@raishin/vanguard-frontier-agentic 2.11.0 → 2.13.1

package/skills/sap/sap-procurement-ariba-value-leakage-review/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: sap-procurement-ariba-value-leakage-review
+description: Review SAP Ariba and SAP S/4HANA source-to-pay processes for value leakage: maverick and off-contract spend, contract compliance rates, supplier risk exposure, three-way match exceptions (invoice/PO/GR), early payment discount capture, and guided buying adoption. Flags leakage patterns, control gaps in procurement compliance, supplier risk blind spots, and discount capture failures. Does not create purchase orders, approve invoices, or mutate any live procurement system.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: finance
+  lifecycle: experimental
+---
+
+# SAP Procurement Ariba Value Leakage Review
+
+## Purpose
+
+Assess the source-to-pay process and configuration quality of SAP Ariba and SAP S/4HANA Procurement to identify value leakage patterns and control gaps. Evaluate maverick and off-contract spend by reviewing purchasing channel discipline, preferred supplier utilization rates, and guided buying configuration in SAP Ariba Buying and Invoicing. Assess contract compliance by reviewing contract consumption rates, contract-to-PO linkage configuration, contract leakage thresholds, and sourcing workflow design in SAP Ariba Sourcing. Review supplier risk exposure by analyzing supplier qualification status, supplier risk scoring configuration in SAP Ariba Supplier Risk, and diversity and sustainability compliance gaps. Evaluate three-way match discipline by examining invoice tolerance configuration, PO/GR/invoice matching rules, hold and exception management workflows, and leakage from tolerance overrides. Assess early payment discount capture rates by reviewing payment term configuration in SAP S/4HANA Accounts Payable, discount monitoring dashboard coverage, and dynamic discounting setup in SAP Ariba Discount Management. Review guided buying adoption and catalog governance for completeness of approved supplier content and user adoption barriers. Does not connect to or mutate any live SAP Ariba or SAP S/4HANA Procurement system. Never creates purchase orders, approves invoices, releases payments, or modifies supplier master data.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review SAP Ariba Buying and Invoicing or SAP S/4HANA Procurement configuration for maverick spend patterns: off-contract purchasing channels, absence of guided buying enforcement, catalog coverage gaps, free-text requisition rates, and whether procurement policy directs spend to preferred suppliers and negotiated contracts,
+- assess contract compliance in SAP Ariba Contracts: contract consumption rates versus negotiated volume commitments, contract-to-PO linkage configuration, whether purchase orders can be created without referencing an active contract for in-scope spend categories, and contract leakage threshold configuration in sourcing workflow,
+- evaluate supplier risk posture using SAP Ariba Supplier Risk or equivalent supplier qualification processes: supplier onboarding completeness, risk score configuration and threshold alerts, supplier financial health monitoring, geographic and concentration risk, regulatory and sanctions screening, and ESG/diversity qualification gaps,
+- review three-way match control discipline: invoice/PO/GR matching rule configuration (quantity tolerance, price tolerance, delivery cost tolerance), hold and exception workflow routing for match failures, whether tolerance overrides require approval, frequency and financial impact of tolerance-based invoice releases, and whether the accounts payable team can bypass match requirements without documented escalation,
+- assess early payment discount capture: payment term configuration and discount window setup in SAP S/4HANA Accounts Payable, SAP Ariba Discount Management or dynamic discounting program setup, discount capture rate reporting, and whether the AP process is structured to surface and capture available discounts before the discount window closes,
+- evaluate guided buying adoption and catalog governance: SAP Ariba catalog configuration (punchout, static, dynamic), catalog content completeness for high-spend categories, supplier catalog update frequency, guided buying policy enforcement rules, and adoption metrics indicating whether users bypass guided buying channels,
+- review source-to-pay cycle time and process efficiency: requisition-to-order cycle time, sourcing event duration, invoice processing time, and whether process bottlenecks create value leakage through delayed payments (penalty risk), delayed sourcing (spend without contract coverage), or slow exception resolution (aged invoice holds),
+- assess spend analytics visibility: whether SAP Ariba Spend Analysis or equivalent reporting covers all spend channels (PO-based, non-PO, procurement card), category hierarchy configuration, supplier normalization quality, and whether spend analysis data is sufficient to identify leakage patterns in specific categories.
+
+## When not to use
+
+- When the user needs live inspection of SAP Ariba purchase orders, contracts, invoices, or supplier records — this skill accepts only user-provided configuration summaries, process descriptions, spend analysis reports, contract compliance metrics, exception reports, or written descriptions of the source-to-pay landscape.
