Senior Principal Federal Security Engineer

The "chink in the armor": why your SAP SoD framework is the ultimate strategic guardrail. Publish Date: July 23, 2026 In the high-stakes world of enterprise resource planning, breaches rarely announce themselves with a siren. More often, they whisper. They happen through a tiny chink in the armor - a single user with just enough "over-permissioned" access to bypass a control. Consider this: According to the ACFE 2024 Report to the Nations, organizations lose an estimated 5% of revenue to fraud each year [[1]], with a lack of internal controls (like SoD) being the primary contributing factor in nearly one-third of cases. All it takes is one individual to expose your organization to massive financial loss or regulatory wrath - segregation of Duties (SoD) in SAP addresses this challenge head-on. By dividing user access, SoD ensures no single person possesses end-to-end control over critical business cycles. It's not just a compliance checkbox; it's a strategic defense against fraud, theft, and data misuse. The modern SAP minefield: why SoD is getting harder. Building a robust SoD framework was simpler when everything lived behind a local firewall. Today, the landscape is shifting under its feet for four primary reasons: * S/4HANA Complexity: Moving from ECC to S/4HANA isn't just a technical upgrade; it's a security overhaul. Fiori-based roles and embedded analytics introduce new permission layers. If you "lift and shift" legacy roles, you're likely migrating hidden risks into your brand-new environment. * The Cloud Explosion: As we plug in SAP Ariba, SuccessFactors, and Concur, we create "silos of risk." These systems often have separate permission models that don't talk to your core ERP, allowing users to accumulate dangerous cross-system access. * Invisible Third-Party Gaps: Integrating non-SAP procurement or banking tools creates access paths that can bypass native SAP checks. Without a holistic view, these violations remain invisible until an auditor raises a red flag - or a breach occurs. * Fragmented Identity: Using Azure AD or Okta for authentication adds flexibility but can fragment governance. Unless SoD checks span across every identity source, your enforcement will be inconsistent at best. Seven pillars of a mature SoD framework. A framework that actually works - rather than just looking good on paper - requires a blend of policy and technology. Ten steps to building your SAP SoD fortress. How do you turn these elements into a functioning program? Follow this roadmap: * Establish Governance: Form a steering committee with IT, Audit, and Business owners. If nobody "owns" the risk, nobody fixes it. * Identify Critical Processes: Map out where the money moves - finance, procurement, and HR are your high-stakes zones. * Catalog Roles: Break down what every role actually does. Identify where a single role can both initiate and approve a transaction. * Develop a Risk Matrix: Create a standard rule set that defines incompatible duties (e.g., "Vendor Setup" vs. "Payment Processing"). * Select Your Tech: Don't do this manually. Tools like SAP GRC Access Control or SAP Cloud IAG are non-negotiable for modern enterprises. * Redesign & Cleanse: Apply the Principle of Least Privilege. Remove conflicts and, where unavoidable, implement compensating controls such as transaction logging. * Embed in the Lifecycle: Automate SoD checks so that no new user gets conflicting access by default during onboarding. * Quarterly Reviews: Business owners should validate their team's access at least twice a year. * Monitor & Remediate: Use real-time dashboards to track violations and trends. * Continuous Improvement: Audit your own framework. As your business changes, your SoD rules must evolve with it. Leveraging the right tools: the SAP advantage. Managing SoD at scale requires more than a spreadsheet and a prayer. * SAP GRC Access Control: The gold standard for automating role analysis and risk reporting. To take this further, YASH Technologies enhances GRC implementations with predictive analytics and custom rule sets to align controls with specific business goals. * SAP Cloud Identity Access Governance (IAG): Your bridge for hybrid landscapes, extending SoD into Ariba and S/4HANA Cloud. * SAP Fiori Apps: These provide intuitive dashboards for managers, making it easier for non-technical leaders to spot and stop risks. * Third-Party Integration: For multi-vendor environments, tools like SailPoint or Saviynt can be integrated with SAP GRC to centralize identity across the entire enterprise. For organizations looking to accelerate this journey and proactively close SoD control gaps, YASH Technologies' SAP GRC solutions provide advanced capabilities for automated SoD analysis, real-time risk monitoring, and streamlined remediation workflows. To learn more, connect with its SAP experts at [email protected].

