@raishin/vanguard-frontier-agentic 2.11.0 → 2.13.0

package/skills/sap/sap-joule-governance-adoption-review/references/workflow-and-output.md

@@ -0,0 +1,81 @@
+# Workflow and output contract — SAP Joule Governance and Adoption Review
+
+Use this reference for all finding classification, risk level assignment, remediation path selection, and output formatting.
+
+## Joule governance domain taxonomy
+
+| Domain | Finding class | Description |
+|--------|--------------|-------------|
+| `scope-grounding` | `unapproved-skill-activation` | Joule skill or action enabled for a connected SAP solution that has not been through the organization's Joule rollout approval process |
+| `scope-grounding` | `write-back-without-confirmation` | Joule action skill that creates, updates, or deletes records in an underlying SAP system without an explicit user confirmation step |
+| `scope-grounding` | `overly-broad-capability-scope` | Joule capabilities activated for a user population broader than required — end users with access to skills intended for managers or administrators |
+| `data-access-boundary` | `authorization-bypass-risk` | Joule can surface data that the user is not authorized to see in the underlying SAP application — authorization model not correctly enforced in Joule context |
+| `data-access-boundary` | `cross-application-unreviewed-aggregation` | Joule aggregates data across multiple connected SAP systems for a user without a governance review of the user's cross-system access rights |
+| `data-access-boundary` | `sensitive-data-in-joule-response` | Joule responses include sensitive business data (compensation, financial positions, procurement prices, personal data) visible to users who are not authorized for that data in the underlying system |
+| `auditability` | `no-interaction-logging` | Joule interaction logging not enabled for a deployment in a regulated or compliance-sensitive business process |
+| `auditability` | `log-access-not-restricted` | Joule interaction logs are accessible without role restriction — any user or administrator can read logs containing other users' prompt content |
+| `auditability` | `insufficient-log-retention` | Joule interaction log retention period does not meet the organization's audit or regulatory requirements |
+| `role-aware-config` | `role-context-not-configured` | Joule role-aware context configuration has not been set up for one or more connected SAP solutions — Joule may not tailor responses to the user's business role |
+| `role-aware-config` | `role-misconfiguration-over-disclosure` | Incorrect role-aware context configuration causes Joule to surface data appropriate for a more privileged role than the user holds |
+| `hallucination-risk` | `regulated-workflow-no-verification` | Joule is used in a financial, HR, legal, or procurement decision workflow without a documented human verification requirement before actioning the output |
+| `hallucination-risk` | `no-source-attribution` | Joule responses for compliance-relevant queries do not include source attribution or grounding data citation |
+| `hallucination-risk` | `no-acceptable-use-training` | End users have not received training on Joule output validation — over-trust risk not mitigated through user awareness |
+| `change-management` | `no-acceptable-use-policy` | No documented acceptable-use policy exists defining permitted and prohibited uses of Joule, output validation requirements, and escalation paths |
+| `change-management` | `no-rollout-governance-process` | No documented process exists for approving and activating additional Joule capabilities beyond the initial deployment |
+| `change-management` | `no-feedback-monitoring-mechanism` | No feedback or monitoring mechanism exists to detect Joule misuse, over-reliance, or systematic output quality issues post-deployment |
+
+## Risk classification
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | Confirmed Joule data access boundary breach: Joule surfaces data the user is not authorized to see in the underlying SAP system; cross-application aggregation exposes regulated personal data without authorization |
+| `high` | Write-back skill without confirmation step; cross-application unreviewed data aggregation; no interaction logging for a regulated business process; regulated workflow with no human verification requirement for Joule outputs; role misconfiguration causing over-disclosure of sensitive business data |
+| `medium` | Missing acceptable-use policy; untested role-aware configuration; insufficient log retention; no feedback and monitoring mechanism; no source attribution for compliance-relevant responses |
+| `low` | Best practice deviation in rollout governance materials, adoption documentation, or monitoring coverage without immediate risk |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this a confirmed Joule data access boundary breach (Joule surfaces unauthorized data)?**
+   - Yes → `critical`. Immediately restrict the affected Joule capability or suspend the connected system integration. Escalate to the security and data protection team. Do not resume the capability until the authorization boundary is confirmed to be enforced. State this explicitly.
+   - No → continue.
+
+2. **Is this a write-back skill without an explicit confirmation step?**
+   - Yes → `high`. Disable the write-back skill until a confirmation step is implemented in the Joule skill configuration or the connected SAP system workflow. Document the required confirmation UX and approval path before re-enabling.
+   - No → continue.
+
+3. **Is this a regulated workflow (financial, HR, legal, procurement) with no human verification requirement?**
+   - Yes → `high`. Define and document a human verification requirement for the affected workflow. Add an explicit policy statement in the acceptable-use policy that Joule outputs in this workflow must be verified by a qualified human before actioning. Train affected users.
+   - No → continue.
+
+4. **Is this missing interaction logging for a compliance-sensitive deployment?**
+   - Yes → `high`. Enable Joule interaction logging per SAP Joule administration documentation. Restrict log access to authorized roles. Define and document a log retention policy meeting the organization's audit requirements.
+   - No → continue.
+
+5. **Is this a governance process or policy gap (missing acceptable-use policy, no rollout governance, untested role configuration)?**
+   - Yes → `medium`. Draft the acceptable-use policy covering permitted uses, prohibited uses, output validation requirements, and escalation paths. Define a rollout governance process for capability additions. Test role-aware configuration in a sandbox environment.
+   - No → classify as `low` and provide adoption best practice guidance.
+
+## Workflow
+
+1. **Receive artifacts** — Joule configuration documentation, skill activation lists, data access boundary descriptions, audit log configuration summaries, acceptable-use policy documents, training material descriptions, or written governance posture descriptions.
+2. **Classify each finding** by Joule governance domain and finding class above.
+3. **Assign risk level** per risk classification table (critical / high / medium / low).
+4. **Flag critical findings immediately** — confirmed data access boundary breaches must be escalated before other remediation is discussed.
+5. **Apply remediation decision tree** per finding.
+6. **Prioritize** — critical data boundary findings first; then high write-back, logging, and regulated workflow findings; then medium policy and configuration gaps; then low adoption best-practice items.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Joule governance domain and finding class per finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. Capability or workflow detail (if applicable): Joule skill name or type, connected SAP solution, affected user population, or business process
+5. Recommended governance control per finding (skill deactivation, confirmation step addition, interaction logging enablement, role-aware config correction, verification policy, acceptable-use policy, etc.)
+6. Joule governance posture after remediation
+7. Escalation notice for confirmed data access boundary breaches — explicit statement that security and data protection team must be engaged before resuming the affected capability
+8. Prioritized remediation sequence

