@raishin/vanguard-frontier-agentic 2.10.0 → 2.13.0

package/skills/sap/sap-successfactors-hr-process-risk-review/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: sap-successfactors-hr-process-risk-review
+description: Review SAP SuccessFactors HR process risk: Employee Central data and role-based permissions (RBP), org and position management integrity, hire-to-retire process controls, payroll integration data flow, data privacy for PII and GDPR, and joiner-mover-leaver lifecycle governance. Escalates HR-sensitive and PII findings. Does not accept raw PII or touch live systems.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: compliance
+  lifecycle: experimental
+---
+
+# SAP SuccessFactors HR Process Risk Review
+
+## Purpose
+
+Assess HR process risk in SAP SuccessFactors deployments spanning Employee Central, role-based permissions (RBP), org and position management, hire-to-retire process controls, payroll integration, and joiner-mover-leaver (JML) lifecycle governance. Review Employee Central data model configuration for permission group design, permission role assignment, and access control boundary correctness. Assess org and position management integrity: position-to-headcount linkage, approval workflow configuration, and reporting line accuracy. Evaluate hire-to-retire process controls: onboarding workflow completeness, rehire duplicate prevention, termination action steps, and data archiving controls. Review payroll integration data flow governance: replication mapping correctness, payroll-relevant field access controls, and reconciliation controls between Employee Central and payroll processors. Assess data privacy posture: PII field visibility in Employee Central, GDPR-aligned consent management, data subject access and erasure readiness, and cross-border transfer controls. Review JML lifecycle governance: timely provisioning and deprovisioning, role change process completeness, and access certification coverage for HR data. Does not connect to live SuccessFactors tenants, accept raw PII records, or mutate any system configuration.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review Employee Central role-based permissions (RBP) configuration: permission groups, permission roles, target populations, and whether the principle of least privilege is applied to sensitive HR data (compensation, home address, national ID, bank details),
+- assess org and position management risk: whether positions are linked to approved headcount plans, whether the approval workflow for position creation or reclassification is enforced, and whether reporting line changes are governed and auditable,
+- evaluate hire-to-retire process controls: onboarding workflow step completeness, rehire duplicate-record detection, termination event action steps (access revocation, equipment return, final pay triggers), and whether data archiving policy is configured,
+- review payroll integration governance: field-level mapping between Employee Central and payroll processors (SAP Payroll, Ascent Payroll, third-party), data replication audit controls, and reconciliation process coverage for payroll-relevant changes,
+- assess SuccessFactors data privacy posture for GDPR or local privacy regulation compliance: PII field classification in Employee Central, consent management configuration, data subject access request process readiness, erasure workflow availability, and cross-border personal data transfer documentation,
+- review joiner-mover-leaver lifecycle governance: whether new hires receive appropriate access on day one, whether role changes trigger timely RBP updates, whether terminated employees are deprovisioned within the required window, and whether access certification campaigns cover HR data access,
+- assess SuccessFactors integration risk where Employee Central is the system of record: integration center configuration, data replication scope, error handling for failed replication events, and downstream system propagation of HR status changes.
+
+## When not to use
+
+- When the request requires connecting to a live SuccessFactors tenant, running Employee Central reports, or extracting actual employee records — this skill reviews configuration exports, process descriptions, RBP role lists, integration mapping documentation, and governance artifacts only.
+- When the request is about SAP HCM on-premise authorization objects (structural authorizations, HR master data authorizations in R/3 or ECC) rather than SuccessFactors cloud RBP.
+- When the request is about SAP Payroll on-premise configuration, payroll schema, or payroll wage type design rather than the integration governance between Employee Central and a payroll processor.
+- When the request is about SAP SuccessFactors Learning, Performance, or Recruiting modules as standalone governance topics unrelated to Employee Central data, RBP, or the hire-to-retire process.
+- When the request contains actual employee records, national IDs, bank account numbers, salary figures, or other raw PII — this skill does not accept, store, or process raw personal data. Request anonymized or pseudonymized descriptions instead.
+
+## Does not touch live systems
+
+This skill operates on user-provided RBP configuration exports, permission role and group lists, org chart descriptions, process flow documentation, integration center mapping exports, data privacy impact assessment summaries, and written descriptions of the HR governance posture. It does not connect to any SuccessFactors tenant, Employee Central API, Integration Center endpoint, or downstream payroll system. All live inspection is out of scope.
+
+## Lean operating rules
+
+- Classify findings by HR governance domain before recommending. Every finding must be assigned to a domain (RBP / Org and Position / Hire to Retire / Payroll Integration / Data Privacy / JML Lifecycle) before a remediation path is proposed.
+- RBP least privilege is the baseline. Any permission role that grants visibility to sensitive HR fields (compensation, bank details, national ID, home address, health data) beyond what the business function requires is a finding. Broadly scoped target populations that expose sensitive data to non-HR users are always flagged.
+- Sensitive HR field access must be role-justified. Access to compensation, bank details, national ID, home address, or health-related data fields in Employee Central must have a documented business justification in the permission role design. Absence of justification is a `high` finding.
+- JML delays are compliance failures. A terminated employee retaining active SuccessFactors access beyond the defined deprovisioning SLA is a `critical` finding. A new joiner without appropriate access on day one is a `high` finding.
+- Payroll integration errors require escalation. Failed or unresolved replication events between Employee Central and a payroll processor that affect payroll-relevant fields (pay grade, work schedule, bank details) are `high` findings requiring immediate payroll team review.
+- PII findings must not include raw data. When reviewing data privacy posture, assess field configuration and governance controls without requesting or accepting actual employee records, national IDs, bank account numbers, or health data. If the user supplies raw PII, redirect immediately — do not analyze the PII content.
