@raishin/vanguard-frontier-agentic 2.11.0 → 2.13.0

package/skills/sap/sap-security-iam-grc-sod-review/references/official-sources.md

@@ -0,0 +1,83 @@
+# Official sources — SAP Security IAM GRC and SoD Review
+
+Use this reference when grounding IAS configuration assessment, IPS connector review, XSUAA scope and role template evaluation, GRC Access Control ruleset analysis, and SoD conflict classification.
+
+**Evidence level**: documentation-based (SAP Help Portal, SAP Cloud Identity Services documentation, SAP GRC Access Control documentation). No live-system evidence is collected by this skill.
+
+## SAP Cloud Identity Services — Identity Authentication (IAS)
+
+- What is Identity Authentication
+  https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/what-is-identity-authentication
+  source_owner: SAP SE
+  topic_supported: IAS capabilities overview, application assignment model, corporate IdP federation, authentication policies
+  why_needed: Primary reference for IAS design model — defines the application, corporate IdP, and authentication policy hierarchy used to classify IAS findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Configure risk-based authentication for an application
+  https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/configure-risk-based-authentication-for-application
+  source_owner: SAP SE
+  topic_supported: Risk-based authentication policies, MFA enforcement rules, IP range restrictions, user attribute conditions
+  why_needed: Defines the MFA enforcement model in IAS — required to assess whether privileged users have adequate MFA protection configured
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Cloud Identity Services — Identity Provisioning (IPS)
+
+- What is Identity Provisioning
+  https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/what-is-identity-provisioning
+  source_owner: SAP SE
+  topic_supported: IPS source and target connector model, user and group provisioning lifecycle, transformation script model, job scheduling
+  why_needed: Primary reference for IPS connector architecture — defines the source/target connector model and transformation pipeline used to classify IPS provisioning governance findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Authorization and Trust Management (XSUAA)
+
+- What is Authorization and Trust Management Service
+  https://help.sap.com/docs/btp/sap-business-technology-platform/what-is-authorization-and-trust-management-service
+  source_owner: SAP SE
+  topic_supported: XSUAA service overview, OAuth 2.0 token issuance, scope and role template model, trust to SAP IAS and external IdPs
+  why_needed: Defines the XSUAA authorization model — required to classify scope design, role template construction, and trust configuration findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Application security descriptor configuration syntax (xs-security.json)
+  https://help.sap.com/docs/btp/sap-business-technology-platform/application-security-descriptor-configuration-syntax
+  source_owner: SAP SE
+  topic_supported: xs-security.json schema, scope definitions, role template attributes, role collection declarations, foreign scope references
+  why_needed: Authoritative schema reference for xs-security.json review — required to assess scope granularity, role template construction, and least-privilege compliance in XSUAA application security descriptors
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Trust and federation
+
+- Trust and federation with identity providers
+  https://help.sap.com/docs/btp/sap-business-technology-platform/trust-and-federation-with-identity-providers
+  source_owner: SAP SE
+  topic_supported: Subaccount trust configuration, SAML/OIDC federation to SAP IAS and external IdPs, attribute mapping for group-based role collection assignment
+  why_needed: Defines the BTP trust configuration model — required to classify trust misconfigurations, missing attribute mappings, and excessive trust scope findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP GRC Access Control and SoD
+
+- What is SAP GRC Access Control
+  https://help.sap.com/docs/sap-grc-access-control/sap-grc-access-control/what-is-sap-grc-access-control
+  source_owner: SAP SE
+  topic_supported: GRC Access Control capabilities, Access Risk Analysis (ARA), Emergency Access Management (EAM), Business Role Management, User Access Review
+  why_needed: Primary reference for GRC Access Control model — defines the ARA, EAM, and business role management capabilities used to classify GRC governance findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Segregation of Duties
+  https://help.sap.com/docs/sap-grc-access-control/sap-grc-access-control/segregation-of-duties
+  source_owner: SAP SE
+  topic_supported: SoD ruleset structure, function and permission entry definitions, risk classification levels (critical/high/medium/low), mitigation control assignment
+  why_needed: Defines the SoD conflict classification model — authoritative reference for risk level taxonomy, ruleset coverage assessment, and mitigation control requirements
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal and GRC Access Control documentation describe the designed IAM model, XSUAA configuration syntax, and GRC ruleset capabilities. They do not prove which roles are assigned in the user's landscape, what SoD conflicts exist in the user's GRC system, or whether mitigation controls have been approved. Users must supply SoD conflict reports, role lists, xs-security.json files, IAS exports, IPS connector configurations, or written descriptions of their IAM landscape for concrete assessment.

package/skills/sap/sap-security-iam-grc-sod-review/references/safety-checklist.md

@@ -0,0 +1,36 @@
+# Safety checklist — SAP Security IAM GRC and SoD Review
+
+Use before making any IAM or GRC remediation recommendation, especially for findings involving SoD conflicts, role changes, or identity provider trust modifications.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live IAS tenant, IPS admin console, XSUAA service instance, GRC Access Control system, BTP subaccount, or on-premise SAP system. This skill reviews artifacts only.
+- Do not accept or request IAS admin credentials, IPS technical user passwords, XSUAA client secrets, GRC system logon credentials, BTP service keys, or RFC connection details.
+- Do not approve, close, or recommend closing an unmitigated critical SoD conflict. Only the GRC / audit team with appropriate authority can accept or mitigate a critical SoD risk. State this explicitly in every response where an unmitigated critical conflict is found.