+- When the request is about SAP S/4HANA Finance Accounts Payable period-end closing controls, G/L posting controls, or payment run governance without a procurement value leakage angle — use `sap-finance-fico-controls-review` for AP financial control assessment.
+- When the request is about SAP Ariba technical integration architecture, API connectivity between SAP Ariba and SAP S/4HANA, or integration suite design — this skill focuses on procurement process and value leakage, not integration platform configuration.
+- When the request concerns SAP Fieldglass contingent workforce or external services procurement — Fieldglass-specific processes are a distinct scope from source-to-pay goods and services procurement.
+- When the request is about SAP Ariba Network trading partner onboarding at a technical level (EDI, cXML configuration) rather than a procurement compliance and value leakage assessment.
+
+## Does not touch live systems
+
+This skill operates on user-provided configuration descriptions, spend analysis exports, contract compliance reports, three-way match exception reports, supplier risk dashboard summaries, discount capture rate reports, guided buying adoption metrics, or written descriptions of the source-to-pay landscape. It does not connect to any SAP Ariba tenant, SAP Ariba Network, SAP S/4HANA Procurement system, Fiori launchpad, or Ariba APIs. It does not create, approve, or modify purchase requisitions, purchase orders, contracts, invoices, supplier records, or payment runs. All live inspection is out of scope.
+
+**This skill never creates or approves procurement documents.** No purchase order creation, no invoice approval, no payment release, no contract activation, and no supplier record modification is performed or recommended as a direct action in this skill's execution path. All remediation recommendations describe configuration and process changes to be implemented and tested in a non-production environment.
+
+## Lean operating rules
+
+- Classify value leakage findings before recommending. Every finding must be assigned to a leakage domain (maverick/off-contract spend / contract compliance / supplier risk / three-way match / discount capture / guided buying / spend analytics visibility) before a remediation path is proposed.
+- Maverick spend without contract coverage is a first-order value leakage signal. Any spend category with material volume and no active contract coverage, or with active contracts that are consistently bypassed, is a `high` leakage finding requiring spend channel enforcement action.
+- Three-way match tolerance overrides that bypass approval are a critical control gap. Tolerances are a managed control parameter — not an uncontrolled bypass valve. Any configuration allowing invoice release on match failure without documented approver authorization is a `critical` or `high` finding depending on the materiality threshold.
+- Contract compliance leakage must be quantified when data is available. If the user provides contract consumption rates, the finding must reference the gap between committed and actual volume. Do not treat low contract consumption as a purely operational metric — it represents direct savings leakage.
+- Supplier risk gaps with active spend exposure are `high`. A supplier with significant spend volume, no completed qualification, unresolved financial health flags, or active sanctions screening alerts represents both financial and reputational risk.
+- Discount capture failures have a measurable cost. An early payment discount window that expires without capture is a direct cost — express this in terms of the annualized cost of missed discounts when discount rate and spend data are provided.
+- Guided buying bypass rate above 20% for in-scope categories is a `medium` leakage indicator requiring adoption analysis and policy enforcement review.
+- Evidence from user-provided artifacts or official SAP Ariba and SAP S/4HANA Procurement documentation takes precedence over inference.
+- Load only the reference needed for the procurement leakage domain under review.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP Ariba, SAP S/4HANA Procurement, or SAP Help Portal source-to-pay documentation, SAP Ariba best practice guides, or SAP procurement compliance guidance
+- `user-provided evidence` — spend analysis exports, contract compliance reports, three-way match exception reports, supplier risk summaries, discount capture rate data, guided buying adoption metrics, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no SAP Ariba API call, Ariba Network transaction, SAP S/4HANA RFC invocation, Fiori OData request, or direct database query in this skill's execution path. Users must supply configuration exports, spend analysis reports, contract compliance metrics, exception reports, supplier risk dashboard summaries, or written descriptions of their source-to-pay landscape for this skill to review.
+
+**This skill never creates or approves procurement documents.** Recommendations describing remediation always apply to configuration, policy, or process design — not to direct purchase order creation, invoice approval, payment release, or supplier record modification.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — procurement value leakage finding taxonomy, severity assignment, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common procurement review mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP Ariba Buying and Invoicing, SAP Ariba Contracts, SAP Ariba Supplier Risk, SAP S/4HANA Procurement, and source-to-pay documentation.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: value leakage domain(s) affected (maverick/off-contract spend / contract compliance / supplier risk / three-way match / discount capture / guided buying / spend analytics visibility) and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / inference.