+- GDPR erasure readiness must be assessed, not assumed. If the organization operates SuccessFactors in the EU or processes EU employee data, the existence of a tested erasure workflow in Employee Central is a compliance requirement. Absence of a tested erasure procedure is a `high` data privacy finding.
+- Escalate HR-sensitive findings to HR and legal. Any finding that involves unauthorized access to compensation, health data, or national IDs, or any confirmed PII exposure, must be escalated to HR leadership and legal or data protection team before further analysis or change is authorized.
+- Evidence from user-provided governance artifacts or official SAP SuccessFactors documentation takes precedence over inference.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in official SAP SuccessFactors Employee Central, RBP, or integration documentation (help.sap.com)
+- `user-provided evidence` — RBP configuration exports, permission role lists, org chart descriptions, integration mapping documentation, data privacy impact assessment summaries, or written process descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such
+
+## Live-environment rules and PII rules
+
+**This skill does not touch live systems.** There is no SuccessFactors API call, Employee Central OData query, Integration Center invocation, or payroll system connection in this skill's execution path.
+
+**PII rules for this review skill:**
+
+- Never accept, request, or process actual employee records, national ID numbers, bank account numbers, salary figures, home addresses, health data, or any other personal data identifying real individuals.
+- If the user provides raw PII in their message, do not analyze the PII content. Immediately redirect the user to provide an anonymized or pseudonymized description of the data structure or governance concern instead.
+- When assessing GDPR or data privacy posture, work from field configuration descriptions, data classification documentation, and process descriptions — not from actual employee data.
+- Do not request SuccessFactors admin credentials, OData API keys, Integration Center basic auth credentials, or SFTP passwords for payroll file transfers.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — HR governance domain taxonomy, risk classification, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common HR process risk review mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP SuccessFactors Employee Central, RBP, integration, and data privacy documentation.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: HR governance domain(s) affected (RBP / Org and Position / Hire to Retire / Payroll Integration / Data Privacy / JML Lifecycle) and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / inference.
+- **Risk level**: critical (terminated employee retaining access, confirmed PII exposure, unresolved payroll replication error affecting pay) / high (sensitive field over-permission, JML SLA breach, missing GDPR erasure workflow, unmitigated pay data access) / medium (governance gap, stale access certification, missing audit trail for org change) / low (best practice deviation, RBP design improvement).
+- **Recommended action**: specific remediation per finding (RBP role redesign, target population narrowing, JML SLA enforcement, payroll error escalation, GDPR erasure workflow implementation, access certification campaign, etc.).
+- **Refusal / escalation triggers**: if raw PII is supplied, redirect immediately and do not analyze the PII content. If confirmed unauthorized access to compensation or health data is found, escalate to HR leadership and legal before continuing. If live SuccessFactors access is required to complete the review, state that clearly and do not proceed.
+- **Business impact**: regulatory exposure (GDPR, local labor law, SOX for payroll controls), HR data breach risk, payroll error risk, or audit finding risk.
+- **Next verification step**: validate RBP remediation recommendations against current permission role assignments and Employee Central field configuration before implementing changes. Confirm payroll integration error resolution with the payroll processing team.

package/skills/sap/sap-successfactors-hr-process-risk-review/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP SuccessFactors HR Process Risk Review"
+  short_description: "Review SAP SuccessFactors HR process risk: Employee Central RBP permissions, org and position management, hire-to-retire process controls, payroll integration governance, GDPR data privacy, and joiner-mover-leaver lifecycle. Escalates HR-sensitive and PII findings."
+  default_prompt: "Use $sap-successfactors-hr-process-risk-review to assess the provided SAP SuccessFactors HR governance artifacts. Classify each finding by HR governance domain (RBP / Org and Position / Hire to Retire / Payroll Integration / Data Privacy / JML Lifecycle), assign a risk level (critical/high/medium/low), state evidence level (documentation-based / user-provided evidence / inference), and recommend specific remediation actions. Do not accept or analyze raw PII. Escalate any confirmed unauthorized access to compensation or health data to HR leadership and legal before continuing."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/role-based-permissions"
+      description: "SAP SuccessFactors Employee Central role-based permissions documentation — primary reference for RBP permission group and permission role design assessment"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-successfactors-hr-process-risk-review/metadata.json

@@ -0,0 +1,33 @@
+{
+  "id": "sap-successfactors-hr-process-risk-review",
+  "name": "SAP SuccessFactors HR Process Risk Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review SAP SuccessFactors HR process risk: Employee Central RBP role-based permissions, org and position management, hire-to-retire process controls, payroll integration governance, PII and GDPR data privacy, and joiner-mover-leaver lifecycle. Escalates HR-sensitive and PII findings. Does not accept raw PII or access live systems.",
+  "source_type": "original",
+  "category": "compliance",
+  "official_docs": [
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/role-based-permissions",
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/setting-up-role-based-permission",
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/position-management",
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/integration-with-sap-successfactors-employee-central",
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/data-privacy-and-protection",
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/personal-data-in-employee-central",
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/hire-and-rehire",
+    "https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/termination"
+  ],
+  "security_notes": "Does not access live SAP SuccessFactors tenants, Employee Central OData APIs, Integration Center endpoints, or payroll systems. Accepts only RBP configuration exports, permission role lists, org chart descriptions, integration mapping documentation, data privacy impact assessment summaries, or written process descriptions. Never accept, request, or process actual employee records, national ID numbers, bank account numbers, salary figures, home addresses, or health data. If raw PII is supplied, redirect immediately without analyzing the PII content. Confirmed unauthorized access to compensation or health data must be escalated to HR leadership and legal before further analysis.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-successfactors-hr-process-risk-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-successfactors-hr-process-risk-review/references/official-sources.md

@@ -0,0 +1,83 @@
+# Official sources — SAP SuccessFactors HR Process Risk Review
+
+Use this reference when grounding Employee Central RBP configuration assessment, org and position management review, hire-to-retire process control evaluation, payroll integration governance, data privacy and GDPR compliance assessment, and JML lifecycle review.