package/skills/sap/sap-license-btp-consumption-finops-review/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: sap-license-btp-consumption-finops-review
+description: Advisory FinOps review of SAP licensing and BTP consumption under CPEA and other commercial models: entitlement vs actual consumption, overage and underutilization patterns, cost allocation, commitment optimization, FUE and digital access licensing, and BTP service cost drivers. Does not touch or mutate any live system.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: finops
+  lifecycle: experimental
+---
+
+# SAP License and BTP Consumption FinOps Review
+
+## Purpose
+
+Assess the cost and licensing posture of an SAP landscape using FinOps principles. Evaluate SAP software license entitlements versus actual consumption, identify overage charges and underutilized license blocks, review BTP consumption under the Cloud Platform Enterprise Agreement (CPEA) or other commercial models, analyze cost allocation across teams and use cases, surface commitment optimization opportunities, assess Full Use Equivalent (FUE) and digital access licensing exposure, and identify the primary BTP service cost drivers. Surface licensing gaps, consumption inefficiencies, incorrect license type assignments, and commercial model mismatches that drive unnecessary spend. Does not connect to or mutate any live system, SAP for Me portal, or SAP licensing management platform.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review SAP software license entitlements versus actual system usage to identify overage or underutilization,
+- assess BTP consumption under CPEA, Pay-As-You-Go, or subscription commercial models for cost optimization,
+- identify which BTP services are the primary cost drivers and evaluate whether consumption is proportionate to business value delivered,
+- review FUE licensing and digital access user type assignments for correct classification and cost efficiency,
+- assess cost allocation practices for BTP and SAP license spend across business units, cost centers, or projects,
+- identify SAP license commitment optimization opportunities (right-sizing, license type conversion, consolidation),
+- review the commercial model fit between the customer's consumption pattern and their current SAP commercial agreement,
+- prepare for SAP license audit readiness or True-Up negotiations,
+- evaluate indirect access or digital access risk from third-party integrations reading or writing SAP data,
+- support an annual BTP or SAP license budget review or cost challenge.
+
+## When not to use
+
+- When the request requires live access to SAP for Me, the SAP License Administration Workbench (LAW), BTP cockpit usage data, or any live measurement tool — this skill accepts only user-provided consumption reports, entitlement summaries, or written descriptions.
+- When the request concerns RISE with SAP contract SLA and vendor risk — use `sap-rise-sla-vendor-risk-review`.
+- When the request concerns BTP account model governance (subaccount structure, entitlement sprawl, role collections) — use `sap-btp-governance-review`.
+- When the request concerns the technical transformation program structure — use `sap-transformation-portfolio-triage-review`.
+- When the request requires legal advice on SAP contract terms — this skill provides advisory cost classification, not legal counsel.
+
+## Does not touch live systems
+
+This skill operates on user-provided license entitlement reports, SAP for Me exports, BTP consumption reports, commercial model summaries, cost allocation data, or written descriptions of the SAP licensing and BTP consumption posture. It does not connect to SAP for Me, the License Administration Workbench, the BTP cockpit, the SAP Global License Audit and Compliance team portal, or any live environment. All live inspection is out of scope.
+
+## Lean operating rules
+
+- Classify spend before optimizing. Every license or consumption finding must be classified by license or cost category before an optimization recommendation is made.
+- Distinguish entitlement from consumption. An entitlement is the right to use a capability. Consumption is the actual measured use. Optimization findings live in the gap between the two — either overage (consumption exceeds entitlement) or underutilization (entitlement exceeds consumption).
+- BTP commercial models have different optimization levers. CPEA is a prepaid credit model — unspent credits expire. Pay-As-You-Go has no commitment but higher unit rates. Subscription is fixed capacity. The correct optimization depends on the model in use.
+- FUE is the primary SAP on-premise and RISE license metric. Named User licenses in SAP are counted as FUEs. The FUE value of each named user type (Professional, Limited, Self-Service) differs. Incorrect type assignments are the most common source of license audit exposure.
+- Digital access licenses cover machine-to-machine document creation. Third-party systems that create SAP documents (orders, invoices, goods receipts) via integration may require digital access licenses. This is a common source of indirect access audit findings.
+- Cost allocation requires metered consumption data. Cost allocation recommendations require BTP service consumption data at subaccount or project level. Without this data, cost allocation assessments are advisory only.
+- Commitment optimization follows a forecast-to-actuals comparison. CPEA credit optimization requires comparing forecasted consumption against actual burn rate and identifying services where consumption is consistently under or over the forecast.
+- Do not recommend license type downgrades without confirming the functional scope the user actually uses. A Limited User license that is performing Professional User functions is a compliance exposure, not a cost optimization opportunity.
+- Evidence from user-provided consumption data or official SAP licensing and BTP commercial model documentation takes precedence over inference.
+- Load only the reference needed for the license or cost domain under review.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP BTP commercial model documentation, SAP licensing guidelines, SAP product-specific supplement documents, or SAP price list definitions
+- `user-provided evidence` — license entitlement reports, BTP consumption exports, SAP for Me data, cost allocation summaries, or commercial model descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official SAP documentation or user-provided evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no API call, SAP for Me portal access, License Administration Workbench connection, BTP cockpit session, or any live measurement tool access in this skill's execution path. Users must supply license entitlement reports, BTP consumption data exports, commercial model summaries, or written descriptions of their SAP licensing and BTP consumption posture for this skill to review.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — license and consumption category taxonomy, FinOps finding severity, optimization path decision criteria, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common licensing misclassification mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP BTP commercial model documentation, CPEA pricing, FUE and digital access licensing guidelines, SAP pricing and licensing resources.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: license or cost domain(s) affected (FUE and named user licensing / digital access / BTP CPEA consumption / BTP service cost drivers / cost allocation / commercial model fit / True-Up and audit readiness) and specific finding(s).
+- **Evidence used**: documentation-based / user-provided evidence / inference.
+- **Risk level**: critical (active overage creating immediate audit or compliance exposure) / high (material underutilization of paid commitment or incorrectly classified license type with audit risk) / medium (cost allocation gap or commercial model mismatch with optimization opportunity) / low (best practice deviation in license management process).
+- **Recommended action**: specific FinOps optimization per finding (right-size license type, convert commercial model, reallocate CPEA credits, enable cost allocation tagging, reclassify digital access users, prepare True-Up evidence).
+- **Refusal / escalation triggers**: if live SAP for Me data, LAW measurement output, or BTP cockpit consumption data is required to complete the assessment, state that clearly and request the user provide the relevant exports. If legal interpretation of license terms is required, escalate to SAP licensing counsel.
+- **Business impact**: overage cost exposure, audit penalty risk, budget overrun risk, or opportunity cost from unused committed spend.
+- **Next verification step**: validate license consumption findings against current SAP for Me entitlement data and BTP cockpit consumption reports before initiating True-Up or renegotiation.

