SAP AI Agent Hub
As AI agents proliferate across enterprise systems — spanning SAP, third-party cloud platforms, and custom deployments — organizations need a systematic way to discover, verify, observe, and govern their entire agent estate. SAP AI Agent Hub is the enterprise command center for AI governance: a single platform that brings enterprise architecture discipline to AI agent management, built on SAP LeanIX.
AI Agent Hub addresses a fundamental challenge: while building and deploying individual agents is increasingly straightforward, governing the resulting landscape at scale is not. SAP AI Agent Hub makes the agent estate visible, manageable, and compliant — from the initial planning of a new agent through to its eventual decommissioning.
Architecture
Flow
-
SAP AI Agent Hub is the central governance platform for AI agents in the enterprise. Agent metadata from every source — SAP agents, custom agents, and third-party agents — flows into AI Agent Hub's registry, which maintains a unified inventory across the entire agent estate. It also offers an MCP server to surface architectural context from AI Agent Hub into development environments, ensuring builders work with the right business and technical context from day one.
-
An Agent Manager — typically an enterprise architect or IT governance lead — uses AI Agent Hub to discover agents, map them to enterprise architecture, verify and activate them, monitor usage and resource access, adjust permissions, and decommission agents at end of life.
-
Agent telemetry from SAP and third-party agent runtimes flows into SAP Signavio for behavioral process analysis and into SAP Cloud ALM for operational monitoring.
-
SAP SuccessFactors provides the organizational dimension, mapping agents to business units and roles.
-
SAP Cloud Identity Services manages agent identities and acts as the authority for access control. Registering an agent in AI Agent Hub triggers provisioning flows that create the corresponding agent identity record and align it with enterprise access policies. See Agent Identity for the detailed identity architecture.
-
The SAP Agent Gateway forms the runtime enforcement point: SAP and third-party agents route their requests through it, and the gateway applies the access control policies defined in AI Agent Hub. The gateway connects agents to MCP servers, SAP applications, Integration Suite adapters, and external systems.
Agent Lifecycle
SAP AI Agent Hub manages AI agents across five governance stages that an agent passes through from initial conception through eventual retirement.
Define
Create agents with the right architecture context and governance foundations from the start. Enterprise architects use AI Agent Hub to define the agent's goal, design its action space, and specify governance requirements — decisions made here determine the risk profile for everything that follows. SAP LeanIX provides the full architecture inventory — existing applications, business capabilities, IT components, data objects, and processes — as the design context that shapes what agents are built, on which technology, and for which purpose.
Joule Studio integrates with AI Agent Hub via the LeanIX MCP server, surfacing architectural context during agent creation so developers work with the right building blocks and business alignment from day one. Architecture decisions captured in AI Agent Hub inform and constrain agent design before the first line of code is written.
Verify
Before an agent reaches production, it enters the central inventory and must demonstrate it meets governance criteria. The verification stage covers risk assessment and classification, identity and credential provisioning, permission scoping and validation, and functional and resilience testing.
SAP AI Agent Hub automatically discovers agents across SAP and non-SAP environments through managed integrations:
- SAP agents: Standard agents delivered by SAP, custom agents built on Joule Studio, and extended partner-built agents
- Third-party agents: Agents deployed on Microsoft Azure, Google Cloud, AWS, ServiceNow, and Databricks
- Local agents: Agents running in developer environments, including Claude Code (in preview)
- MCP servers: Discovered via Integration Suite connectors and MCP Builder
- LLMs: Discovered via SAP AI Core
Discovered agents populate the agent registry with standardized fact sheets capturing identity, ownership, capabilities, technology stack, and governance status. AI Agent Hub surfaces contextually relevant agent suggestions to help teams identify the right agent for any task — or determine whether a new one needs to be built at all. Agents that have not passed the required verification checks remain in a pending state until cleared.
Enforce
Once verified, the agent goes live with all governance controls active from the first interaction. Identity and access policies are applied, guardrails and action constraints take effect, consumption limits and model-routing rules are set, and the ability to suspend or revoke the agent is in place.
The SAP Agent Gateway is the runtime enforcement point: SAP and third-party agents route their requests through it, and the gateway applies the access control policies defined in AI Agent Hub. Structured compliance records capture assessment results, architecture review outcomes, and EU AI Act risk classifications. Every registered agent has a clear owner and responsible party, and continuous architecture review ensures agents remain aligned with enterprise standards, business capabilities, and processes.