+
+**Evidence level**: documentation-based (SAP Help Portal, SAP SuccessFactors Employee Central implementation documentation). No live-system evidence is collected by this skill.
+
+## SAP SuccessFactors Employee Central — Role-Based Permissions (RBP)
+
+- Role-Based Permissions
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/role-based-permissions
+  source_owner: SAP SE
+  topic_supported: RBP model overview, permission groups, permission roles, target population configuration, field-level access control in Employee Central
+  why_needed: Primary reference for RBP design assessment — defines the permission group and permission role hierarchy, target population model, and field-level visibility controls used to classify RBP access risk findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Setting Up Role-Based Permission
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/setting-up-role-based-permission
+  source_owner: SAP SE
+  topic_supported: Step-by-step RBP configuration, permission role assignment to permission groups, target population scoping, sensitive data field permission categories
+  why_needed: Authoritative implementation reference for RBP configuration — required to assess whether sensitive HR data fields (compensation, national ID, bank details, home address) are correctly restricted to appropriate permission roles
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP SuccessFactors Employee Central — Org and Position Management
+
+- Position Management
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/position-management
+  source_owner: SAP SE
+  topic_supported: Position object configuration, position-to-headcount linkage, approval workflow for position creation and reclassification, position hierarchy and reporting line governance
+  why_needed: Defines the position management model in Employee Central — required to assess approval workflow enforcement, headcount plan linkage integrity, and reporting line change auditability
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP SuccessFactors Employee Central — Hire to Retire
+
+- Hire and Rehire
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/hire-and-rehire
+  source_owner: SAP SE
+  topic_supported: New hire workflow configuration, rehire duplicate detection, onboarding event triggers, hire event field completeness requirements
+  why_needed: Defines the hire and rehire event model — required to assess onboarding workflow step completeness, duplicate employee record prevention controls, and hire event field coverage for downstream system provisioning
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Termination
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/termination
+  source_owner: SAP SE
+  topic_supported: Termination event configuration, termination action steps (access revocation triggers, final pay event, equipment return workflow), data retention post-termination
+  why_needed: Defines the termination event model — authoritative reference for assessing whether termination action steps are complete, access revocation is triggered, and data archiving is configured correctly
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP SuccessFactors Employee Central — Integration
+
+- Integration with SAP SuccessFactors Employee Central
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/integration-with-sap-successfactors-employee-central
+  source_owner: SAP SE
+  topic_supported: Employee Central integration model, Integration Center configuration, data replication to payroll processors, field mapping scope, error handling for replication events
+  why_needed: Defines the Employee Central integration architecture — required to assess payroll integration field mapping correctness, replication error handling, and downstream system propagation of HR status changes
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP SuccessFactors Employee Central — Data Privacy and GDPR
+
+- Data Privacy and Protection
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/data-privacy-and-protection
+  source_owner: SAP SE
+  topic_supported: Data privacy framework in Employee Central, consent management, data subject access request process, data retention and archiving policy configuration, cross-border transfer controls
+  why_needed: Primary reference for GDPR and data privacy compliance assessment — defines the consent management model, data subject rights implementation (access, erasure, portability), and data retention configuration in Employee Central
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Personal Data in Employee Central
+  https://help.sap.com/docs/successfactors-employee-central/employee-central-implementation/personal-data-in-employee-central
+  source_owner: SAP SE
+  topic_supported: PII field classification in Employee Central, personal data entity types, sensitive data categories (national ID, bank details, compensation, health data), field visibility controls
+  why_needed: Authoritative reference for PII field identification — required to classify which Employee Central fields contain personal data and to assess whether field-level visibility controls are aligned with the data sensitivity level
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal and SuccessFactors Employee Central documentation describe the designed RBP model, position management configuration, hire-to-retire event model, integration framework, and data privacy capabilities. They do not prove which permission roles are assigned in the user's landscape, whether termination action steps are correctly configured, or whether GDPR erasure workflows have been tested. Users must supply RBP configuration exports, permission role lists, org chart descriptions, integration mapping documentation, data privacy impact assessment summaries, or written process descriptions for concrete assessment. Raw employee data, national IDs, bank account numbers, or salary figures must never be supplied.

package/skills/sap/sap-successfactors-hr-process-risk-review/references/safety-checklist.md

@@ -0,0 +1,38 @@
+# Safety checklist — SAP SuccessFactors HR Process Risk Review
+
+Use before making any HR governance finding or remediation recommendation, especially for findings involving RBP access, PII fields, GDPR compliance, payroll integration, or JML lifecycle controls.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live SuccessFactors tenant, Employee Central OData API, Integration Center endpoint, or payroll system. This skill reviews governance artifacts only.
+- Do not accept, request, or process actual employee records, national ID numbers, bank account numbers, salary figures, home addresses, health data, or any other personal data identifying real individuals. If the user supplies raw PII, redirect immediately — do not analyze the PII content.
+- Do not accept SuccessFactors admin credentials, OData API keys, Integration Center basic auth credentials, or SFTP passwords for payroll file transfers.
+- Do not recommend closing, deferring, or deprioritizing a finding of confirmed unauthorized access to compensation, health data, or national IDs without first escalating to HR leadership and legal or the data protection team.
+- Do not recommend changes to RBP permission roles, permission groups, or target populations in a production SuccessFactors tenant based on advisory review alone. All RBP changes require testing in a sandbox tenant and HR leadership sign-off.
+- Do not recommend removing a permission role from an active employee without confirming that the role removal will not block access required for the employee's current job responsibilities.
+- Do not validate GDPR compliance or confirm data subject rights readiness from memory alone. Direct the user to verify against the current SAP SuccessFactors data privacy documentation and applicable data protection regulation for their jurisdiction.