+- Do not recommend changes to live role assignments, XSUAA service bindings, or IPS connector configurations in a production system based on advisory review alone. All recommendations require testing in a non-production environment and GRC/audit sign-off where applicable.
+- Do not recommend removing a trust configuration (XSUAA or BTP subaccount) without first confirming that no active users or applications depend on it. A wrong trust removal can lock out all users from an application.
+- Do not use memory alone to assert which SAP transaction codes create SoD conflicts. SoD conflict classification must be grounded in user-provided GRC ruleset exports, official SAP GRC documentation, or user-described conflict reports.
+- Do not conflate IAS-level authentication controls with XSUAA-level authorization controls. MFA enforcement is an IAS concern; scope and role assignment is an XSUAA concern. They are separate security layers with different remediation paths.
+
+## What people get wrong
+
+- **Conflating IAS users with BTP platform users**: Users managed in IAS (application users) and users managed at the BTP platform level (platform users in the global account) are different identity populations with separate lifecycle management requirements. IPS provisions application users; BTP platform user management is done in the BTP cockpit.
+- **Treating xs-security.json role collections as deployed role collections**: Role collections declared in xs-security.json are created when the application is deployed to BTP. They are separate from custom role collections created manually in the BTP cockpit. Both must be reviewed; changes to xs-security.json only affect the next deployment.
+- **Missing privilege accumulation across multiple role collections**: A user with three individually-compliant role collections can accumulate incompatible access when the collections are combined. SoD analysis must consider the union of all role collections per user, not each in isolation.
+- **Recommending direct user assignment as a temporary fix**: Direct user-to-role-collection assignment bypasses the IdP group lifecycle and creates orphaned assignments when users change roles or leave the organization. It is never acceptable as a long-term or even temporary production fix without a documented exception.
+- **Assuming GRC covers cloud IAM automatically**: GRC Access Control traditionally covers on-premise SAP authorization objects. Cloud IAM (IAS, IPS, XSUAA, BTP role collections) may not be in scope for the user's GRC ruleset. Confirm coverage scope before asserting that a cloud IAM finding is or is not captured by GRC.
+- **Ignoring Emergency Access Management (EAM) in the governance assessment**: Organizations that use firefighter IDs in SAP GRC EAM must ensure firefighter access is time-bounded, logged, and reviewed. Unreviewed or perpetually active firefighter IDs are `high` findings regardless of the underlying SoD position.
+
+## When to push back
+
+- Push back (and escalate) when an unmitigated critical SoD conflict is found — do not proceed with any other recommendation until the conflict is escalated to GRC/audit.
+- Push back when the user asks to confirm role or SoD compliance from memory alone without providing role lists, SoD reports, or GRC artifacts.
+- Push back when the user asks to recommend specific XSUAA scope values without providing the xs-security.json file or a description of the authorization model.
+- Push back when the request requires live system access (IAS API, IPS connector API, XSUAA binding, GRC logon) — state clearly that live inspection is out of scope and ask the user to supply the relevant exports or summaries.
+- Push back when asked to approve or close a GRC access violation or SoD conflict — this skill is advisory only; approval authority rests with the GRC/audit team.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP IAS, IPS, XSUAA, GRC Access Control, or SAP security best practice documentation
+- `user-provided evidence` — SoD conflict reports, role lists, xs-security.json files, IAS exports, IPS connector configurations, or descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such

package/skills/sap/sap-security-iam-grc-sod-review/references/workflow-and-output.md

@@ -0,0 +1,79 @@
+# Workflow and output contract — SAP Security IAM GRC and SoD Review
+
+Use this reference for all finding classification, SoD conflict risk assignment, remediation path selection, and output formatting.
+
+## IAM finding taxonomy
+
+| Domain | Finding class | Description |
+|--------|--------------|-------------|
+| `ias` | `missing-mfa-enforcement` | IAS application or user group with privileged access has no MFA or risk-based authentication policy enforced |
+| `ias` | `unconfigured-corporate-idp` | IAS tenant accepts login without federated corporate IdP — users authenticate directly to IAS without corporate credential lifecycle |
+| `ias` | `unused-application-assignment` | IAS application assignment configured for a BTP application that is no longer active |
+| `ips` | `production-provisioning-no-approval` | IPS connector provisioning to a production target (BTP, S/4HANA, SuccessFactors) without an approval workflow |
+| `ips` | `overly-broad-transformation` | IPS transformation script provisions all source groups to the target without filtering — over-provisioning risk |
+| `ips` | `orphaned-account-source` | IPS source connector returns deprovisioned user records that remain active in target systems |
+| `xsuaa` | `over-broad-scope` | XSUAA scope grants access to a broad resource category (e.g., all documents, all tenants) where a narrower scope would suffice |
+| `xsuaa` | `wildcard-authorization-value` | XSUAA role template or authorization object uses wildcard (`*`) for organizational-level attributes (company code, plant, sales org) |
+| `xsuaa` | `missing-foreign-scope-reference` | xs-security.json references foreign scopes from another app without explicit `granted-apps` restriction |
+| `xsuaa` | `direct-user-role-assignment` | Role collection assigned directly to a named user rather than to an IdP group — access lifecycle bypassed |
+| `grc` | `incomplete-sod-ruleset` | GRC Access Control ruleset does not cover key business process combinations (e.g., FI-MM SoD, procure-to-pay, order-to-cash) |
+| `grc` | `stale-mitigation-control` | Mitigation control assigned to a SoD conflict has expired or has no owner/approver on record |
+| `sod` | `critical-sod-conflict` | User or role set has access to incompatible transaction pairs at critical risk level (e.g., create vendor + approve payment, create PO + goods receipt + invoice verification) |
+| `sod` | `unmitigated-critical-conflict` | Critical SoD conflict exists with no approved compensating mitigation control — immediate escalation required |
+| `sod` | `privilege-accumulation` | User has accumulated access across multiple roles that individually pass SoD but together create an incompatible combination |
+
+## SoD conflict risk classification
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | SoD conflict in a key control process: financial fraud enablement (procure-to-pay, order-to-cash, financial close), data exfiltration path, or compliance-mandated separation (SOX IT general controls) |
+| `high` | SoD conflict with significant operational risk: access to incompatible transaction pairs that could cause material financial error or unauthorized system configuration change |
+| `medium` | SoD conflict in non-key control process, or privilege accumulation without a direct incompatible transaction pair |
+| `low` | Potential future SoD risk from role design that, if a second role were added, would create a conflict |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this an unmitigated critical SoD conflict?**
+   - Yes → `critical`. Immediately escalate to GRC / audit team. Do not approve, defer, or propose a workaround without documented compensating control and approver sign-off. State this explicitly in the response.