package/skills/sap/sap-license-btp-consumption-finops-review/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP License and BTP Consumption FinOps Review"
+  short_description: "Advisory FinOps review of SAP licensing and BTP consumption: entitlement vs consumption gaps, overage and underutilization, CPEA credit burn, FUE and digital access classification, cost allocation, and commitment optimization."
+  default_prompt: "Use $sap-license-btp-consumption-finops-review to assess the provided SAP licensing and BTP consumption posture. Classify each finding by domain (FUE and named user licensing, digital access, BTP CPEA consumption, BTP service cost drivers, cost allocation, commercial model fit, True-Up and audit readiness), assign a risk level (critical/high/medium/low), and recommend specific FinOps optimization actions. State evidence level for each finding and escalate to SAP licensing counsel when contract interpretation is required."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/btp/sap-business-technology-platform/what-is-consumption-based-commercial-model"
+      description: "SAP BTP consumption-based commercial model documentation — primary reference for CPEA, Pay-As-You-Go, and subscription model mechanics and optimization levers"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-license-btp-consumption-finops-review/metadata.json

@@ -0,0 +1,32 @@
+{
+  "id": "sap-license-btp-consumption-finops-review",
+  "name": "SAP License and BTP Consumption FinOps Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Advisory FinOps review of SAP licensing and BTP consumption under CPEA and other commercial models: entitlement vs consumption, overage and underutilization, cost allocation, commitment optimization, FUE and digital access licensing, and BTP service cost drivers. Does not access live systems.",
+  "source_type": "original",
+  "category": "finops",
+  "official_docs": [
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/what-is-consumption-based-commercial-model",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/cloud-platform-enterprise-agreement",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/commercial-models",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/monitor-usage-and-costs",
+    "https://support.sap.com/en/my-support/license-audit-and-compliance.html",
+    "https://www.sap.com/products/erp/s4hana/digital-access.html",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/managing-entitlements-and-quotas-using-the-cockpit"
+  ],
+  "security_notes": "Does not access live SAP systems, SAP for Me, the License Administration Workbench, BTP cockpit usage data, or SAP Global License Audit and Compliance portals. Accepts only user-provided license entitlement reports, BTP consumption exports, commercial model summaries, or written descriptions of the SAP licensing posture. Never request or accept SAP contract portal credentials, customer-specific contract pricing, or confidential True-Up negotiation data. Cost and licensing findings are advisory only and do not constitute legal or contractual advice — SAP licensing counsel must be engaged for binding interpretation of license terms.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-license-btp-consumption-finops-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-license-btp-consumption-finops-review/references/official-sources.md