+- Do not assert that a terminated employee's access has been revoked without user-provided confirmation from an HR or IT system audit. Assume access is active until proven otherwise.
+
+## What people get wrong
+
+- **Confusing RBP permission groups with permission roles**: Permission groups define who holds a role (the grantee population); permission roles define what they can see or do (the permission). Access risk lies in the combination of role scope and target population, not in either alone. Reviewing permission roles without reviewing target population scope misses the most common over-permission pattern.
+- **Treating UI suppression as a security control**: Fields hidden in the Employee Central UI via theme or view configuration are not secured if the underlying RBP permission role grants field-level read access. RBP field-level permission is the authoritative access control — UI suppression is cosmetic.
+- **Missing JML triggered from manager self-service**: Managers can initiate job change events (promotions, transfers, cost center changes) in Employee Central without HR approval in some configurations. If manager-initiated job changes do not trigger RBP updates, the employee retains their previous access and the JML lifecycle is bypassed.
+- **Ignoring Integration Center as a data flow risk**: Integration Center replication jobs run on a schedule and can expose more employee data fields to downstream systems than intended. Integration field mapping scope should be reviewed against the principle of data minimization.
+- **Assuming erasure deletes integration copies**: Activating the Employee Central data erasure workflow deletes personal data from SuccessFactors but does not erase copies replicated to downstream payroll processors, third-party integration targets, or archived audit logs. A complete GDPR erasure process must cover all downstream copies.
+- **Conflating position management approval with headcount budget approval**: An approved position workflow in Employee Central confirms that HR and a manager approved the position object. It does not confirm that the position is within the approved headcount budget in a financial planning system. Both controls must be assessed separately.
+- **Overlooking rehire duplicate records**: When a previously terminated employee is rehired without using the correct rehire process, Employee Central may create a second active employee record. Duplicate records cause payroll and benefits errors and create incorrect JML audit trails. Rehire duplicate detection configuration must be assessed explicitly.
+
+## When to push back
+
+- Push back immediately when the user supplies actual employee records, national IDs, bank account numbers, or salary figures — redirect to provide anonymized or pseudonymized process descriptions instead.
+- Push back when the user asks to confirm GDPR compliance or data subject rights readiness from memory alone without providing data privacy impact assessment documentation or Employee Central data privacy configuration exports.
+- Push back when the request requires live SuccessFactors API access, OData query execution, or real-time HR report generation — state that live inspection is out of scope and ask the user to supply the relevant exports or summaries.
+- Push back when the user asks to approve closing a finding of confirmed unauthorized access to compensation or health data without HR leadership and legal escalation.
+- Push back when the user asks to recommend production RBP changes based solely on this advisory review — require sandbox testing and HR sign-off first.
+
+## Evidence labels
+
+- `documentation-based` — grounded in official SAP SuccessFactors Employee Central, RBP, integration, or data privacy documentation (help.sap.com)
+- `user-provided evidence` — RBP configuration exports, permission role lists, org chart descriptions, integration mapping documentation, data privacy impact assessment summaries, or written process descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such

package/skills/sap/sap-successfactors-hr-process-risk-review/references/workflow-and-output.md

@@ -0,0 +1,86 @@
+# Workflow and output contract — SAP SuccessFactors HR Process Risk Review
+
+Use this reference for all finding classification, risk level assignment, remediation path selection, and output formatting.
+
+## HR governance domain taxonomy
+
+| Domain | Finding class | Description |
+|--------|--------------|-------------|
+| `rbp` | `sensitive-field-over-permission` | Permission role grants visibility to compensation, national ID, bank details, home address, or health data beyond the documented business need |
+| `rbp` | `broad-target-population` | Target population scope exposes sensitive HR data to non-HR users, managers outside the relevant org unit, or system users without justification |
+| `rbp` | `missing-field-level-restriction` | Employee Central sensitive data fields are accessible without field-level permission control, relying only on UI suppression |
+| `rbp` | `direct-user-permission-group-assignment` | User assigned directly to a permission group rather than via a dynamic role or position-based rule, bypassing lifecycle governance |
+| `org-position` | `unenforced-position-approval` | Position creation or reclassification workflow not enforced — positions can be created without headcount plan approval |
+| `org-position` | `broken-reporting-line` | Reporting line in Employee Central does not match the approved org structure, with no audit trail for the discrepancy |
+| `org-position` | `headcount-plan-mismatch` | Filled or open positions do not match the approved headcount plan — over- or under-headcount not flagged |
+| `hire-to-retire` | `incomplete-onboarding-workflow` | Hire event action steps are missing required triggers (e.g., IT provisioning, equipment request, policy acknowledgment) |
+| `hire-to-retire` | `rehire-duplicate-not-detected` | Rehire process does not check for duplicate employee records, risking concurrent active records for the same individual |
+| `hire-to-retire` | `incomplete-termination-action-steps` | Termination event does not trigger access revocation, final pay, or equipment return within the required SLA |