+- **Risk level**: critical (three-way match bypass without approval enabling payment fraud; supplier payments to sanctioned or disqualified parties) / high (maverick spend above materiality threshold, contract compliance leakage in core categories, supplier risk with active spend exposure, tolerance override without approval, missed discount capture at material scale) / medium (guided buying bypass above 20%, catalog coverage gap, spend analytics blind spot, process cycle time creating compliance risk) / low (best practice deviation in sourcing workflow design or catalog governance).
+- **Recommended action**: specific configuration or process remediation per finding (guided buying enforcement rule, contract-to-PO linkage activation, tolerance approval workflow, supplier risk threshold alert, discount capture monitoring setup, catalog content update, spend analysis category hierarchy correction, etc.).
+- **Refusal / escalation triggers**: if three-way match bypass without approval or supplier payments to potentially sanctioned parties are identified, escalate to the compliance and audit team before any further procurement or payment action is taken. If a finding requires live SAP Ariba or S/4HANA system inspection, state that clearly and ask the user to supply the relevant export or description.
+- **Business impact**: direct savings leakage (quantified when data is available), regulatory or sanctions compliance risk, supplier concentration or financial risk, audit finding risk, working capital impact from uncaptured discounts or delayed AP processing.
+- **Next verification step**: confirm recommended configuration changes against the user's current SAP Ariba and SAP S/4HANA Procurement setup in a non-production environment before promoting to production.

package/skills/sap/sap-procurement-ariba-value-leakage-review/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP Procurement Ariba Value Leakage Review"
+  short_description: "Review SAP Ariba and SAP S/4HANA source-to-pay processes for value leakage: maverick and off-contract spend, contract compliance, supplier risk, three-way match exceptions, early payment discount capture, and guided buying adoption. Does not create purchase orders, approve invoices, or access live procurement systems."
+  default_prompt: "Use $sap-procurement-ariba-value-leakage-review to assess the provided SAP Ariba and SAP S/4HANA Procurement configuration and process data. Classify each finding by value leakage domain (maverick/off-contract spend, contract compliance, supplier risk, three-way match, discount capture, guided buying, spend analytics visibility), assign a risk level (critical/high/medium/low), and recommend specific remediation actions. Flag any three-way match bypass without approval or supplier payments to potentially sanctioned parties for immediate escalation. State evidence level (documentation-based, user-provided, inference) and confirm that no live system access, purchase order creation, invoice approval, or payment release is performed."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/SAP_ARIBA_BUYING_AND_INVOICING/ariba-buying-and-invoicing/guided-buying"
+      description: "SAP Ariba Buying and Invoicing documentation — primary reference for guided buying and source-to-pay value leakage review"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-procurement-ariba-value-leakage-review/metadata.json

@@ -0,0 +1,32 @@
+{
+  "id": "sap-procurement-ariba-value-leakage-review",
+  "name": "SAP Procurement Ariba Value Leakage Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review SAP Ariba and SAP S/4HANA source-to-pay processes for value leakage: maverick and off-contract spend, contract compliance, supplier risk, three-way match exceptions, early payment discount capture, and guided buying adoption. Does not create purchase orders, approve invoices, or access live procurement systems.",
+  "source_type": "original",
+  "category": "finance",
+  "official_docs": [
+    "https://help.sap.com/docs/SAP_ARIBA_BUYING_AND_INVOICING/ariba-buying-and-invoicing/guided-buying",
+    "https://help.sap.com/docs/SAP_ARIBA_CONTRACTS/ariba-contracts/contract-compliance-and-monitoring",
+    "https://help.sap.com/docs/SAP_ARIBA_SUPPLIER_RISK/ariba-supplier-risk/supplier-risk-assessment",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-procurement/invoice-verification-and-three-way-match",
+    "https://help.sap.com/docs/SAP_ARIBA_DISCOUNT_MANAGEMENT/ariba-discount-management/dynamic-discounting",
+    "https://help.sap.com/docs/SAP_ARIBA_SPEND_ANALYSIS/ariba-spend-analysis/spend-visibility-and-classification",
+    "https://help.sap.com/docs/SAP_ARIBA_SOURCING/ariba-sourcing/sourcing-projects-and-events"
+  ],
+  "security_notes": "Does not access live SAP Ariba tenants, SAP Ariba Network, SAP S/4HANA Procurement systems, Fiori launchpads, or any production procurement database. Accepts only user-provided configuration descriptions, spend analysis exports, contract compliance reports, three-way match exception reports, supplier risk summaries, discount capture rate data, guided buying adoption metrics, or written descriptions of the source-to-pay landscape. Never request or accept SAP Ariba login credentials, API keys, or direct database access. Never creates, approves, or modifies purchase requisitions, purchase orders, contracts, invoices, supplier records, or payment runs. Three-way match bypass findings and supplier payments to potentially sanctioned parties must be escalated to the compliance and audit team — this skill does not approve payments or close compliance findings.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-procurement-ariba-value-leakage-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-procurement-ariba-value-leakage-review/references/official-sources.md

@@ -0,0 +1,79 @@
+# Official sources — SAP Procurement Ariba Value Leakage Review
+
+Use this reference when grounding maverick spend assessment, contract compliance analysis, supplier risk review, three-way match discipline evaluation, discount capture analysis, guided buying adoption review, and spend analytics visibility assessment.
