SAP says enterprise AI agents need knowledge graphs and governance, not just chatbots

SAP says the shift from corporate chatbots to autonomous AI agents that carry out business processes on their own requires more than just a stronger language model. The company is betting on two pillars: knowledge graphs that embed agents in a specific enterprise context, and a governance layer that controls what an agent is allowed to do.

From chatbot to colleague

McPhee described the moment when an AI agent stops being an assistant that answers questions and starts acting like a team member. In his view, that happens once the system gains access to a company's actual context, rather than just the general knowledge large language models are trained on.

Where we start to see more emergent behavior, where it feels like a colleague rather than an assistant, is where we're able to provide context about the actual enterprise - Max McPhee, senior solution advisor, SAP

That context is meant to come from the SAP Knowledge Graph, a semantic layer linking data on customers, suppliers, orders and processes to SAP's domain models. Instead of guessing at the meaning of industry terms, the agent is meant to read relationships between concrete objects in a company's system: invoices, orders, business partners.

Governance as foundation, not add-on

The second pillar of SAP's strategy is governance: a set of mechanisms controlling the permissions, identity and accountability of AI agents. McPhee compared onboarding a new agent to onboarding a new employee, who has to go through defined access pathways before being given freedom to act.

When you're onboarding a new agent, I think it's important to recognize how you would onboard a new employee - Max McPhee, senior solution advisor, SAP

SAP argues this is an area where it holds a natural advantage as a company with a fifty-year history in business process automation. Controls that once policed standard workflows are now meant to evolve toward overseeing systems that operate with more decision-making freedom than classic automation.

A problem beyond SAP's own backyard

SAP's biggest challenge, though, isn't its own systems but the rest of a customer's IT environment. Companies building AI agents have to account for decades of custom deployments, third-party systems and local modifications that SAP doesn't directly see. The answer is meant to come from acquisitions: LeanIX, which specializes in mapping IT architecture, and Signavio, which handles process mining.

You're only 10 percent of my environment - Max McPhee, senior solution advisor, SAP, quoting SAP customers

The new Business AI Platform architecture

SAP ties all these elements together in the Business AI Platform, a consolidation of its existing Business Technology Platform, Business Data Cloud and Business AI stack into a single structure, split into a context layer (SAP and non-SAP data plus process knowledge), a build layer (based on the updated Joule Studio 2.0) and a governance layer (tracking every agent across the company). Joule Studio 2.0 itself provides Agent Hub for managing agent lifecycles, Process Insights for analyzing their behavior, and a runtime environment with built-in control mechanisms.

You have to upgrade the track first if you want to drive a Ferrari - Max McPhee, senior solution advisor, SAP

What this means for businesses

For enterprises running SAP systems, the message is a practical one: before an AI agent gets the right to issue orders, approve payments or modify data on its own, a company needs a well-organized map of its own processes and clearly defined permissions. Without that, an autonomous agent can act faster than previous automation, but it can also make costly mistakes faster.

This approach fits into a broader trend in the enterprise software industry, where vendors like SAP, Salesforce and Microsoft are racing to build governance layers over agents instead of focusing solely on the capabilities of the models themselves. The signal for Polish companies using SAP is similar: deploying AI agents starts with getting data and processes in order, not with picking the strongest model.