Saviynt expands Identity Security for AI solution with Intent-Aware Runtime authorisation for AI agents. Saviynt | Published 16 June 2026 New capabilities in Saviynt's Agent Access Gateway help enterprises control AI agent actions at runtime; new identity verification features reduce identity impersonation risk Saviynt, a leading provider of identity security, today released major enhancements to its Agent Access Gateway - a runtime authorisation layer that controls what AI agents can do as they interact with applications, data, APIs, tools, infrastructure, and other agents. As enterprises move AI agents from experimentation into production, security teams face a new access problem. Agents can reason, adapt, and execute thousands of actions across business systems within seconds. Traditional access controls, which were designed for human users and static applications, cannot always determine whether an agent's action is appropriate the moment it occurs. Saviynt's Agent Access Gateway addresses this challenge by enforcing policy at runtime. Today's release introduces Intent-Aware Runtime Authorization(TM)(IARA), a new capability that evaluates AI agent actions in real time based on identity, context, policy, and intent. If an action falls outside approved boundaries, Saviynt can block it and generate an audit event at runtime. With IARA, organisations can protect sensitive resources from unintended or unauthorised actions. "AI agents are becoming a new class of enterprise identity - autonomous, powerful, and capable of taking action across critical business systems," said Vibhuti Sinha, Chief Product Officer, Saviynt. "Agent Access Gateway gives enterprises a way to control AI agent behaviour at runtime, when decisions actually happen. With IARA, organisations can move beyond static permissions and make access decisions based on what an agent is trying to do, why it is doing it, and whether that action should be allowed." Along with IARA, Saviynt also announced expanded capabilities within its broader Identity Security for AI solution to help organisations address identity governance and security posture across the entire AI ecosystem. Agent Access Gateway now enables organisations to: * Evaluate AI agent actions at runtime, in real-time, based on identity, context, policies, and intent * Control an agent's access to tools at runtime using static and dynamic policies * Determine who an AI agent acts for by recognizing whether it carries out actions independently, on behalf of a human, or via another AI agent. As AI agents increasingly interact with humans and other agents, governance should apply to every access. For example, a sales operations agent may be authorized to access CRM data to summarise a customer opportunity. But if that agent then attempts to export customer records, modify pricing terms, or trigger outbound communications, the critical question is whether those actions match the user's original intent - not simply whether the agent is technically authorised to perform them. Saviynt's intent-aware runtime enforcement is designed to identify that mismatch at runtime and prevent the action before it occurs. The latest release also features new inbound and outbound access controls for AI agents, bringing identity governance principles to autonomous systems. Organisations can now govern who is authorised to interact with AI agents and what applications, data, and resources those agents are permitted to access. This enables enterprises to enforce least privilege, strengthen accountability, and reduce the risk of unauthorised AI actions at scale. Saviynt's Identity Security for AI control plane enables AI agent visibility, management, governance, and access across every layer of the stack - where they're built, where they run, and the enterprise applications where they take action. The latest release extends Saviynt's ecosystem of native integrations to include Microsoft Foundry, N8N, Snowflake Cortex, and more. Additionally, Saviynt introduced new identity verification capabilities to help organisations reduce impersonation risk as AI assistance makes fraud, social engineering, and unauthorised access attempts easier to execute. New capabilities also provide high-assurance identity verification directly within the Saviynt platform for human identity certification, including biometric scanning, selfie photos, liveness detection, and support for more than 4,000 government-issued document formats across more than 177 countries. Together, these capabilities help organisations address two of the most urgent AI-related security challenges facing enterprises today: controlling agent access at runtime and reducing identity impersonation risk. Saviynt will demonstrate Saviynt Agent Access Gateway, including IARA, as well as owner recommendation for lifecycle governance, and identity verification capabilities at Identiverse. Attendees can visit Saviynt at booth 501 to see how Saviynt helps enterprises control agent access at runtime and strengthen identity assurance across the AI ecosystem. A free trial of Saviynt's Identity Security for AI product is available here. About Saviynt. Saviynt is a leading provider of identity security solutions that help organizations secure and govern access for all identities across the enterprise. The Saviynt platform enables organisations to manage identity governance, application access, privileged access, external identities, non-human identities, and AI agents through a unified, intelligent platform. Saviynt helps customers reduce risk, strengthen compliance, and enable secure digital transformation at enterprise scale.