+
+**Evidence level**: documentation-based (SAP Help Portal, SAP Ariba documentation, SAP S/4HANA Procurement documentation). No live-system evidence is collected by this skill.
+
+## SAP Ariba Buying and Invoicing — Guided Buying and Catalog
+
+- SAP Ariba Buying and Invoicing — Guided Buying Configuration
+  https://help.sap.com/docs/SAP_ARIBA_BUYING_AND_INVOICING/ariba-buying-and-invoicing/guided-buying
+  source_owner: SAP SE
+  topic_supported: Guided buying enforcement rules, catalog configuration (static, punchout, dynamic), preferred supplier routing, purchasing channel policy, maverick spend reduction through guided buying
+  why_needed: Primary reference for assessing guided buying adoption gaps and maverick spend channel controls — defines the guided buying policy enforcement model used to classify off-contract spend findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Ariba Contracts — Contract Compliance and Consumption
+
+- SAP Ariba Contracts — Contract Compliance and Monitoring
+  https://help.sap.com/docs/SAP_ARIBA_CONTRACTS/ariba-contracts/contract-compliance-and-monitoring
+  source_owner: SAP SE
+  topic_supported: Contract-to-PO linkage configuration, contract consumption monitoring, contract compliance rate reporting, contract leakage threshold configuration, sourcing workflow design in SAP Ariba Sourcing and Contracts
+  why_needed: Authoritative reference for assessing contract compliance and leakage — defines the contract consumption and PO linkage model used to classify contract compliance findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Ariba Supplier Risk — Supplier Qualification and Risk Scoring
+
+- SAP Ariba Supplier Risk — Risk Assessment and Qualification
+  https://help.sap.com/docs/SAP_ARIBA_SUPPLIER_RISK/ariba-supplier-risk/supplier-risk-assessment
+  source_owner: SAP SE
+  topic_supported: Supplier risk score configuration, risk threshold alerting, supplier qualification workflow, financial health monitoring, geographic and concentration risk assessment, ESG and diversity screening
+  why_needed: Defines the supplier risk and qualification model — required to classify supplier risk exposure gaps and missing qualification controls in source-to-pay processes
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP S/4HANA Procurement — Three-Way Match and Invoice Processing
+
+- SAP S/4HANA Procurement — Invoice Verification and Three-Way Match
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-procurement/invoice-verification-and-three-way-match
+  source_owner: SAP SE
+  topic_supported: Three-way match configuration (invoice/PO/GR), tolerance group setup for invoice verification, hold and exception management workflow in Materials Management (MM-IV), LIV (Logistics Invoice Verification), tolerance-based invoice release
+  why_needed: Primary reference for assessing three-way match discipline and tolerance control design — defines the invoice matching model used to classify match leakage and tolerance override findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Ariba Discount Management — Early Payment Discount Capture
+
+- SAP Ariba Discount Management and Dynamic Discounting
+  https://help.sap.com/docs/SAP_ARIBA_DISCOUNT_MANAGEMENT/ariba-discount-management/dynamic-discounting
+  source_owner: SAP SE
+  topic_supported: Early payment discount program setup, dynamic discounting configuration, discount window monitoring, discount capture rate reporting, integration with SAP S/4HANA Accounts Payable payment terms
+  why_needed: Defines the discount capture model in SAP Ariba Discount Management — required to classify early payment discount leakage and AP process timing gaps
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Ariba Spend Analysis — Spend Visibility and Category Management
+
+- SAP Ariba Spend Analysis — Configuration and Reporting
+  https://help.sap.com/docs/SAP_ARIBA_SPEND_ANALYSIS/ariba-spend-analysis/spend-visibility-and-classification
+  source_owner: SAP SE
+  topic_supported: Spend analysis category hierarchy configuration, supplier normalization, multi-channel spend data ingestion (PO-based, non-PO, procurement card), spend classification accuracy, spend visibility dashboard coverage
+  why_needed: Reference for assessing spend analytics visibility gaps — defines the spend analysis data model and category hierarchy used to classify spend blind spot findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Ariba Sourcing — Sourcing Projects and Events
+
+- SAP Ariba Sourcing — Sourcing Projects and Competitive Events
+  https://help.sap.com/docs/SAP_ARIBA_SOURCING/ariba-sourcing/sourcing-projects-and-events
+  source_owner: SAP SE
+  topic_supported: Sourcing project template configuration, RFx event type design (RFI, RFP, RFQ, reverse auction), supplier invitation and participation controls, scoring template design, award recommendation workflow, savings baseline and savings tracking in SAP Ariba Sourcing