+   - No → continue.
+
+2. **Is this a critical SoD conflict with an existing mitigation control?**
+   - Yes → `critical` until the mitigation control is confirmed valid (non-expired, active owner, documented approval). Verify mitigation control validity before marking as managed risk.
+   - No → continue.
+
+3. **Is this excessive privilege in XSUAA (wildcard scope, over-broad role template)?**
+   - Yes → `high`. Redesign the XSUAA scope to use the narrowest attribute set required. Replace wildcard organizational-level values with explicit values per the user's landscape. Redeploy xs-security.json and rebind the XSUAA service instance.
+   - No → continue.
+
+4. **Is this a missing MFA or unapproved IPS production provisioning?**
+   - Yes → `high`. Enforce risk-based authentication in IAS for the affected application or user group. Add an IPS approval workflow for production target connectors. Do not defer MFA enforcement for privileged users.
+   - No → continue.
+
+5. **Is this a governance or lifecycle gap (orphaned account, stale mitigation, direct user assignment)?**
+   - Yes → `medium`. Remove orphaned accounts from target systems via IPS deprovisioning or manual cleanup. Reassign stale mitigation controls to an active owner. Replace direct user role assignments with IdP group-mapped role collections.
+   - No → classify as `low` and provide best practice guidance.
+
+## Workflow
+
+1. **Receive artifacts** — SoD conflict reports, role lists, xs-security.json files, IAS exports, IPS connector configurations, GRC ruleset exports, or user descriptions.
+2. **Classify each finding** by IAM domain and finding class.
+3. **Assign risk level** per SoD classification table above (critical / high / medium / low).
+4. **Flag any unmitigated critical SoD conflicts** immediately — these must be escalated before any other remediation is discussed.
+5. **Apply remediation decision tree** per finding.
+6. **Prioritize** — unmitigated critical SoD conflicts first; then critical mitigated conflicts requiring validation; then high privilege/MFA findings; then medium lifecycle gaps; then low best-practice items.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. IAM domain and finding class per finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. SoD conflict details (if applicable): transaction pair, affected user/role, GRC risk ID if provided
+5. Recommended remediation action (role redesign, mitigation control assignment, IPS workflow addition, XSUAA scope reduction, MFA policy enforcement, etc.)
+6. IAM posture after remediation
+7. Escalation notice for any unmitigated critical SoD conflict — explicit statement that this requires GRC/audit team sign-off before proceeding
+8. Prioritized remediation sequence

package/skills/sap/sap-signavio-process-mining-value/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: sap-signavio-process-mining-value
+description: Review SAP Signavio process intelligence and process mining configurations for value discovery: process discovery coverage, conformance checking against reference models, bottleneck and rework analysis, value realization tracking, and linkage of process mining findings to S/4HANA process improvement opportunities. Flags analytical blind spots, conformance gaps, and unrealized value levers. Does not modify process models, mining configurations, or live SAP systems.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: data
+  lifecycle: experimental
+---
+
+# SAP Signavio Process Mining Value Review
+
+## Purpose
+
+Assess SAP Signavio Process Intelligence (process mining) configurations and analytical outputs for value discovery quality and realization effectiveness. Evaluate process discovery coverage — which end-to-end processes are mined (Procure-to-Pay, Order-to-Cash, Lead-to-Cash, Record-to-Report, Hire-to-Retire, Plan-to-Produce), what event log coverage exists, and whether the extracted process variants are representative of real execution. Review conformance checking setup against SAP reference process models and customer-defined target processes — assessing how deviations are classified, whether root causes are traced, and whether conformance scores drive actionable remediation. Analyze bottleneck and rework identification methodology — confirming that waiting times, rework loops, and touchpoint counts are measured at the right granularity and linked to business impact. Assess value realization tracking — whether improvement initiatives identified from process mining findings are tracked to completion and whether business outcomes (cycle time reduction, cost savings, error rate reduction) are measured. Evaluate the linkage between Signavio process mining findings and S/4HANA process improvement opportunities including clean core alignment and process standardization levers. Does not modify process models in Signavio Process Manager, mining configuration in Signavio Process Intelligence, or any live SAP system.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review SAP Signavio Process Intelligence event log configuration: which SAP source systems are connected (S/4HANA, SAP ECC, Ariba, SuccessFactors, etc.), what event log extraction covers (case ID, activity, timestamp, attributes), and whether the event log is representative of the full end-to-end process,
+- assess process discovery quality: number of process variants discovered, variant coverage threshold (percentage of cases covered by reviewed variants), whether low-frequency outlier variants are investigated or dismissed, and whether the discovered process map reflects real execution rather than an idealized flow,
+- evaluate conformance checking setup against SAP reference process models (SAP Signavio Business Process Management Suite reference content) or customer-defined target process models: how conformance deviations are classified, whether severity levels are assigned to deviation types, and whether root cause investigation is systematically performed for high-frequency deviations,
+- identify bottleneck analysis quality: whether waiting times between process steps are measured and attributed (system wait, resource wait, external dependency), whether the bottleneck root cause links to a specific system, role, or organizational unit, and whether Signavio simulation is used to model the impact of bottleneck removal,