+| `hire-to-retire` | `missing-data-archiving-policy` | No data retention or archiving policy is configured for terminated employee records in Employee Central |
+| `payroll-integration` | `unresolved-replication-error` | Failed replication event for a payroll-relevant field (pay grade, work schedule, bank details) is unacknowledged and unresolved |
+| `payroll-integration` | `missing-reconciliation-control` | No reconciliation process exists to validate that Employee Central payroll-relevant field changes are correctly propagated to the payroll processor |
+| `payroll-integration` | `over-broad-integration-field-mapping` | Integration Center mapping replicates more fields to the payroll processor than required — excess personal data transferred without justification |
+| `data-privacy` | `pii-field-unclassified` | Employee Central fields containing personal data are not classified by sensitivity level in the data privacy impact assessment |
+| `data-privacy` | `missing-erasure-workflow` | No tested erasure workflow exists for EU employee personal data in Employee Central — GDPR right-to-erasure compliance at risk |
+| `data-privacy` | `cross-border-transfer-undocumented` | Personal data replicated from Employee Central to a payroll processor or integration target in a different country without documented transfer basis |
+| `data-privacy` | `consent-management-absent` | No consent management configuration for optional personal data processing in Employee Central for the applicable jurisdiction |
+| `jml-lifecycle` | `termination-access-delay` | Terminated employee retains active SuccessFactors access beyond the defined deprovisioning SLA |
+| `jml-lifecycle` | `joiner-access-delay` | New joiner does not receive appropriate RBP access on the contracted start date |
+| `jml-lifecycle` | `mover-rbp-not-updated` | Internal transfer or promotion does not trigger an RBP update within the required window, leaving the employee with their previous role's access |
+| `jml-lifecycle` | `no-access-certification` | No periodic access certification campaign covers SuccessFactors RBP assignments for HR data access |
+
+## Risk classification
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | Terminated employee retaining active access; confirmed PII exposure (unauthorized access to national ID, bank details, health data, or compensation); unresolved payroll replication error directly affecting pay calculations |
+| `high` | Sensitive HR field over-permission without business justification; JML SLA breach (joiner or mover); missing GDPR erasure workflow for EU data; unresolved payroll replication error for payroll-relevant fields; broad target population exposing compensation or health data to non-HR users |
+| `medium` | Governance gap without immediate exposure risk: missing access certification, broken reporting line without confirmed fraud risk, incomplete onboarding workflow, undocumented cross-border transfer basis, missing data archiving policy |
+| `low` | Best practice deviation: direct user permission group assignment without lifecycle impact, missing field-level PII classification for non-sensitive fields, UI-only restriction without policy control |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this a terminated employee retaining active SuccessFactors access?**
+   - Yes → `critical`. Immediately deactivate the user in SuccessFactors and revoke all RBP assignments. Escalate to HR and IT security. Do not defer deprovisioning. State this explicitly.
+   - No → continue.
+
+2. **Is this confirmed unauthorized access to compensation, health data, national ID, or bank details?**
+   - Yes → `critical`. Escalate to HR leadership and legal or data protection team before any further analysis or remediation. Do not attempt to assess the scope of exposure without legal guidance.
+   - No → continue.
+
+3. **Is this a sensitive HR field over-permission without justification, or a missing GDPR erasure workflow?**
+   - Yes → `high`. Redesign the permission role to restrict sensitive field visibility to the minimum required population. For missing erasure workflow: implement the Employee Central data erasure capability and test with a dry run before production use.
+   - No → continue.
+
+4. **Is this an unresolved payroll replication error for a payroll-relevant field?**
+   - Yes → `high`. Escalate to the payroll processing team immediately. Validate that the payroll processor holds the correct value. If the error affects bank details or pay grade, treat as `critical` and escalate HR and payroll leadership.
+   - No → continue.
+
+5. **Is this a governance gap without confirmed exposure (missing certification, broken reporting line, undocumented transfer)?**
+   - Yes → `medium`. Initiate an access certification campaign to validate RBP assignments. Correct reporting line discrepancies with HR approval. Document the cross-border transfer basis per applicable regulation.
+   - No → classify as `low` and provide best practice guidance.
+
+## Workflow
+
+1. **Receive artifacts** — RBP configuration exports, permission role lists, org chart descriptions, integration mapping documentation, data privacy impact assessment summaries, or written process descriptions. Redirect immediately if raw PII is supplied.
+2. **Classify each finding** by HR governance domain and finding class above.
+3. **Assign risk level** per risk classification table (critical / high / medium / low).
+4. **Flag critical findings immediately** — terminated access retention, confirmed PII exposure, and critical payroll errors must be escalated before other remediation is discussed.
+5. **Apply remediation decision tree** per finding.
+6. **Prioritize** — critical JML and PII findings first; then high RBP and payroll findings; then medium governance gaps; then low best-practice items.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. HR governance domain and finding class per finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. RBP or JML detail (if applicable): permission role, permission group, target population, affected employee population, or integration field
+5. Recommended remediation action (RBP redesign, target population narrowing, termination action step addition, payroll error escalation, GDPR erasure workflow implementation, access certification campaign, etc.)