@@ -0,0 +1,71 @@
+# Official sources — SAP License and BTP Consumption FinOps Review
+
+Use this reference when grounding license category classification, BTP commercial model assessment, consumption optimization guidance, FUE and digital access licensing evaluation, and cost allocation best practices.
+
+**Evidence level**: documentation-based (SAP BTP Help Portal, SAP Support Portal, SAP product documentation). No live-system evidence is collected by this skill.
+
+## BTP commercial models
+
+- What Is the Consumption-Based Commercial Model
+  https://help.sap.com/docs/btp/sap-business-technology-platform/what-is-consumption-based-commercial-model
+  source_owner: SAP SE
+  topic_supported: Overview of BTP consumption-based commercial model, differences between CPEA, Pay-As-You-Go, and subscription options, credit unit mechanics
+  why_needed: Primary reference for understanding the BTP commercial model landscape — required to classify the user's commercial model before assessing optimization levers
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Cloud Platform Enterprise Agreement (CPEA)
+  https://help.sap.com/docs/btp/sap-business-technology-platform/cloud-platform-enterprise-agreement
+  source_owner: SAP SE
+  topic_supported: CPEA credit model, credit consumption mechanics, service pricing under CPEA, credit expiry, CPEA entitlement management, forecasting and budget controls
+  why_needed: Canonical reference for CPEA credit optimization — defines how credits are consumed, how services are priced against credits, and how unused credits expire; required for all CPEA FinOps assessments
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- BTP Commercial Models Overview
+  https://help.sap.com/docs/btp/sap-business-technology-platform/commercial-models
+  source_owner: SAP SE
+  topic_supported: Comparison of BTP commercial models (CPEA, subscription, Pay-As-You-Go), service eligibility per model, switching between models, model selection criteria
+  why_needed: Required to assess commercial model fit — determines whether the user's consumption pattern is better served by CPEA, subscription, or Pay-As-You-Go and identifies mismatches that drive unnecessary spend
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## BTP consumption monitoring and cost management
+
+- Monitor Usage and Costs
+  https://help.sap.com/docs/btp/sap-business-technology-platform/monitor-usage-and-costs
+  source_owner: SAP SE
+  topic_supported: BTP cockpit usage and cost monitoring, consumption reports, cost center allocation, budget alerts, subaccount-level cost visibility
+  why_needed: Defines the SAP-native cost monitoring capabilities — required to assess whether the user has adequate visibility into BTP consumption and cost allocation, and to identify gaps in cost observability
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Managing Entitlements and Quotas Using the Cockpit
+  https://help.sap.com/docs/btp/sap-business-technology-platform/managing-entitlements-and-quotas-using-the-cockpit
+  source_owner: SAP SE
+  topic_supported: BTP entitlement assignment and quota management, service plan entitlements, directory and subaccount quota distribution
+  why_needed: Required to assess whether entitlement assignments align with actual consumption — the basis for identifying underutilization and quota right-sizing opportunities
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP licensing and digital access
+
+- SAP License Audit and Compliance
+  https://support.sap.com/en/my-support/license-audit-and-compliance.html
+  source_owner: SAP SE
+  topic_supported: SAP True-Up process, License Administration Workbench (LAW), license measurement methodology, audit preparation, indirect and digital access measurement
+  why_needed: Primary reference for understanding SAP's license audit and True-Up methodology — required for audit readiness assessment and for interpreting LAW measurement output
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- SAP Digital Access
+  https://www.sap.com/products/erp/s4hana/digital-access.html
+  source_owner: SAP SE
+  topic_supported: Digital access licensing model, document-based pricing, which third-party integration scenarios require digital access licenses, digital access adoption program
+  why_needed: Primary reference for digital access licensing — defines which integration scenarios create digital access license obligations and how document counts are measured; required for indirect access risk assessment
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP BTP commercial model documentation and SAP licensing guidance describe the designed commercial and measurement frameworks. They do not prove what licenses or BTP entitlements the user holds, what their actual consumption is, or how SAP would measure their system in a True-Up. Users must supply entitlement reports, BTP consumption exports, SAP for Me data, or LAW measurement output for concrete FinOps assessment. This skill does not provide legal advice on license contract terms.

package/skills/sap/sap-license-btp-consumption-finops-review/references/safety-checklist.md