+- assess rework and exception loop identification: whether rework loops (repeated activities, reversal patterns, re-approval cycles) are defined and measured, whether rework rates are tracked over time, and whether high-rework activities are prioritized for S/4HANA process improvement,
+- review value realization tracking: whether process mining findings are linked to improvement initiatives with owners, timelines, and measurable KPIs, and whether post-implementation measurement confirms that the improvement initiative delivered the expected cycle time, cost, quality, or compliance outcome,
+- evaluate the linkage between Signavio process mining insights and SAP S/4HANA process improvement opportunities: whether mining findings inform clean core decisions, SAP Best Practice process adoption, process standardization scope, or automation candidates (SAP Build Process Automation, iRPA),
+- assess SAP Signavio Process Intelligence dashboard and investigation design: KPI selection, benchmark comparison (SAP Business Process Intelligence benchmarking data), filter and drill-down coverage, and whether the dashboard enables root cause analysis without requiring custom SQL or data export.
+
+## When not to use
+
+- When the user needs live access to a Signavio Process Intelligence tenant, event log data, or mining output — this skill accepts only user-provided mining configuration descriptions, conformance check summaries, bottleneck analysis reports, dashboard screenshots, or written descriptions of the Signavio setup.
+- When the request is about Signavio Process Manager (BPMN process modeling, process collaboration, process repository governance) rather than Process Intelligence (process mining, conformance checking, bottleneck analysis) — process modeling governance is a distinct scope.
+- When the request is about SAP LeanIX or SAP Signavio Journey Modeler rather than Process Intelligence mining capabilities.
+- When the request is about building a custom process mining implementation from raw SAP event data outside of Signavio — this skill focuses specifically on the SAP Signavio Process Intelligence platform.
+- When the request is about SAP Datasphere or SAP Analytics Cloud KPI dashboards that are not derived from Signavio process mining output.
+
+## Does not touch live systems
+
+This skill operates on user-provided Signavio Process Intelligence configuration descriptions, event log specification summaries, conformance check reports, bottleneck analysis outputs, value tracking dashboards, dashboard screenshots, or written descriptions of the Signavio process mining setup. It does not connect to any Signavio Process Intelligence tenant, SAP S/4HANA system, Ariba, SuccessFactors, or any other source system. It does not modify process models, event log configurations, mining run parameters, conformance rules, or dashboard definitions. All live inspection is out of scope.
+
+## Lean operating rules
+
+- Classify process mining findings before recommending. Every finding must be assigned to an analytical domain (event log coverage / process discovery / conformance / bottleneck analysis / rework analysis / value realization / S/4HANA linkage) before a recommendation is proposed.
+- Event log coverage determines analytical validity. If the event log does not capture the full end-to-end process (missing handoff events, truncated case journeys, incomplete attribute capture), all downstream mining findings are potentially misleading. Coverage gaps must be classified first.
+- Conformance checking without a target model is not conformance checking. Conformance analysis requires an explicit reference process model. Mining that produces a process map without comparing it to a defined target state measures actual behavior, not deviation from intent.
+- Bottleneck attribution must reach a root cause. Identifying that step X has a long average waiting time is a first-order observation, not an actionable finding. The review must assess whether the root cause (system response time, resource shortage, approval queue depth, external dependency) has been identified and whether it is addressable.
+- Value realization requires measurement, not projection. A process mining engagement that produces a prioritized list of improvement opportunities but does not track post-implementation outcomes has delivered analysis, not value realization. The distinction matters for ROI justification.
+- S/4HANA process improvement linkage must be specific. General statements that process mining "informs the S/4HANA roadmap" are insufficient. The link should identify which specific SAP Best Practice process variant, automation capability, or clean core decision is supported by which specific mining finding.
+- Evidence from user-provided artifacts or official SAP Signavio documentation takes precedence over inference.
+- Load only the reference needed for the analytical domain under review.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP Signavio Process Intelligence documentation, SAP Help Portal Signavio content, or SAP process mining best practice guidance
+- `user-provided evidence` — event log configuration descriptions, conformance check reports, bottleneck analysis outputs, value tracking summaries, dashboard screenshots, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no Signavio Process Intelligence API call, tenant connection, event log query, mining run trigger, or process model modification in this skill's execution path. Users must supply mining configuration descriptions, conformance check summaries, bottleneck analysis reports, or written descriptions of their Signavio process mining setup for this skill to review.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — process mining finding taxonomy, severity assignment, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common process mining review mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP Signavio Process Intelligence, conformance checking, value tracking, and S/4HANA process improvement documentation.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: analytical domain(s) affected (event log coverage / process discovery / conformance / bottleneck analysis / rework analysis / value realization / S/4HANA linkage) and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / inference.
