SAP Joule Security and Governance for Joule Agents and Joule Studio Custom Agents

If your last security review of Joule was in 2025, most of what follows is new. Dates come from SAP's own news pages.

At SAP Connect, SAP described the governance it wants every agent to have: "every agent should have a verified owner, a risk tier, and scoped access rights", along with "human-in-the-loop approval, human-on-the-loop monitoring, and human-in-command override authority." That is the right list. For SAP-delivered agents inside SAP applications, SAP provides much of it. For custom agents calling tools outside SAP, the approval and the risk tier are yours to build.

SAP's own architecture guidance also says policy enforcement for agent tool and MCP calls is planned for the second half of 2026, and that some A2A components are not yet generally available. Check the current status with your SAP account team before you assume a control exists in your tenant.

SAP's reference architecture says each Joule interaction is "governed by the user's identity and the agent's permitted scope." For the Microsoft 365 Copilot path, SAP's documentation says a request is processed in the scope of that user's identity and permissions, with the same permission checks as using Joule directly. Agents also get their own identities in the Identity Directory.

This is the correct default, and it closes the worst class of agent failure: an agent with a service account that can see everything. A Joule agent cannot read payroll the user cannot read.

What it cannot do is tell a legitimate action from a manipulated one when both are inside the user's authority. Permission checks answer "may this user change vendor bank details?" They do not answer "should this change, to this account, triggered by this email, happen now?" That second question is where prompt injection does its damage, because the attacker does not need new permissions. They borrow the ones your user already has.

Each row is a case where SAP did its job and the risk is still open. That is the reason to add an action-level gate, and only on the handful of actions where it matters. Our human approval for AI agents page explains how to choose those actions without drowning reviewers.

Custom agents built on SAP AI Core usually run model calls through the Generative AI Hub orchestration service. It offers useful controls, and they are worth turning on.

• Content filtering with Azure Content Safety (hate, sexual, violence and self-harm thresholds, plus a prompt shield flag) or Llama Guard 3.
• Data masking through SAP Data Privacy Integration, with anonymization that removes sensitive values and pseudonymization that lets you restore them afterward.
• Grounding on your own documents, which keeps answers tied to approved content.

Two limits are worth knowing. The filters are configured per orchestration call, so a developer who skips them gets none. And content categories like hate or violence say nothing about a polite, well-formed instruction to change a bank account. A prompt shield helps with obvious jailbreak patterns. It is not built to know that remit-to changes from inbound email should never run without a callback.

Use the filters for what they are designed for, and put a separate rule on the tool call itself. Our prompt injection protection page shows how instructions hidden in documents and emails are caught before they turn into actions.

The highest-risk Joule surface for most US enterprises is not SAP's own agents. It is the custom agents your teams build in Joule Studio, and the outside agents you connect, because those call tools SAP does not govern.

The practical design is simple. Keep identity in SAP Cloud Identity Services. Route every MCP call from a custom agent that can write, pay or grant access through one enforcement point that holds the real credentials. Write rules on the arguments that matter, such as amount, payee, destination domain and record type. Hold anything that matches for a named approver, and keep the record somewhere the agent cannot edit. Our MCP gateway page shows where that point sits in front of a server.

If the same MCP servers are also used by agents on other platforms, one policy point beats one rule set per platform. We cover the same pattern for watsonx Orchestrate security and ServiceNow AI agents security.

SAP's AI pricing page, read on October 14, 2026, says Base AI is included in every SAP cloud subscription at no extra cost and needs no AI Units. Joule agents are priced on AI Units per action, and all SAP-delivered agents in 2026 are priced at 0.02 AI Units per agent action. AI Units are bought annually and expire after 12 months. Running custom-built agents in a productive Joule Studio runtime is free through the end of 2026, after which it is billed on consumption through the BTP Enterprise Agreement.

SAP does not publish a dollar price per AI Unit, so the number on your order form is a negotiation. The security budget lines that sit outside it are usually an identity review of agent scopes, Generative AI Hub filtering on custom agents, and an action gate for the custom agents that write outside SAP. We break the numbers down in our SAP Joule pricing and AI Units guide.

1. Inventory agents and owners. List every SAP-delivered agent you enabled and every custom Joule Studio agent, each with a named owner and a risk tier, as SAP itself recommends.
2. Review the roles behind agent users. An agent inherits the user's authority, so broad roles become broad agents. Fix role sprawl before you scale agents.
3. Turn on filtering and masking for custom agents. Configure Generative AI Hub content filtering and data masking on every orchestration call, not just the first one.
4. List the write tools. For each custom agent, list the MCP tools and APIs that change records, move money, send data out or grant access.
5. Gate those tools on arguments. Rules on amount, payee, destination and record type, with a named approver for matches. Read-only calls run without delay.
6. Keep credentials out of the agent. The enforcement point holds the real token. The agent never sees it.
7. Record decisions outside the tenant. Who approved what, with which values, and what the agent did next, retained on your schedule for SOX and internal audit.
8. Check data handling settings. Decide on Joule memory and the 365-day conversation log option deliberately, and keep regulated personal data out of prompts, as SAP's own guidance asks.

Four of six rows end without a purchase from us. If you run custom agents in financial processes, our financial services AI agents page covers the SOX evidence side, and the tool permissions page shows how argument rules are written.