@@ -0,0 +1,36 @@
+# Safety checklist — SAP License and BTP Consumption FinOps Review
+
+Use before making any licensing or FinOps recommendation, especially for findings that affect True-Up exposure, digital access obligations, CPEA credit commitments, or license type reclassification.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live SAP system, SAP for Me portal, License Administration Workbench, BTP cockpit usage data, or SAP Global License Audit and Compliance team portal. This skill reviews artifacts only.
+- Do not accept or request SAP contract portal credentials, customer-specific contract pricing, True-Up settlement amounts, or confidential commercial negotiation positions.
+- Do not provide legal advice on SAP license contract terms. This skill provides advisory risk classification. SAP licensing counsel must be engaged for binding contract interpretation.
+- Do not recommend license type downgrades without confirming which SAP functional scope the user actually exercises. A user performing Professional User functions on a Limited User license is a compliance exposure, not a cost optimization.
+- Do not assert a definitive True-Up cost without the user's actual LAW measurement output and current contract pricing. Provide estimates only and label them as estimates.
+- Do not conflate BTP service entitlement with BTP service consumption. An entitlement to use a BTP service does not mean the service is consuming credits or generating cost — only active provisioned instances and consumed service units generate charges.
+- Do not recommend canceling or reducing a CPEA commitment without first confirming the commitment term and early termination clauses in the user's contract. CPEA commitments are typically non-cancellable within the term.
+
+## What people get wrong
+
+- **Treating all inactive users as safe to deprovision for license savings**: Deprovisioning named users reduces future measurement exposure, but does not retroactively reduce an already-measured True-Up obligation. Confirm the measurement date before treating deprovisioning as a retroactive cost saving.
+- **Assuming CPEA credits cover all BTP services**: Not all BTP services are available under CPEA. Some services are subscription-only or available on Pay-As-You-Go only. Check service eligibility before assuming a service can be covered by CPEA credits.
+- **Treating credit expiry as a fixed date**: CPEA credit validity depends on the contract start date and the credit tranche. Different credit tranches within the same CPEA contract may have different expiry dates. Confirm the expiry schedule per tranche from the user's order form.
+- **Ignoring the Digital Access Adoption Program**: SAP offered a structured transition to digital access licensing under the Digital Access Adoption Program. Customers who have not activated this program may be measured under indirect access terms that are significantly more expensive. Flag this as a `high` finding if the user's system has significant third-party integrations.
+- **Assuming BTP subaccount equals a cost center**: BTP subaccounts can be used to isolate cost allocation, but they are not automatically mapped to cost centers. Cost allocation requires deliberate tagging and reporting configuration in the BTP cockpit.
+- **Treating LAW measurement as a one-time exercise**: SAP license audit readiness requires that LAW measurement be run and evidence be retained for each measurement period specified in the contract. Measurement that is run once and not maintained is not audit-ready.
+- **Confusing BTP service plan tiers**: Many BTP services have multiple service plans (e.g., free, standard, premium). The free tier is limited in capacity and often not suitable for production. Recommending a free plan for a production use case creates a reliability risk that outweighs the cost saving.
+
+## When to push back
+
+- Push back when the user asks to assess True-Up exposure without providing LAW measurement output or the entitlement quantities in their contract. Exposure cannot be quantified without both sides of the measurement.
+- Push back when the user asks for a definitive CPEA credit optimization plan without providing the credit expiry schedule, current burn rate, and service consumption by service. Optimization without this data is inference.
+- Push back when a request requires live BTP cockpit data or SAP for Me entitlement data — state that the assessment cannot be completed without the relevant exports and ask the user to provide them.
+- Push back when the user asks for SAP license contract interpretation or True-Up settlement advice. Risk classification is in scope; legal and commercial counsel is required for those activities.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP BTP commercial model documentation, SAP licensing guidelines, SAP digital access documentation, or SAP Support Portal license audit resources
+- `user-provided evidence` — license entitlement reports, BTP consumption exports, SAP for Me data, LAW measurement output, or commercial model summaries provided by the user
+- `inference` — derived reasoning not directly confirmed by official SAP documentation or user-provided evidence; must always be labeled as such

package/skills/sap/sap-license-btp-consumption-finops-review/references/workflow-and-output.md

