agent Gateway, A2A consumption and Business Data Cloud egress undisclosed. Forrester, which published a May critique titled \"SAP Is Attempting To Become The Gatekeeper Of Enterprise AI,\" treats the free period as the tell, and the memo argues the access grant, not the agent, is the asset incumbents are fortifying.", "body_md": "# Memo: The Agent Isn't the Asset. The Access Grant Is.\n\n*In April, SAP added a clause to its API policy barring autonomous agents from calling its APIs outside SAP-endorsed pathways. In June it shipped a patch that enforces the clause technically. By October, ServiceNow, NVIDIA and the payment networks had each built machinery for the same thing: deciding which agents may act against an authoritative record. This did not happen in a week – it took five months, which is what makes it a structural shift rather than a coincidence. The model layer is commoditising. The grant that lets an agent read, write or spend against a system of record is the asset the incumbents have quietly started fortifying, and in SAP's case it is currently free, which is the most revealing detail in the whole story.*\n\nSection 2.2.2 of SAP's API Policy v4/2026 states that, except through SAP-endorsed architectures, data services or service-specific pathways, SAP prohibits API use for \"interaction or integration with (semi-)autonomous or generative AI systems that plan, select, or execute sequences of API calls.\"\n\nRead it precisely, because the loose reading has dominated the commentary. This is not a ban on AI. It is a ban on an agent planning and chaining its own calls against SAP's API surface outside approved routes. A static integration that calls an endpoint on a schedule is untouched. An agent pointed at SAP that decides for itself which calls to make, in which order, is the pattern in scope – which is to say, exactly what every modern orchestration framework does.\n\nThe policy also restricts scraping and large-scale systematic extraction outside those same channels, which closes the obvious workaround of pulling the data somewhere permissive and letting the agent loose there.\n\nFor several months this read as paper. Then SAP made it operational. Enforcement began on 9 June 2026 with a security patch adding a subscriber-type check to ODP calls: if the calling application is not recognised as an SAP system, the call is blocked. The mechanics are documented in SAP Note 3255746, which designates ODP-RFC as SAP-to-SAP communication only, with Note 3439624 providing a self-assessment tool for auditing existing usage.\n\nWhat remains open is narrower than the headlines suggested, but wider than one road. SAP's API Policy FAQ names three endorsed architectures for agentic access: the MCP Gateway on SAP Integration Suite, SAP-provided MCP servers through Joule Studio, and the A2A protocol. Chief Customer Officer Thomas Saueressig's framing at Sapphire was blunter than the document – for agentic use cases, A2A via Joule is the way, with public APIs reserved for static applications rather than dynamic third-party agents.\n\n### **The most important fact is that it's free**\n\nHere is the detail that most coverage buried and that changes how to read the whole move.\n\nSAP made Joule Studio 2.0 free through 31 December 2026. Agent runtime is free. A2A interoperability is free with no cap. There is no agent tax today. What is undisclosed is the 2027 commercial model for Joule Studio, the Agent Gateway, A2A consumption and Business Data Cloud egress.\n\nForrester, which published the sharpest critique of the policy in May under the title \"SAP Is Attempting To Become The Gatekeeper Of Enterprise AI,\" treats the free period as the tell rather than the generosity. That is the right reading, and it is also why this memo is not about pricing. Writing an analysis of a rate card nobody has published would be forecasting. The structural claim stands without it: SAP has established, technically and contractually, that it decides which agents may act against its records. Whether it charges for that in 2027, and how much, is a second-order question about a position it has already taken.\n\nThere is one live metering mechanism worth noting, because it predates all of this and nobody has modelled it for agents. SAP's Digital Access licensing charges on documents created by non-SAP systems. An autonomous agent that creates ten thousand invoice documents owes Digital Access fees on those documents regardless of where the agent runs. The agent tax people are speculating about for 2027 already exists in a different form, keyed to exactly the thing agents do at machine scale.\n\n### **Why a toll on agency and not on data**\n\nCEO Christian Klein's defence – that customers do not pay to access their own data – is accurate and beside the point.\n\nThe distinction the policy draws is not between your data and SAP's. It is between *looking* and *acting*. A human in a UI, a scheduled report, a static integration: all untouched. An autonomous system that plans a sequence and commits changes to the authoritative record: gated. SAP has drawn a boundary around agency rather than around information, and it is the first major vendor to do so explicitly in contract language backed by a technical control.