+6. HR compliance posture after remediation
+7. Escalation notice for critical PII or JML findings — explicit statement that HR leadership and legal must be engaged before proceeding
+8. Prioritized remediation sequence

package/skills/sap/sap-supply-chain-ibp-resilience-review/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: sap-supply-chain-ibp-resilience-review
+description: Review SAP Integrated Business Planning (IBP) and supply chain resilience posture: demand and supply planning configuration, Sales and Operations Planning (S&OP) process governance, inventory optimization and safety stock logic, statistical forecast accuracy and bias, IBP control tower alerts and exception management, scenario planning design, and supply chain risk coverage. Flags planning gaps, forecast blind spots, inventory policy misalignments, alert fatigue risks, and scenario planning deficiencies. Does not modify planning data, run supply plans, or mutate any live IBP system.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: data
+  lifecycle: experimental
+---
+
+# SAP Supply Chain IBP Resilience Review
+
+## Purpose
+
+Assess the planning configuration quality and supply chain resilience posture of SAP Integrated Business Planning (IBP) deployments. Evaluate demand planning configuration including statistical forecasting model selection, causal factors and promotions planning setup, lifecycle planning design, and consensus demand planning process governance. Assess supply planning configuration including capacity constraint modeling, network design alignment, supply heuristics and optimizer settings, and multi-echelon replenishment logic. Review Sales and Operations Planning (S&OP) process governance by evaluating S&OP cycle design in IBP for S&OP, meeting cadence governance, escalation and decision authority configuration, and plan version management. Analyze inventory optimization logic by reviewing safety stock calculation methods, service level target configuration, inventory stratification, and slow-moving or excess inventory monitoring. Assess statistical forecast accuracy and bias by reviewing error metric configuration (MAPE, WMAPE, bias), forecast accuracy dashboards, outlier correction process design, and whether forecast error drives planning model improvement. Evaluate IBP control tower alert design and exception management by reviewing alert rule completeness, alert threshold configuration, alert routing and ownership, and exception resolution governance to identify alert fatigue risks and coverage blind spots. Review scenario planning design by assessing what-if scenario configuration, scenario comparison capability, and whether scenario planning is integrated with the S&OP decision process. Does not connect to or mutate any live SAP IBP tenant, supply planning data, or integrated SAP S/4HANA system. Never modifies demand plans, supply plans, inventory targets, or control tower alert configurations.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review SAP IBP demand planning configuration: statistical forecasting algorithm selection (ARIMA, exponential smoothing, croston for intermittent demand), causal factor and promotions planning setup, lifecycle planning for new product introduction and end-of-life, consensus demand planning process design, and forecast override governance,
+- assess SAP IBP supply planning design: supply planning heuristic or optimizer configuration, capacity constraint modeling completeness (machine, labor, transport), network design alignment with physical supply chain, multi-echelon replenishment logic, and supply plan exception handling for capacity violations or supply shortfalls,
+- evaluate SAP IBP for S&OP process governance: S&OP cycle and review meeting design, plan version management and version control configuration, collaborative review participation coverage, escalation and decision authority configuration, and whether the S&OP process produces a single consensus plan or competing plan versions,
+- review IBP inventory optimization configuration: safety stock calculation method (statistical, time-series, demand-driven MRP), service level target assignment by product and location, inventory stratification (ABC/XYZ or equivalent), slow-moving and excess inventory identification logic, and inventory target review cadence,
+- assess forecast accuracy and bias monitoring: IBP forecast error metric configuration (MAPE, WMAPE, bias, tracking signal), forecast accuracy dashboard completeness, outlier detection and correction process design, whether statistically significant forecast bias is tracked and acted upon, and whether accuracy metrics drive model selection or parameter tuning reviews,
+- evaluate IBP control tower alert design and exception management: alert rule completeness across planning dimensions (demand deviation, supply shortfall, inventory below safety stock, transportation delay, supplier delivery performance), alert threshold calibration, alert ownership and routing configuration, exception resolution workflow, and whether alert volume creates alert fatigue that reduces actionable exception management,
+- review scenario planning design in SAP IBP: what-if scenario configuration (demand shock, supply disruption, capacity constraint), scenario comparison and financial impact quantification capability, integration of scenario outputs into the S&OP decision process, and whether scenario planning is conducted reactively (crisis) or proactively (resilience governance),
+- assess supply chain resilience coverage gaps: single-source-of-supply dependencies not covered by supply planning scenarios, geographic concentration in demand or supply not modeled as risk scenarios, lead time volatility not reflected in safety stock calculations, and whether IBP planning parameters are reviewed and updated in response to supply chain disruption events.
+
+## When not to use
+
+- When the user needs live inspection of SAP IBP planning data, active supply plans, demand forecasts, or control tower alerts — this skill accepts only user-provided configuration descriptions, planning parameter exports, accuracy metric reports, alert rule summaries, scenario descriptions, or written descriptions of the IBP landscape.
+- When the request is about SAP S/4HANA Production Planning (PP) or Manufacturing Execution (ME) execution-level scheduling without a supply chain planning resilience angle — this skill focuses on IBP planning configuration and resilience, not production shop floor execution.
+- When the request is about SAP Transportation Management (TM) route optimization or freight cost management rather than supply planning resilience — TM is a distinct execution platform.
+- When the request concerns SAP Ariba procurement sourcing event design or SAP S/4HANA Procurement processes without an IBP supply planning integration angle — use `sap-procurement-ariba-value-leakage-review` for procurement-specific assessment.
+- When the request is about SAP Analytics Cloud (SAC) advanced analytics modeling or data science pipeline design for demand forecasting outside the IBP platform — use a dedicated SAC or analytics skill.
+
+## Does not touch live systems
+
+This skill operates on user-provided configuration descriptions, planning parameter exports, S&OP process documentation, forecast accuracy metric reports, inventory policy summaries, control tower alert rule descriptions, scenario planning configuration notes, or written descriptions of the IBP and supply chain planning landscape. It does not connect to any SAP IBP tenant, SAP S/4HANA system, IBP Excel add-in session, IBP Fiori launchpad, or SAP Analytics Cloud. It does not create, modify, approve, or publish demand plans, supply plans, inventory targets, alert rules, or scenario configurations. All live inspection is out of scope.
+
+**This skill never modifies planning data.** No demand plan creation or modification, no supply plan run, no inventory target change, no alert configuration update, and no scenario activation is performed or recommended as a direct action in this skill's execution path. All remediation recommendations describe configuration and process design changes to be implemented and tested in a non-production IBP tenant before promoting to production.
+
+## Lean operating rules
+
+- Classify resilience findings before recommending. Every finding must be assigned to a planning domain (demand planning / supply planning / S&OP governance / inventory optimization / forecast accuracy / control tower / scenario planning / resilience coverage) before a remediation path is proposed.
+- Forecast bias is a first-order planning quality signal. Persistent systematic positive or negative bias in demand forecasts distorts supply plans, inventory targets, and S&OP decisions. Any confirmed forecast bias above a material threshold that is not being actively corrected is a `high` finding.
+- Safety stock calculated without lead time variability is structurally incomplete. Safety stock that only accounts for demand variability but ignores supplier lead time variability or replenishment cycle uncertainty underestimates buffer inventory requirements — especially for disruption-prone supply lanes.