@@ -0,0 +1,69 @@
+# Workflow and output contract — SAP License and BTP Consumption FinOps Review
+
+Use this reference for license and consumption category classification, FinOps finding severity, optimization path decision criteria, and output formatting.
+
+## License and cost domain taxonomy
+
+| Domain | Scope | Typical FinOps findings |
+|--------|-------|------------------------|
+| `fue-and-named-user` | Full Use Equivalent (FUE) counting, named user type classification (Professional, Limited, Self-Service), indirect named user usage | Users classified as Limited performing Professional-scope functions, more named users provisioned than active, FUE count exceeds entitlement creating True-Up exposure |
+| `digital-access` | Digital access licensing for third-party integrations, document-type counts (orders, invoices, goods receipts), Digital Access Adoption Program participation | Third-party system creating SAP documents without a digital access license, incorrect document type count, Digital Access Adoption Program not activated to avoid per-document pricing |
+| `btp-cpea-consumption` | CPEA credit burn rate vs forecast, credit expiry risk, service-level credit consumption patterns, CPEA vs subscription vs Pay-As-You-Go fit | Credits expiring unused, consumption consistently above forecast triggering overage charges, services priced at Pay-As-You-Go rates when CPEA credit consumption would be cheaper |
+| `btp-service-cost-drivers` | Individual BTP service consumption by volume, identification of highest-cost services relative to business value, service plan selection | Expensive service plan selected when a lower plan meets the requirement, test and development services running at production scale, unused service instances accumulating charges |
+| `cost-allocation` | BTP subaccount and service cost tagging, cost center allocation, chargeback and showback model, budget visibility | No subaccount-level cost attribution, business units consuming BTP resources with no cost visibility, no budget alert thresholds configured |
+| `commercial-model-fit` | Match between consumption pattern and commercial model (CPEA vs subscription vs Pay-As-You-Go), volume commitment adequacy | Steady-state consumption at scale under Pay-As-You-Go (CPEA commitment would be more cost-effective), CPEA commitment too large for actual consumption pattern |
+| `true-up-and-audit-readiness` | True-Up preparation, SAP audit readiness, LAW measurement output review, evidence preparation | LAW measurement not run within the required measurement period, measurement excludes relevant system types, no documented process for managing True-Up evidence |
+
+## FinOps finding severity classification
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | Active overage that is creating immediate audit exposure or unexpected commercial liability (e.g., measured user count already above entitlement between True-Up periods, digital access documents being created without a license) |
+| `high` | Material underutilization of paid commitment (CPEA credits consistently under-consumed and at expiry risk, large license block with low active user count), or incorrectly classified license type that would be found in a True-Up |
+| `medium` | Cost allocation gap (no subaccount-level cost visibility, no chargeback model), commercial model mismatch with a clear optimization opportunity that requires a contract event to act on |
+| `low` | Best practice deviation in license management process (LAW measurement run but not reviewed, CPEA consumption not monitored monthly, no budget alert thresholds configured) |
+
+## Optimization path decision criteria
+
+For each finding, apply:
+
+1. **Is there an active overage or audit exposure?**
+   - Yes → `critical`. Quantify the exposure. Identify the remediation path (license purchase, user deprovisioning, digital access license activation). Do not defer.
+   - No → continue.
+
+2. **Is entitlement significantly larger than consumption with committed spend expiring?**
+   - Yes → `high`. Identify the underutilized block. Recommend right-sizing at next contract event, reallocation to other use cases, or model conversion.
+   - No → continue.
+
+3. **Is the commercial model mismatched to the consumption pattern?**
+   - Yes → `medium`. Model the cost difference between current model and optimal model. Flag as a renegotiation opportunity at the next contract event.
+   - No → continue.
+
+4. **Is there a cost visibility or allocation gap?**
+   - Yes → `medium`. Recommend enabling BTP cost monitoring, subaccount cost tagging, and budget alerts. No contract action required — this is an operational improvement.
+   - No → continue.
+
+5. **Is this a process or governance deviation with no immediate cost impact?**
+   - Yes → `low`. Provide guidance for alignment; do not block current operations.
+
+## Workflow
+
+1. **Receive artifacts** — license entitlement reports, BTP consumption exports, SAP for Me data, LAW output, commercial model summaries, or written descriptions of the licensing and BTP consumption posture.
+2. **Classify each finding** by domain.
+3. **Apply optimization path decision criteria** per finding.
+4. **Assign risk level** (critical / high / medium / low).
+5. **Quantify impact where evidence permits** — estimated overage cost, credit expiry value, or cost savings opportunity.
+6. **Prioritize** — critical overage and audit exposure first; then high underutilization and misclassification; then medium commercial model and cost allocation gaps; then low process improvements.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Domain and specific finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. Quantified impact estimate (where evidence permits; label as estimate)
+5. Recommended action (license reclass, True-Up evidence preparation, CPEA reallocation, model conversion, cost tag enablement)
+6. Contract event required (yes / no / at renewal) — whether the optimization requires a contract action or can be done operationally
+7. Escalation trigger if live SAP for Me data, LAW output, or legal contract interpretation is required