\n\nThat is the insight worth extracting, and it is separable from whether SAP is behaving well. Forrester's critique is that SAP is closing from a position of AI weakness, and that is probably true. But the identification underneath the move is sound: in an agentic stack, the durable control point is not the model, not the copilot interface, not the workflow. It is the boundary where an agent commits a change to the system of record. SAP owns that boundary for a large share of the Global 2000's financial and supply-chain truth. It is worth noting that Microsoft Copilot sits at roughly 77% adoption among AI-active SAP enterprises, per Forrester – which is precisely why a clause about third-party agents matters commercially rather than theoretically.\n\n### **The objection that may undo it**\n\nThe strongest argument against all of this comes from practitioners rather than competitors: in its strongest reading, the restriction may be unenforceable, because SAP cannot reliably distinguish agent traffic from human traffic on the wire.\n\nThat objection has real force and it has limits. The June patch does not detect agents; it detects whether the caller is an SAP system, which is a cruder and more enforceable test. A customer running an agent through a non-SAP integration path is blocked by architecture, not by behavioural detection. But an agent operating through a permitted channel, pacing itself to look like an application, is not obviously catchable – which means the policy's effective teeth are in contract and audit rather than in packet inspection.\n\nFor an operator that distinction matters enormously. A control enforced technically is a design constraint. A control enforced contractually is an audit exposure that surfaces years later, in a true-up, with interest. SAP's indirect-access history suggests which of those is more expensive.\n\n### **Everyone else is building the same layer**\n\nIf this were only SAP, it would be a vendor story. The reason it is a structural one is that the rest of the industry spent the following months building control machinery at the identical boundary, while arguing about SAP's version of it.\n\nOn 15 October, ServiceNow announced AI Passport: a cryptographically signed credential defining an agent's identity, permitted actions, accessible systems and accountable owner, issued through its control tower, checked at runtime rather than at login, with NVIDIA as design and launch partner linking it to NVIDIA's Open Agent Safety Platform. It is built on open specifications so other governance products and identity providers can issue and verify credentials, and it ships in Q4 2026 alongside shadow-AI detection and cost management.\n\nNote what that is. ServiceNow is one of the vendors held up as the open counter-example to SAP – and it is building verifiable runtime authority at the same boundary SAP is gating contractually. The postures differ. The recognition is identical.\n\nThe same pattern appears in payments. Agentic commerce standards – the OpenAI and Stripe Agentic Commerce Protocol now being adopted by enterprise acquirers, Google's AP2, and the agentic rails work at Mastercard and Visa – converge on one primitive: letting the party that owns the authoritative boundary decide which agents it will accept an instruction from. Enterprise records and consumer payments arriving at the same design pattern within months of each other is not a coincidence of roadmaps.\n\nAnd the demand side is unambiguous. ServiceNow's 2026 Banking AI Maturity Index found that while every bank surveyed reports using AI, only 24% have governance to match, with unmanaged service accounts, shadow agents and unregistered devices left exposed.\n\n### **Open is a position, not a principle**\n\nSalesforce's Headless 360 exposes data, workflows and actions over API, MCP and CLI with a large catalogue of MCP tools usable from third-party runtimes. ServiceNow's Action Fabric opens workflows and business rules to external agents with the customer choosing the model. Both are genuinely more open than SAP, and for SAP customers evaluating alternatives that difference is real and current.\n\nBut read it as strategy rather than virtue. Salesforce and ServiceNow are open because openness is their wedge against SAP, and because they are far enough ahead on agent capability that inbound agents expand their surface rather than threatening it. A company that opens a boundary to win share can meter it once the share is won, and AI Passport is evidence that the instrumentation to do so is being built regardless of today's posture. You do not issue cryptographic credentials for a world where access is free and ungoverned forever.\n\n### **What to do**\n\n**Inventory which boundaries you own and which you rent.** Map every point where your agents cross into a record you do not control. SAP customers have a specific task with a deadline attached: audit ODP-RFC dependencies using SAP's own self-assessment tool in Note 3439624. Generalise it from there. The boundaries you own are your moat; the ones you rent are a position someone else can reprice or revoke.\n\n**Get 2027 terms in writing before signing anything multiyear.** The gateway, A2A consumption and data egress pricing are undisclosed and the current free period ends 31 December 2026. Any agent roadmap that depends on SAP data and extends past that date is being planned against an unknown rate. Demand the numbers or demand a carve-out.\n\n**Model Digital Access against agent throughput now.** This one is live, not hypothetical. If your agents create documents in SAP, your licensing liability scales with their autonomy, and it surfaces in an audit rather than an invoice. Run the arithmetic before the agents scale, not after.\n\n**Treat open as dated.** Build on Salesforce and ServiceNow openness, but keep integrations portable enough that routing through a future gateway is a migration rather than a rebuild. Assume every boundary you rent can close.