Monitor
Once operating in production, telemetry flows, performance is measured against defined criteria, and behavioral patterns are analyzed. SAP Cloud ALM receives session telemetry from SAP-managed agents and delivers dedicated agent dashboards covering evaluation rates, error root causes, session volumes, and performance trends over time. Operations teams can detect anomalies before they impact business operations and generate insights that inform agent strategy and investment decisions.
The monitor stage also carries recurring governance obligations: periodic access reviews, compliance recertification, risk-tier reassessment, and alignment checks against evolving regulatory requirements and organizational strategy.
Optimize
Based on outcome data, agents are either improved or retired. Improvement activities include goal recalibration, permission adjustment, and execution tuning. Retirement is a governed process: credentials are revoked, integrations are disabled, ownership is transferred, and audit records are preserved.
Agent behavior mining through SAP Signavio Process Intelligence reveals how agents actually behave in production: how they navigate process steps, where they deviate, and what they cost to run. These insights surface optimization opportunities, identify redundant or underperforming agents, and provide the data-driven foundation for decommissioning decisions. SAP SuccessFactors integration adds the organizational perspective, helping organizations understand how roles and required competencies are shifting as agents take on tasks previously performed by people.
Core Capabilities
Agent & MCP Registry
The central catalog of all AI artifacts in the enterprise landscape — agents, MCP servers, and LLMs. Each entry is a fact sheet capturing standardized attributes: identity, ownership, technology stack, business capabilities served, and governance status. The registry connects to the broader LeanIX architecture inventory, enabling architects to understand how agents relate to applications, processes, data objects, and IT components across the landscape.
The registry covers three categories of SAP-originated agents:
- Standard agents: Pre-built agents delivered by SAP
- Custom agents: Agents built on Joule Studio by customers
- Extended agents: Partner-built agents available through the SAP ecosystem
AI Agent Hub maintains a reference catalog with SAP-curated suggestions — recommending agents relevant to the customer's specific architecture landscape based on their existing context and the inventory of available agents.
Agent Evals & Assessment
Structured assessment and verification for agents and MCP servers. Verification records capture evaluation outcomes, compliance checks, and architecture review results. The EU AI Act risk assessment extension enables organizations to classify agents by risk category and manage ongoing compliance obligations. An AI governance assistant (in preview) helps teams navigate assessment processes and interpret governance requirements.
Identity & Access Control
SAP Cloud Identity Services manages agent identities alongside human identities. AI Agent Hub drives the full agent identity lifecycle: registering a new agent creates the corresponding identity record in SAP Cloud Identity Services, provisioning flows align role and permission assignments, and ongoing governance ensures agent access remains appropriate as capabilities and organizational requirements evolve. See Agent Identity for the detailed identity architecture.
Agent Observability
Session telemetry from SAP-managed agents flows into SAP Cloud ALM, where dedicated agent dashboards surface evaluation rates, error patterns, session volumes, and performance trends over time. This observability layer enables proactive detection of anomalies and provides the operational data needed for continuous improvement.
Agent Mining
Signavio Process Intelligence ingests agent execution traces via a dedicated AI Agent Mining connector. Once mining is enabled for an agent type in AI Agent Hub, telemetry is routed to the connector, which normalizes it into an event log structure for behavioral analysis. Signavio surfaces process conformance issues, cost drivers, and performance benchmarks. See Agent Behavior Mining for the detailed mining architecture.
Agent Org & Skills Mapping
Integration with SAP SuccessFactors maps the agent estate to the organizational structure, revealing which teams, business units, and roles interact with which agents. This organizational dimension supports impact analysis, change management, and the emerging discipline of workforce planning as agents reshape job functions and required competencies across the enterprise.
SAP Integrations
| Integration | Role |
|---|---|
| SAP LeanIX | Foundation platform; architecture inventory, fact sheets, architecture decisions, EA context |
| SAP Cloud ALM | Agent observability; session telemetry, performance dashboards, lifecycle management |
| SAP Signavio Process Intelligence | Agent mining; behavioral analysis, conformance checking, impact measurement |
| SAP SuccessFactors | Org chart integration; agent-to-workforce mapping and skills planning |
| SAP Cloud Identity Services | Agent identity store; authentication, authorization, and identity lifecycle management |
| SAP Integration Suite | MCP server management; MCP Builder for publishing and governing MCP servers |
| Joule Studio | Agent development; LeanIX MCP server surfaces architecture context during agent creation |