package/skills/sap/sap-live-readonly-identity-trust-discovery/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: sap-live-readonly-identity-trust-discovery
+description: Inspect SAP Cloud Identity Services (IAS/IPS), BTP trust and federation configuration, XSUAA role collections, and identity provider settings using read-only list, get, describe, and export operations only. Use when read-only discovery of IAS application assignments, IPS connector configuration, XSUAA role collection assignments, corporate identity provider federation, or BTP trust configurations is needed as evidence for advisory, audit, or compliance purposes. Requires pre-authorized read-only credentials. Never creates, updates, deletes, assigns, rotates, modifies trust, or triggers any mutation.
+allowed-tools: Read Grep Glob WebSearch WebFetch Bash
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: security
+  lifecycle: experimental
+  execution_tier: read-only-runtime
+---
+
+# SAP Live Read-Only Identity and Trust Discovery
+
+## Purpose
+
+Enumerate SAP Cloud Identity Services (IAS and IPS), BTP trust and federation configuration, XSUAA role collections, and identity provider settings using strictly read-only operations to produce structured evidence for advisory, audit, compliance, or security review purposes. Every action taken by this skill must appear on the allowed-actions list below. This skill never changes state, never modifies trust configuration, and never assigns or revokes any identity or role.
+
+## When to use
+
+Use this skill when the user needs to:
+
+- list IAS applications and their assigned identity providers, risk-based authentication policies, and MFA enforcement settings,
+- enumerate IPS connectors (source and target systems), transformation scripts, and provisioning job history in read-only mode,
+- list and describe XSUAA role collections, their role template assignments, and user or group assignments within a BTP subaccount,
+- export BTP trust configurations (trusted identity providers, federation attributes, principal propagation settings) as structured audit evidence,
+- enumerate corporate identity provider federation settings in IAS: SAML 2.0 or OIDC trust metadata, allowed redirect URIs, and attribute mapping,
+- gather identity and trust facts needed as input to `sap-security-iam-grc-sod-review` or as evidence for a compliance audit,
+- confirm read-only identity posture for zero-trust assessment without modifying any identity object.
+
+## When not to use
+
+- When any creation, update, deletion, assignment, rotation, trust modification, or trigger is needed — use the appropriate mutating skill or escalate to an authorized administrator.
+- When no live access has been authorized by the user — operate in advisory mode only and state that no live evidence was gathered.
+- When the user has not confirmed credential scope is read-only — refuse until confirmed.
+- When the request is about GRC Access Control ruleset review or SoD conflict classification without live enumeration — use `sap-security-iam-grc-sod-review`.
+
+## Lean operating rules
+
+- Read-only absolute. Every CLI invocation or API call must be on the allowed-actions list. Do not construct commands that write, modify, assign, rotate, or trigger state changes even if such commands exist in the tool.
+- Credential scope first. Before any live command, confirm with the user that the credential in scope carries only read permissions. Do not proceed if write permissions cannot be excluded.
+- Least privilege. Request the minimum scope needed for the specific discovery task. Never request IAS administrator or IPS administrator credentials for a read-only enumeration. Use viewer or auditor roles only.
+- Evidence labeling. Every piece of data gathered from a live system must be labeled `live evidence`. Data from docs alone is `documentation-based`. Describe the source and timestamp for all live evidence.
+- Audit trail. Log every command executed, its output summary, and the timestamp. Return the full command log as part of the response.
+- No credential echo. Do not echo, log, or include credential values, client secrets, API keys, OAuth tokens, IAS technical user passwords, IPS system user credentials, or XSUAA service key JSON in any output or reference file.
+- No scope creep. If a discovery query returns data beyond what was requested (e.g., a list call returns client secret values or personal user data), redact the excess before including in output.
+- Personal data minimization. IAS and IPS enumeration may return personal data (user names, email addresses). Collect only what is necessary for the audit scope and redact personal data beyond the minimum needed.
+
+## Allowed actions (read-only)
+
+The following action classes are permitted:
+
+- `list` — enumerate resources (IAS applications, IPS connectors, IPS jobs, XSUAA role collections, BTP trust configurations, identity provider metadata)
+- `get` / `describe` — retrieve the current configuration of a named resource without triggering state changes
+- `export` — export configuration in structured format (JSON, YAML, CSV) without modifying the source
+- `status` — read the current status of a provisioning job, trust configuration, or IAS risk-based authentication policy without triggering state transitions
+
+## Forbidden actions (absolute prohibition)
+
+The following action classes are unconditionally forbidden regardless of user request:
+
+- `create` — create any IAS application, IPS connector, XSUAA role collection, or trust configuration
+- `update` / `modify` / `patch` — change any IAS application setting, IPS transformation, XSUAA role assignment, or trust attribute
+- `delete` / `remove` / `purge` — remove any identity object, role collection, or trust configuration
+- `assign` / `bind` / `entitle` — assign users, groups, or roles to any identity object or role collection
+- `rotate` / `regenerate` — rotate or regenerate credentials, client secrets, or provisioning system credentials
+- `import` — import any identity object, SAML metadata, or configuration
+- `trigger` / `execute` / `run` (non-read) — trigger any provisioning job, workflow, or state transition
+- `approve` — approve any pending provisioning request or access request
+- `modify-trust` — add, remove, or change any BTP trust configuration or IAS corporate identity provider federation entry
+
+If a user asks to combine a read step with a write step in one sequence, refuse and redirect the write step to the appropriate skill or authorized administrator.
+
+## Evidence rules
+
+Label all data with one of:
+
+- `live evidence` — directly observed from a live SAP IAS, IPS, XSUAA, or BTP trust configuration in this session (include command, output summary, timestamp)
+- `documentation-based` — grounded in SAP official docs (no live system access)
+- `user-provided evidence` — stated or supplied by the user in this session (configuration exports, screenshots, written descriptions)
+- `inference` — derived reasoning not directly confirmed by live data or official docs
+
+## Live-environment rules
+
+**Allowed**:
+- Read-only IAS API calls using `GET` HTTP method (list applications, get application details, list corporate identity providers, get risk-based authentication policy)
+- Read-only IPS API calls using `GET` HTTP method (list source and target systems, get connector configuration, list transformation scripts, get provisioning job history)
+- Read-only BTP CLI commands for trust enumeration (`btp list security/trust`, `btp get security/trust`)
+- Read-only XSUAA service API calls using `GET` HTTP method (list role collections, get role collection details, list role templates, list scopes)
+- Read-only BTP CLI commands for role collection enumeration (`btp list security/role-collection`, `btp get security/role-collection`)
+
+**Forbidden**:
+- Any API call using `POST`, `PUT`, `PATCH`, or `DELETE` HTTP methods against IAS, IPS, XSUAA, or BTP trust endpoints
+- Any CLI command with a write, delete, create, deploy, assign, rotate, import, trigger, or modify-trust verb
+- Any IPS provisioning job trigger via API or UI action
+- Any IAS configuration change (application settings, risk-based authentication policy, MFA enforcement, corporate identity provider federation)
+- Any XSUAA role collection creation, modification, or assignment
+
+**Least-privilege credential rules**:
+- IAS API: use an IAS administrator account scoped to read-only operations, or use a service user with `Manage Applications` set to read-only; never use a full IAS tenant administrator for enumeration
+- IPS API: use an IPS administrator account with read-only access to connector configuration and job history; never use credentials with provisioning job execution rights
+- XSUAA / BTP CLI: use a subaccount viewer or security auditor role only; never use a subaccount administrator or security administrator for discovery
+- BTP trust endpoints: use Global Account Viewer or Subaccount Viewer role; never use Global Account Administrator
+
+**Approval gate**:
+Before executing any live command, confirm:
+1. The user has authorized live read-only access for this session.
+2. The credential in scope is confirmed read-only (viewer, auditor, or read-only API user role or equivalent).
+3. The target system and scope are explicitly identified by the user (IAS tenant ID, IPS tenant, BTP subaccount ID, XSUAA service instance).
+
+**Rollback**: This skill makes no changes; rollback is not applicable. However, if a command unexpectedly triggers a state change (e.g., an API bug or misconfigured tool), stop immediately and escalate to the user without continuing.
+
+**Post-discovery**:
+- Return a command log with all commands executed and a summary of evidence gathered.
+- Redact all credential values, client secrets, passwords, personal user data beyond the minimum necessary, and sensitive tokens from output.
+- Label all gathered data as `live evidence` with source command and timestamp.
+
+**Audit evidence**:
+- Every response that includes live evidence must include the full command log.
+- Audit evidence format: `[COMMAND] [TIMESTAMP_UTC] [SYSTEM] [SUMMARY_OF_OUTPUT]`
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — discovery workflow, command patterns, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, forbidden action verification, credential rules.
+- [Official sources](references/official-sources.md) — SAP IAS, IPS, XSUAA, BTP trust documentation.
+- [Live environment access](references/live-environment-access.md) — credential setup, role requirements, audit log format, redaction rules.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: what identity and trust data is needed and why.
+- **Evidence used**: live evidence (with command log) / documentation-based / user-provided / inference.
+- **Risk level**: none — this skill is read-only.
+- **Recommended action**: which list/get/describe commands to run and in what order.
+- **Refusal / escalation triggers**: refuse if any requested action is on the forbidden list; escalate to the appropriate skill or an authorized administrator.
+- **Business impact**: what security posture decisions depend on this identity and trust data; what is the cost of incomplete discovery.
+- **Next verification step**: confirm credential scope with the user before the first live command.