+- **Risk level**: critical (event log coverage gap that invalidates all downstream findings; unmeasured high-value process entirely outside mining scope) / high (conformance checking without a target model; bottleneck attribution stops at symptom; rework loops unmeasured in a high-cost process) / medium (value realization not tracked post-implementation; S/4HANA linkage too generic; dashboard missing key drill-down) / low (best practice deviation in mining configuration or dashboard design).
+- **Recommended action**: specific analytical or configuration improvement per finding (event log extension, target model definition, conformance severity classification, bottleneck root cause drill-down, rework loop definition, value KPI addition, specific S/4HANA improvement linkage, etc.).
+- **Refusal / escalation triggers**: if a finding requires live Signavio tenant access, active mining run output, or real event log data to evaluate, state that clearly and ask the user to supply the relevant export or summary.
+- **Business impact**: unrealized process efficiency gains, compliance risk from undetected conformance deviations, continued cost of rework and exception handling, or ROI justification gap for the process mining program.
+- **Next verification step**: confirm recommended analytical changes (event log extension, target model definition, KPI addition) in the Signavio Process Intelligence tenant before treating mining outputs as a reliable basis for S/4HANA improvement decisions.

package/skills/sap/sap-signavio-process-mining-value/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP Signavio Process Mining Value Review"
+  short_description: "Review SAP Signavio Process Intelligence configurations and outputs for value discovery: process discovery coverage, conformance checking, bottleneck and rework analysis, value realization tracking, and linkage to S/4HANA process improvement opportunities. Flags analytical blind spots, conformance gaps, and unrealized value levers."
+  default_prompt: "Use $sap-signavio-process-mining-value to assess the provided SAP Signavio Process Intelligence configuration and mining outputs. Classify each finding by analytical domain (event log coverage, process discovery, conformance, bottleneck analysis, rework analysis, value realization, S/4HANA linkage), assign a risk level (critical/high/medium/low), and recommend specific analytical or configuration improvements. Flag any event log coverage gaps that invalidate downstream findings. State evidence level (documentation-based, user-provided, inference) and confirm that no live Signavio tenant was accessed and no process models or mining configurations were modified."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/what-is-sap-signavio-process-intelligence"
+      description: "SAP Signavio Process Intelligence documentation — primary reference for process mining capabilities and configuration review"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-signavio-process-mining-value/metadata.json

@@ -0,0 +1,33 @@
+{
+  "id": "sap-signavio-process-mining-value",
+  "name": "SAP Signavio Process Mining Value Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review SAP Signavio Process Intelligence (process mining) configurations and outputs for value discovery: process discovery coverage, conformance checking against reference models, bottleneck and rework analysis, value realization tracking, and linkage to S/4HANA process improvement opportunities. Flags analytical blind spots, conformance gaps, and unrealized value levers. Does not modify process models, mining configurations, or live SAP systems.",
+  "source_type": "original",
+  "category": "data",
+  "official_docs": [
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/what-is-sap-signavio-process-intelligence",
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/setting-up-investigations",
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/conformance-checking",
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/process-variant-explorer",
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/key-performance-indicators",
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/benchmarking",
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/connecting-data-sources",
+    "https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/value-realization"
+  ],
+  "security_notes": "Does not access live SAP Signavio Process Intelligence tenants, SAP S/4HANA systems, Ariba, SuccessFactors, or any source system event logs. Accepts only user-provided mining configuration descriptions, conformance check summaries, bottleneck analysis reports, value tracking dashboard exports, or written descriptions of the Signavio process mining setup. Never request or accept Signavio tenant credentials, SAP logon credentials, or event log data containing personally identifiable information. Does not modify process models, mining run configurations, conformance rules, or dashboard definitions. No live process mining run is triggered.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-signavio-process-mining-value",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-signavio-process-mining-value/references/official-sources.md

@@ -0,0 +1,89 @@
+# Official sources — SAP Signavio Process Mining Value Review
+
+Use this reference when grounding process discovery coverage assessment, conformance checking evaluation, bottleneck and rework analysis review, value realization tracking assessment, and S/4HANA process improvement linkage review.
+
+**Evidence level**: documentation-based (SAP Help Portal, SAP Signavio Process Intelligence documentation). No live-system evidence is collected by this skill.