\n\n**If you own a boundary, understand what you are holding.** The uncomfortable corollary of the SAP story is that the strategy is coherent. A platform sitting on an authoritative record that other companies' agents need to touch holds the scarce asset of this era. The question is no longer how good your copilot is. It is how you govern the grant – and whether you do it before a standards body does it for you and takes the margin.\n\n### **Bottom line**\n\nThe industry spent two years believing the lock-in was the model. The model swaps out on a Tuesday. The lock-in is the boundary where an agent is permitted to act on the authoritative record, and over five months – an April clause, a June patch, an October credential layer, and a payments standard arriving at the same primitive – three unrelated corners of the industry reached for it.\n\nThe forward call: SAP publishes 2027 commercial terms for Joule Studio, the Agent Gateway and A2A consumption before the free period expires on 31 December 2026, and those terms become the reference price for agent access to systems of record – watched and matched by every other platform holding an authoritative boundary. The second tell to watch is whether runtime agent credentials converge on a shared specification or fragment per vendor. If they converge, the grant becomes portable and the toll gets competed down. If they fragment, every platform owns its own tollbooth, and the access grant becomes the most valuable asset in enterprise software.\n\nThe agent does the work. The grant to let it is the business.\n\n*Sources: SAP API Policy v4/2026 Section 2.2.2, quoted text per SAP's published policy as cited by the SAP Community technology blog, AI Magazine and Headless Systems; the three SAP-endorsed agentic architectures (MCP Gateway on SAP Integration Suite, SAP-provided MCP servers through Joule Studio, and the A2A protocol) per SAP's API Policy FAQ Question 35 as documented in the SAP Community analysis. Enforcement from 9 June 2026 via a security patch adding a subscriber-type check to ODP calls, SAP Note 3255746 designating ODP-RFC as SAP-to-SAP only, and SAP Note 3439624 providing the self-assessment tool, per Forrester and SAP Community. Thomas Saueressig's Sapphire 2026 remarks and the \"agent tax\" characterisation per Techzine, \"SAP blocks external AI agents. Salesforce and ServiceNow don't.\" Christian Klein's defence per the same. Free-period terms – Joule Studio 2.0 free through 31 December 2026, free agent runtime, uncapped free A2A interoperability – and the undisclosed 2027 commercial terms for Joule Studio, Agent Gateway, A2A consumption and Business Data Cloud egress, per Forrester, \"SAP Is Attempting To Become The Gatekeeper Of Enterprise AI — CIOs Should Push Back\" (May 2026), which also supplies the 77% Microsoft Copilot adoption figure among AI-active SAP enterprises and the \"closing from a position of AI weakness\" assessment. Digital Access fees applying to documents created by autonomous agents regardless of where the agent runs, and the enforceability objection that SAP cannot reliably distinguish agent from human traffic on the wire, per Ahead CRM's analysis of the policy. Bidirectional A2A with third-party agents not yet supported as of late August 2026, with Joule A2A general availability targeted for Q4 2026, per SAP's reference architectures as cited in the SAP Community analysis. ServiceNow AI Passport announced 15 October 2026 – cryptographically signed credential covering identity, permitted actions, accessible systems and accountable owner, issued through its control tower, enforced at runtime, built on open specifications, with NVIDIA as design and launch partner via its Open Agent Safety Platform, available Q4 2026 alongside shadow AI detection and AI Cost Management – per ServiceNow's investor release, SiliconANGLE, Constellation Research and CDO Magazine. ServiceNow 2026 Banking AI Maturity Index (100% of banks using AI, 24% with matching governance) per Channel Post MEA. Salesforce Headless 360 and ServiceNow Action Fabric per Techzine. Agentic commerce standards (OpenAI and Stripe's Agentic Commerce Protocol, Google AP2, Mastercard and Visa agentic rails) per contemporaneous reporting. Cross-references to prior Signal Memo coverage: substrate vs. broker, the unbundled licence, the audit log still says it was you. What is original to this memo: the access grant as the appreciating asset against a commoditising model layer, the reading of the free period as position-taking rather than pricing, the identification of Digital Access as the live metering mechanism, and the convergence-versus-posture distinction between SAP and the nominally open platforms.*", "url": "https://wpnews.pro/news/memo-the-agent-isn-t-the-asset-the-access-grant-is", "canonical_source": "https://signal-memo.com/memo-the-agent-isnt-the-asset-the-access-grant-is/", "published_at": "2026-10-28 07:40:19+00:00", "updated_at": "2026-10-28 07:42:00.471416+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-policy"], "entities": ["SAP", "Joule Studio", "SAP Integration Suite", "MCP Gateway", "A2A protocol", "Forrester", "Thomas Saueressig", "ServiceNow"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/memo-the-agent-isn-t-the-asset-the-access-grant-is", "markdown": "https://wpnews.pro/news/memo-the-agent-isn-t-the-asset-the-access-grant-is.md", "text": "https://wpnews.pro/news/memo-the-agent-isn-t-the-asset-the-access-grant-is.txt", "jsonld": "https://wpnews.pro/news/memo-the-agent-isn-t-the-asset-the-access-grant-is.jsonld"}}