package/skills/sap/sap-live-readonly-identity-trust-discovery/agents/openai.yaml

@@ -0,0 +1,14 @@
+interface:
+  display_name: "SAP Live Read-Only Identity and Trust Discovery"
+  short_description: "Enumerate SAP IAS/IPS configuration, BTP trust settings, XSUAA role collections, and identity provider metadata using read-only list/get/describe/export operations — no state changes"
+  default_prompt: "Use $sap-live-readonly-identity-trust-discovery to enumerate SAP identity and trust configuration in read-only mode. Confirm credential scope is read-only (viewer/auditor/read-only API user) before the first live command. Use only list/get/describe/export operations. Log every command. Redact all credential values, client secrets, and personal user data from output. Refuse any create/update/delete/assign/rotate/import/trigger/modify-trust request."
+dependencies:
+  tools:
+    - type: "cli"
+      value: "btp"
+      description: "SAP BTP CLI for read-only trust configuration, role collection, and subaccount security enumeration — must be authenticated with viewer or security auditor role credentials only"
+    - type: "api"
+      value: "https://api.sap.com/api/IAS_Application_Directory"
+      description: "SAP IAS API for read-only application and identity provider enumeration — GET operations only; never POST, PUT, PATCH, or DELETE"
+policy:
+  allow_implicit_invocation: false

package/skills/sap/sap-live-readonly-identity-trust-discovery/metadata.json

@@ -0,0 +1,34 @@
+{
+  "id": "sap-live-readonly-identity-trust-discovery",
+  "name": "SAP Live Read-Only Identity and Trust Discovery",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Enumerate SAP Cloud Identity Services (IAS/IPS) configuration, BTP trust and federation settings, XSUAA role collections, and identity provider metadata using read-only list/get/describe/export operations. Produces structured audit evidence. Never creates, updates, deletes, assigns, rotates, modifies trust, or triggers any mutation.",
+  "source_type": "original",
+  "category": "security",
+  "official_docs": [
+    "https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/what-is-identity-authentication",
+    "https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/configure-applications",
+    "https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/what-is-identity-provisioning",
+    "https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/manage-provisioning-systems",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/what-is-authorization-and-trust-management-service",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/trust-and-federation-with-identity-providers",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/managing-role-collections",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/application-security-descriptor-configuration-syntax"
+  ],
+  "security_notes": "Read-only enforced. Never request or accept write-capable credentials. Use IAS read-only API user, IPS read-only connector viewer, XSUAA subaccount viewer, or BTP security auditor roles only. Redact all credential values, client secrets, OAuth tokens, IAS technical user passwords, IPS system user credentials, and personal user data beyond the minimum necessary from output. Log every command executed. Refuse any request that maps to a create/update/delete/assign/rotate/import/trigger/modify-trust action. Personal data encountered during IAS or IPS enumeration must be minimized and redacted beyond audit necessity.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-live-readonly-identity-trust-discovery",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental",
+  "execution_tier": "read-only-runtime"
+}