+
+## SAP Signavio Process Intelligence overview
+
+- What is SAP Signavio Process Intelligence
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/what-is-sap-signavio-process-intelligence
+  source_owner: SAP SE
+  topic_supported: SAP Signavio Process Intelligence capabilities overview, process mining scope, integration with SAP and non-SAP source systems, difference between Process Intelligence and Process Manager
+  why_needed: Primary reference for understanding the Signavio Process Intelligence platform model — defines capabilities, scope boundaries, and integration options used to classify capability coverage findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Data source connection and event log
+
+- Connecting Data Sources
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/connecting-data-sources
+  source_owner: SAP SE
+  topic_supported: Event log extraction from SAP S/4HANA, SAP ECC, Ariba, SuccessFactors, and non-SAP systems; case ID and activity attribute mapping; event log schema requirements; SAP extraction content (pre-built extractors for P2P, O2C, R2R)
+  why_needed: Authoritative reference for evaluating event log coverage quality — defines the extraction model and pre-built content used to classify event log coverage gaps and attribute completeness findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Investigation and process discovery
+
+- Setting Up Investigations
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/setting-up-investigations
+  source_owner: SAP SE
+  topic_supported: Investigation configuration in Signavio Process Intelligence, process variant explorer setup, filter and drill-down configuration, KPI definition within investigations, process map generation
+  why_needed: Defines the investigation design model — required to assess process discovery coverage quality, variant explorer configuration, and whether the investigation setup enables meaningful root cause analysis
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Process variant analysis
+
+- Process Variant Explorer
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/process-variant-explorer
+  source_owner: SAP SE
+  topic_supported: Process variant identification, variant frequency and case coverage statistics, variant comparison, outlier variant handling, process map abstraction levels
+  why_needed: Primary reference for evaluating process discovery quality — defines the variant coverage model and abstraction options used to classify discovery completeness findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Conformance checking
+
+- Conformance Checking
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/conformance-checking
+  source_owner: SAP SE
+  topic_supported: Conformance checking configuration in Signavio Process Intelligence, reference model definition, deviation classification (missing activity, additional activity, wrong order), conformance score calculation, deviation root cause investigation
+  why_needed: Authoritative reference for conformance checking review — defines the target model requirement, deviation taxonomy, and scoring model used to classify conformance analysis gap findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## KPIs and performance measurement
+
+- Key Performance Indicators
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/key-performance-indicators
+  source_owner: SAP SE
+  topic_supported: KPI definition in Signavio Process Intelligence, cycle time KPI, throughput time KPI, rework rate KPI, exception rate KPI, KPI threshold configuration and alerting
+  why_needed: Primary reference for KPI framework review — defines the KPI definition model, available metric types, and threshold configuration used to classify KPI coverage and threshold gap findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Benchmarking
+
+- Benchmarking
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/benchmarking
+  source_owner: SAP SE
+  topic_supported: SAP Business Process Intelligence benchmarking data integration, industry benchmark comparison for P2P, O2C, and other end-to-end processes, benchmark metric selection and interpretation
+  why_needed: Defines the benchmarking capability in Signavio Process Intelligence — required to assess whether benchmark comparison is used to contextualize bottleneck and cycle time findings against industry standards
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Value realization
+
+- Value Realization
+  https://help.sap.com/docs/signavio/sap-signavio-process-intelligence/value-realization
+  source_owner: SAP SE
+  topic_supported: Value realization tracking in Signavio Process Intelligence, improvement initiative registration, pre- and post-implementation KPI comparison, business case outcome measurement, value dashboard
+  why_needed: Primary reference for value realization tracking review — defines the improvement initiative tracking model and outcome measurement approach used to classify value realization maturity findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal and Signavio Process Intelligence documentation describe the designed platform capabilities, investigation configuration model, conformance checking framework, KPI definition options, and value realization tracking approach. They do not prove what processes are currently mined in the user's Signavio tenant, what conformance scores exist for specific processes, what bottlenecks have been identified, or whether value realization tracking is active. Users must supply mining configuration descriptions, conformance check summaries, bottleneck analysis outputs, value tracking dashboard exports, or written descriptions of their Signavio process mining setup for concrete assessment.

package/skills/sap/sap-signavio-process-mining-value/references/safety-checklist.md

@@ -0,0 +1,36 @@
+# Safety checklist — SAP Signavio Process Mining Value Review
+
+Use before making any process mining analytical or configuration recommendation, especially for findings involving event log coverage, conformance deviation classification, bottleneck attribution, or value realization measurement.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live SAP Signavio Process Intelligence tenant, SAP S/4HANA system, Ariba, SuccessFactors, or any source system event log. This skill reviews artifacts only.
+- Do not accept or request Signavio tenant credentials, SAP logon credentials, event log database access, or raw process mining data containing personally identifiable information (PII). Event logs from HR processes (Hire-to-Retire) may contain personal employee data — these must not be shared.
+- Do not modify process models in Signavio Process Manager, investigation configurations in Signavio Process Intelligence, mining run parameters, conformance rules, KPI definitions, or dashboard layouts. This skill is strictly advisory.
+- Do not trigger mining runs, conformance check executions, KPI recalculations, or data extractions in any Signavio or source system. These operations affect production analytical environments and must be executed by authorized Signavio administrators.
+- Do not present process mining findings as definitive proof of process compliance or non-compliance without confirming event log completeness. Findings derived from an incomplete event log are analytical observations with limited reliability, not compliance determinations.
+- Do not recommend acting on conformance deviation findings before confirming that a target process model has been established and agreed by process owners. Deviations measured against an informal or unreviewed reference model may incorrectly flag intentional regional or legal variants as non-conformances.
+
+## What people get wrong
+
+- **Treating "process is mined" as equivalent to "event log is complete"**: Signavio can produce a process map from a partial event log. A P2P investigation that covers only the S/4HANA invoice verification steps but misses the Ariba purchase requisition and purchase order steps is mined — but the map does not represent the full process. Coverage completeness must be explicitly verified.
+- **Confusing process variant frequency with process variant importance**: Low-frequency process variants are often dismissed as noise. In reality, low-frequency variants frequently contain the highest-risk behaviors: emergency bypasses, error corrections, fraud patterns, and regulatory exceptions. A sound review assesses whether low-frequency variants have been investigated, not just filtered out.
+- **Treating conformance score as a compliance score**: A Signavio conformance score measures how often the actual process matches the defined reference model. It does not measure regulatory compliance, internal policy compliance, or audit readiness unless the reference model explicitly encodes those requirements. The distinction matters for stakeholder communication.
+- **Accepting bottleneck identification as a complete finding**: Identifying that a specific process step has a high average cycle time is the beginning of an analysis, not the end. The actionable finding requires attribution (what causes the wait), impact quantification (what is the cost of this wait), and a specific remediation lever (system change, automation, resource increase, process redesign).