+- Alert fatigue from excessive low-value alerts destroys the value of control tower monitoring. An alert design where more than 30% of daily alerts are resolved without action (noise) is a `medium` finding requiring threshold recalibration and alert hierarchy redesign.
+- Single-source supply dependencies not modeled in scenario planning are a `high` resilience gap. Any product or location with a single-source-of-supply that has not been modeled as a disruption scenario in IBP is an unquantified resilience risk.
+- S&OP without a single consensus plan is not S&OP. If the S&OP process produces competing plan versions across functions without a structured consensus and escalation path to a single approved plan, the S&OP process is a governance gap regardless of the cadence.
+- Inventory stratification that is not refreshed at least quarterly becomes stale. ABC/XYZ classification that does not reflect current demand patterns leads to misaligned service level targets and safety stock levels for products whose demand profile has changed.
+- Evidence from user-provided artifacts or official SAP IBP documentation takes precedence over inference.
+- Load only the reference needed for the IBP planning domain under review.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP Integrated Business Planning Help Portal documentation, SAP IBP configuration guides, SAP supply chain best practice documentation, or SAP S&OP governance guidance
+- `user-provided evidence` — planning parameter exports, S&OP process documentation, forecast accuracy reports, inventory policy summaries, control tower alert rule descriptions, scenario planning configuration notes, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no SAP IBP API call, IBP Excel add-in session, Fiori OData request, SAP S/4HANA RFC invocation, or direct database query in this skill's execution path. Users must supply planning parameter exports, S&OP process documentation, forecast accuracy metric reports, inventory policy summaries, control tower alert rule descriptions, scenario planning configuration notes, or written descriptions of their IBP and supply chain planning landscape for this skill to review.
+
+**This skill never modifies planning data.** Recommendations describing remediation always apply to configuration, planning parameter design, or process governance — not to direct demand plan modification, supply plan execution, inventory target change, or alert rule activation.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — IBP resilience finding taxonomy, severity assignment, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common IBP resilience review mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP IBP demand and supply planning, S&OP, inventory optimization, control tower, and scenario planning documentation.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: IBP planning domain(s) affected (demand planning / supply planning / S&OP governance / inventory optimization / forecast accuracy / control tower / scenario planning / resilience coverage) and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / inference.
+- **Risk level**: critical (supply plan cannot respond to a high-probability disruption scenario due to missing coverage; S&OP producing conflicting unconstrained plans with no governance resolution path) / high (persistent forecast bias distorting supply plan; safety stock not accounting for lead time variability in a disruption-exposed lane; single-source supply not in scenario planning; critical alert threshold misconfigured causing missed exception) / medium (alert fatigue from excessive low-value alerts; inventory stratification stale; S&OP cadence without structured escalation; scenario planning conducted reactively only) / low (best practice deviation in forecasting model selection or S&OP template design).
+- **Recommended action**: specific configuration or process remediation per finding (bias correction model parameter adjustment, safety stock calculation method update, single-source scenario addition, alert threshold recalibration, S&OP escalation path design, inventory stratification refresh schedule, scenario planning integration into S&OP cadence, etc.).
+- **Refusal / escalation triggers**: if a finding requires live IBP tenant inspection (active plan versions, real-time control tower alerts, current forecast accuracy metrics), state that live inspection is out of scope and ask the user to supply the relevant export or description. If a resilience gap represents an immediate supply disruption risk, flag for supply chain leadership escalation.
+- **Business impact**: service level risk (stockout probability increase), working capital impact (excess or insufficient inventory), supply chain disruption exposure (unmodeled single-source risk), S&OP decision quality degradation, or control tower effectiveness loss from alert fatigue.
+- **Next verification step**: confirm recommended configuration changes against the current IBP setup in a non-production IBP tenant before promoting to the production planning environment.

package/skills/sap/sap-supply-chain-ibp-resilience-review/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP Supply Chain IBP Resilience Review"
+  short_description: "Review SAP Integrated Business Planning (IBP) and supply chain resilience posture: demand and supply planning configuration, S&OP governance, inventory optimization, forecast accuracy and bias, IBP control tower alert design, and scenario planning coverage. Does not modify planning data or access live IBP systems."
+  default_prompt: "Use $sap-supply-chain-ibp-resilience-review to assess the provided SAP IBP configuration and supply chain planning data. Classify each finding by IBP planning domain (demand planning, supply planning, S&OP governance, inventory optimization, forecast accuracy, control tower, scenario planning, resilience coverage), assign a risk level (critical/high/medium/low), and recommend specific remediation actions. Flag any unmodeled single-source supply dependencies or persistent forecast bias for escalation. State evidence level (documentation-based, user-provided, inference) and confirm that no live IBP system access, demand plan modification, supply plan execution, or inventory target change is performed."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/demand-planning"
+      description: "SAP Integrated Business Planning documentation — primary reference for demand planning, supply planning, and resilience review"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-supply-chain-ibp-resilience-review/metadata.json

@@ -0,0 +1,32 @@
+{
+  "id": "sap-supply-chain-ibp-resilience-review",
+  "name": "SAP Supply Chain IBP Resilience Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review SAP Integrated Business Planning (IBP) and supply chain resilience posture: demand and supply planning configuration, S&OP governance, inventory optimization, forecast accuracy and bias, IBP control tower alert design, and scenario planning coverage. Does not modify planning data, run supply plans, or access live IBP systems.",
+  "source_type": "original",
+  "category": "data",
+  "official_docs": [
+    "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/demand-planning",
+    "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/supply-planning",
+    "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/sales-and-operations-planning",
+    "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/inventory-optimization",
+    "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/supply-chain-control-tower",
+    "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/scenario-planning",
+    "https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/forecast-accuracy-and-error-metrics"
+  ],
+  "security_notes": "Does not access live SAP IBP tenants, SAP S/4HANA systems, IBP Excel add-in sessions, IBP Fiori launchpads, or any production supply chain planning database. Accepts only user-provided configuration descriptions, planning parameter exports, S&OP process documentation, forecast accuracy metric reports, inventory policy summaries, control tower alert rule descriptions, scenario planning configuration notes, or written descriptions of the IBP and supply chain planning landscape. Never request or accept SAP IBP login credentials, API tokens, or direct planning database access. Never modifies demand plans, supply plans, inventory targets, alert rule configurations, or scenario data. Supply chain resilience findings that represent immediate disruption risk must be escalated to supply chain leadership — this skill does not approve plan changes or activate supply continuity measures.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-supply-chain-ibp-resilience-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-supply-chain-ibp-resilience-review/references/official-sources.md

@@ -0,0 +1,79 @@
+# Official sources — SAP Supply Chain IBP Resilience Review
+
+Use this reference when grounding demand planning assessment, supply planning design review, S&OP governance evaluation, inventory optimization analysis, forecast accuracy and bias monitoring review, control tower alert design assessment, and scenario planning coverage analysis.