+- **Conflating Signavio Process Manager and Signavio Process Intelligence**: Process Manager is a BPMN modeling and collaboration tool. Process Intelligence is a process mining and analytics tool. They share the SAP Signavio brand but are distinct products with different purposes. A review of process model governance in Process Manager is not a review of process mining analytics in Process Intelligence.
+- **Assuming value realization is complete when improvements are implemented**: Implementation of a process improvement (new S/4HANA Fiori app, automation bot, streamlined approval workflow) delivers the potential for value realization. Actual value realization requires post-implementation measurement: comparing the cycle time, rework rate, or exception rate before and after the change under comparable volume conditions.
+
+## When to push back
+
+- Push back when an event log coverage gap invalidates downstream process mining findings — advise stakeholders that findings for affected processes cannot be treated as reliable until coverage is confirmed.
+- Push back when the user asks to confirm process compliance based on mining findings alone without a defined reference process model for conformance checking.
+- Push back when the request requires live Signavio tenant access, active mining output data, or real event log records — state clearly that live inspection is out of scope and ask the user to supply the relevant export or description.
+- Push back when asked to modify investigation configurations, trigger mining runs, or alter conformance rules — this is an absolute boundary and must be refused in all circumstances.
+- Push back when asked to assess process efficiency from industry benchmarks without confirming that the user's event log covers the same process scope as the benchmark definition — benchmark comparison is misleading when scope differs.
+- Push back when improvement initiative owners ask this skill to confirm that a registered initiative has "delivered its value" — post-implementation measurement requires data from the live Signavio investigation, which must be supplied by the user.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP Signavio Process Intelligence documentation, SAP Help Portal Signavio content, or SAP process mining best practice guidance
+- `user-provided evidence` — event log configuration descriptions, conformance check summaries, bottleneck analysis outputs, value tracking dashboard exports, investigation configuration descriptions, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such

package/skills/sap/sap-signavio-process-mining-value/references/workflow-and-output.md

@@ -0,0 +1,91 @@
+# Workflow and output contract — SAP Signavio Process Mining Value Review
+
+Use this reference for all process mining finding classification, risk level assignment, recommendation selection, and output formatting.
+
+## Process mining finding taxonomy
+
+| Domain | Finding class | Description |
+|--------|--------------|-------------|
+| `event-log-coverage` | `end-to-end-process-not-extracted` | An in-scope end-to-end process (P2P, O2C, R2R, H2R, P2P, etc.) has no event log extracted — entire process is outside the mining scope |
+| `event-log-coverage` | `handoff-event-missing` | Event log captures activities within one system but misses handoff events between systems (e.g., Ariba to S/4HANA handoff in P2P) — cross-system flow is invisible |
+| `event-log-coverage` | `case-journey-truncated` | Event log case journeys are truncated at an arbitrary extraction window rather than the full process lifecycle — long-running cases appear shorter than they are |
+| `event-log-coverage` | `attribute-completeness-gap` | Key case attributes (business unit, plant, material category, vendor category, employee group) are missing from the event log — drill-down and root cause analysis is limited |
+| `process-discovery` | `variant-coverage-insufficient` | Reviewed process variants cover less than 80% of cases — the long tail of low-frequency variants contains unexamined behavior that may include exceptions, errors, or compliance risks |
+| `process-discovery` | `outlier-variants-dismissed` | Low-frequency process variants are filtered out rather than investigated — potential error patterns, fraud vectors, or compliance exceptions are hidden |
+| `process-discovery` | `process-map-too-aggregated` | Investigation process map abstraction level is so high that meaningful step-level analysis is not possible — findings are at too coarse a granularity to drive improvement |
+| `conformance` | `no-target-model-defined` | Conformance checking is not configured because no reference process model (SAP Best Practice or customer-defined) has been established as the conformance target — deviation from intent cannot be measured |
+| `conformance` | `deviation-severity-not-classified` | Conformance deviations are identified but not classified by severity (critical compliance deviation vs. acceptable variant) — all deviations appear equally important, obscuring the highest-risk ones |
+| `conformance` | `root-cause-not-investigated` | High-frequency conformance deviations are identified but not traced to a root cause (missing system control, human behavior, missing automation) — findings are not actionable |
+| `bottleneck-analysis` | `waiting-time-not-attributed` | Waiting time between process steps is measured but not attributed to a cause (system wait, resource wait, external dependency) — the bottleneck source is unknown |
+| `bottleneck-analysis` | `bottleneck-not-linked-to-impact` | A bottleneck step is identified but its business impact (delay cost, downstream effect, SLA breach rate) is not quantified — prioritization is not evidence-based |
+| `bottleneck-analysis` | `simulation-not-used` | Signavio simulation capability is not used to model the expected impact of bottleneck removal — improvement benefits are projected without analytical validation |
+| `rework-analysis` | `rework-loop-not-defined` | Rework loops (repeated activities, reversal patterns, re-approval cycles) are not explicitly defined in the investigation — rework rate is unmeasured |
+| `rework-analysis` | `rework-rate-not-trended` | Rework rate is measured at a point in time but not tracked over time — improvement initiatives targeting rework reduction cannot demonstrate progress |
+| `rework-analysis` | `high-rework-process-not-prioritized` | Process with a high rework rate has not been prioritized for S/4HANA process improvement or automation — rework cost continues without a remediation plan |
+| `value-realization` | `initiative-not-registered` | Process mining findings have generated recommendations but no improvement initiative has been formally registered with an owner, timeline, and target KPI — findings do not convert to action |
+| `value-realization` | `post-implementation-not-measured` | An improvement initiative identified from mining findings has been implemented but no post-implementation KPI measurement has been performed — outcome is assumed, not confirmed |
+| `value-realization` | `business-case-not-tracked` | The process mining program has an estimated ROI or business case but no mechanism to track actual realized value — investment justification cannot be confirmed |
+| `s4hana-linkage` | `improvement-linkage-too-generic` | Process mining findings are described as informing the S/4HANA roadmap without identifying a specific SAP Best Practice variant, automation capability, or clean core decision they support |
+| `s4hana-linkage` | `automation-candidate-not-identified` | Process mining has identified a high-frequency repetitive activity that is a strong automation candidate (SAP Build Process Automation, iRPA) but no automation initiative has been linked to the finding |
+| `s4hana-linkage` | `clean-core-deviation-not-flagged` | Conformance deviations indicate process customizations that conflict with SAP clean core principles, but this has not been flagged to the S/4HANA governance team |
+
+## Risk level assignment
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | Event log coverage gap that invalidates all downstream findings for an in-scope process; an entire high-value process (P2P, O2C, R2R) entirely outside the mining scope with no compensating analytical coverage |
+| `high` | Conformance checking without a target model; bottleneck attribution stops at symptom with no root cause; rework loops unmeasured in a high-cost process; improvement initiative not registered after mining engagement produces findings |
+| `medium` | Value realization not tracked post-implementation; S/4HANA linkage too generic; simulation not used for bottleneck impact estimation; variant coverage below 80%; dashboard missing key drill-down capability |
+| `low` | Best practice deviation in investigation design; cosmetic KPI or dashboard gap in a low-risk process; single attribute completeness gap that limits one specific drill-down dimension |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this an event log coverage gap that invalidates all downstream findings for the process?**
+   - Yes → `critical`. Halt reliance on downstream findings for this process until the event log is extended. Engage the Signavio implementation team and the source system team to extend the extraction. Clearly communicate to stakeholders that current findings for this process are not reliable.
+   - No → continue.
+
+2. **Is conformance checking missing because no target model has been defined?**
+   - Yes → `high`. Identify the appropriate reference model (SAP Best Practice process variant from SAP Signavio BPM Suite reference content or a customer-defined target process). Configure conformance checking in the investigation. Classify existing deviations using the newly established reference. This is a prerequisite for all conformance-based recommendations.
+   - No → continue.
+
+3. **Is a bottleneck identified but not attributed to a root cause?**
+   - Yes → `high`. Drill down into the waiting time breakdown between the bottleneck steps. Attribute to system response time (transaction response, batch job schedule), resource constraint (team capacity, approval queue depth), or external dependency (vendor response, regulatory wait). Link the root cause to a specific remediation lever.
+   - No → continue.
+
+4. **Is rework unmeasured in a high-cost process?**
+   - Yes → `high`. Define explicit rework loop patterns for the process (e.g., GR reversal in P2P, credit memo creation in O2C, journal entry reversal in R2R). Add rework rate KPIs to the investigation. Trend rework rate over time. Quantify the cost of rework per case to prioritize remediation.
+   - No → continue.
+
+5. **Is a process mining finding not linked to a registered improvement initiative?**
+   - Yes → `high`. Register the finding as a formal improvement initiative with: responsible owner, target KPI (cycle time reduction %, rework rate %, cost saving estimate), timeline, and post-implementation measurement date. Link the initiative to the process mining investigation that surfaced it.
+   - No → continue.
+
+6. **Is the S/4HANA process improvement linkage too generic or an automation candidate not identified?**
+   - Yes → `medium`. Map the specific mining finding (high-rework activity, conformance deviation type, bottleneck step) to a specific SAP Best Practice process variant, SAP Build Process Automation template, or clean core remediation action. Document the linkage explicitly so the S/4HANA governance team can act on it.
+   - No → classify as `low` and provide best practice guidance.
+
+## Workflow
+
+1. **Receive artifacts** — event log configuration descriptions, investigation setup summaries, conformance check reports, bottleneck analysis outputs, rework analysis summaries, value tracking dashboard exports, improvement initiative registers, or written descriptions of the Signavio process mining setup.
+2. **Classify each finding** by analytical domain and finding class.
+3. **Assign risk level** per the table above (critical / high / medium / low).
+4. **Flag event log coverage gaps that invalidate downstream findings** immediately — halt reliance on downstream analysis for affected processes until coverage is confirmed.
+5. **Apply remediation decision tree** per finding.
+6. **Prioritize** — event log coverage invalidation first; then high conformance, bottleneck attribution, rework, and value realization findings; then medium initiative and linkage gaps; then low best-practice items.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Analytical domain and finding class per finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. Finding detail: affected process (P2P, O2C, R2R, etc.), investigation name (if provided), specific analytical gap or configuration deficit
+5. Recommended remediation action (event log extension, target model definition, conformance severity classification, bottleneck root cause drill-down, rework loop definition, KPI addition, improvement initiative registration, specific S/4HANA process linkage, automation candidate identification, etc.)
+6. Process intelligence posture after remediation
+7. Escalation notice for any event log coverage gap that invalidates downstream findings — explicit statement that stakeholders should not act on those findings until coverage is confirmed
+8. Prioritized remediation sequence
+9. Confirmation that no live Signavio tenant was accessed and no process models, mining configurations, or live SAP systems were modified in this review