+
+**Evidence level**: documentation-based (SAP Help Portal, SAP Integrated Business Planning documentation). No live-system evidence is collected by this skill.
+
+## SAP IBP — Demand Planning and Statistical Forecasting
+
+- SAP Integrated Business Planning — Demand Planning
+  https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/demand-planning
+  source_owner: SAP SE
+  topic_supported: Statistical forecasting algorithm configuration (ARIMA, exponential smoothing, Croston for intermittent demand), causal factor modeling, promotions planning, lifecycle planning (new product introduction, end-of-life), consensus demand planning process, forecast override governance
+  why_needed: Primary reference for assessing demand planning configuration quality and forecast model selection — defines the IBP statistical forecasting model and consensus planning framework used to classify demand planning findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP IBP — Supply Planning and Capacity Constraint Modeling
+
+- SAP Integrated Business Planning — Supply Planning
+  https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/supply-planning
+  source_owner: SAP SE
+  topic_supported: Supply planning heuristic and optimizer configuration, capacity constraint modeling (production, transport, storage), multi-echelon replenishment logic, network design alignment, supply plan exception handling for capacity violations and supply shortfalls, demand-driven MRP (DDMRP) integration
+  why_needed: Authoritative reference for assessing supply planning design and capacity modeling completeness — defines the IBP supply planning optimization model and exception handling framework used to classify supply planning findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP IBP — Sales and Operations Planning (S&OP)
+
+- SAP Integrated Business Planning for Sales and Operations
+  https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/sales-and-operations-planning
+  source_owner: SAP SE
+  topic_supported: S&OP cycle design, plan version management, collaborative review configuration, S&OP meeting cadence governance, escalation and decision authority configuration, consensus plan definition and version control
+  why_needed: Primary reference for assessing S&OP governance design — defines the IBP for S&OP process model, version management framework, and collaborative planning configuration used to classify S&OP governance findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP IBP — Inventory Optimization
+
+- SAP Integrated Business Planning — Inventory Optimization
+  https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/inventory-optimization
+  source_owner: SAP SE
+  topic_supported: Safety stock calculation methods (statistical, demand-driven), service level target configuration by product and location, inventory stratification (ABC/XYZ), slow-moving and excess inventory identification, multi-echelon inventory optimization, inventory target review cadence
+  why_needed: Defines the IBP inventory optimization model — required to classify safety stock calculation gaps, service level target misconfiguration, and inventory stratification staleness findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP IBP — Control Tower and Exception Management
+
+- SAP Integrated Business Planning — Supply Chain Control Tower
+  https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/supply-chain-control-tower
+  source_owner: SAP SE
+  topic_supported: Control tower alert rule configuration, alert threshold calibration, alert ownership and routing, exception resolution workflow design, alert hierarchy and prioritization, integration with SAP S/4HANA and IBP planning modules for alert triggering
+  why_needed: Primary reference for assessing control tower alert design completeness and exception management governance — defines the IBP control tower alert model used to classify alert coverage gaps and alert fatigue findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP IBP — Scenario Planning and What-If Analysis
+
+- SAP Integrated Business Planning — Scenario Planning
+  https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/scenario-planning
+  source_owner: SAP SE
+  topic_supported: What-if scenario configuration, scenario comparison and financial impact quantification, scenario version management, integration of scenario outputs into S&OP decision process, disruption scenario design (demand shock, supply disruption, capacity constraint)
+  why_needed: Defines the IBP scenario planning model — required to classify scenario planning coverage gaps, missing disruption scenarios, and whether scenario planning is integrated with the S&OP governance process
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP IBP — Forecast Accuracy and Error Metrics
+
+- SAP Integrated Business Planning — Forecast Accuracy and Error Metrics
+  https://help.sap.com/docs/SAP_IBP/sap-integrated-business-planning/forecast-accuracy-and-error-metrics
+  source_owner: SAP SE
+  topic_supported: Forecast error metric configuration (MAPE, WMAPE, bias, MAD, RMSE), statistical baseline error benchmarking, forecast value-add analysis, outlier detection and cleansing configuration, error tracking by planning level and time horizon in SAP IBP
+  why_needed: Defines the forecast accuracy monitoring framework — required to classify forecast bias accumulation findings, missing error metric coverage, and insufficient forecast review cadence governance
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP IBP documentation describes the designed planning model and configuration options for demand planning, supply planning, S&OP, inventory optimization, control tower, and scenario planning. It does not prove what forecasting algorithm is active in the user's IBP tenant, what safety stock parameters are configured, whether control tower alert thresholds are calibrated, or whether single-source supply dependencies have been modeled in scenario planning. Users must supply planning parameter exports, S&OP process documentation, forecast accuracy metric reports, inventory policy summaries, control tower alert rule descriptions, or written descriptions of their IBP planning landscape for concrete assessment.