+  why_needed: Defines the competitive sourcing process and control model — required to classify sourcing bypass findings, single-source exceptions without approval, and award process integrity gaps
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Ariba and SAP S/4HANA Procurement documentation describes the designed control model and configuration options for source-to-pay processes. It does not prove what guided buying rules are active in the user's tenant, what contract consumption rates are, whether three-way match tolerances are approved, or whether supplier risk scores are configured for specific suppliers. Users must supply configuration exports, spend analysis reports, contract compliance metrics, exception reports, supplier risk summaries, discount capture rate data, or written descriptions of their source-to-pay landscape for concrete assessment.

package/skills/sap/sap-procurement-ariba-value-leakage-review/references/safety-checklist.md

@@ -0,0 +1,38 @@
+# Safety checklist — SAP Procurement Ariba Value Leakage Review
+
+Use before making any procurement value leakage remediation recommendation, especially for findings involving three-way match tolerance overrides, supplier sanctions screening, contract compliance bypass, or payments to unqualified suppliers.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live SAP Ariba tenant, SAP Ariba Network, SAP S/4HANA Procurement system, Fiori launchpad, or production procurement database. This skill reviews artifacts only.
+- Do not accept or request SAP Ariba login credentials, API tokens, or direct procurement database access.
+- Do not create, approve, modify, or release any purchase requisition, purchase order, contract, invoice, or payment. There is no procurement document creation or mutation in this skill's execution path. Recommendations always describe configuration and process changes, not direct procurement transactions.
+- Do not approve, close, or recommend closing an unmitigated critical finding (three-way match bypass without approval; payment to sanctioned supplier) without documented compliance and audit team authorization.
+- Do not recommend implementing configuration changes (tolerance group edits, guided buying rule activation, contract linkage enforcement) directly in a production SAP Ariba tenant or SAP S/4HANA system. All recommendations must first be tested in a non-production environment.
+- Do not use memory alone to assert what a specific SAP Ariba tenant's guided buying enforcement rules, contract consumption rates, or tolerance group settings are. All findings must be grounded in user-provided artifacts or official SAP Ariba documentation.
+- Do not conflate a three-way match tolerance (a configured control parameter allowing defined variance) with a match bypass (a missing or disabled match requirement). A tolerance is a managed control; a bypass is a control failure. The distinction determines the risk classification.
+
+## What people get wrong
+
+- **Treating tolerance groups as a sufficient match control**: A tolerance group that allows automatic invoice release for price variances up to 10% or quantity variances up to 5% is a managed control — but only if tolerance overrides still require documented approval for releases above zero. A tolerance that releases invoices automatically without any approval step is a control gap, not a tolerance design.
+- **Overlooking non-PO spend in leakage analysis**: Spend analysis that covers only PO-based spend misses a significant leakage channel. Non-PO invoices (direct-pay, emergency purchases, service-based invoices without PO reference) are frequently the largest maverick spend source. Procurement card spend adds a third channel. All three must be in scope.
+- **Conflating contract existence with contract compliance**: An active contract in SAP Ariba Contracts does not prove that spend is flowing through the contract. Contract compliance requires both contract existence and enforcement that routes POs through the contract. Low contract consumption rates with high spend in the category signal contract existence without compliance.
+- **Missing guided buying bypass in analytics**: SAP Ariba reporting may not surface the guided buying bypass rate directly — it requires comparing total requisition volume to guided-buying-sourced requisition volume per category. A review that only confirms guided buying is configured without measuring actual bypass rates misses the adoption gap finding.
+- **Treating supplier qualification as a one-time event**: Supplier qualification completion at onboarding does not guarantee ongoing risk management. Supplier financial health, geographic concentration, and sanctions status change over time. A qualification framework without periodic re-screening and automated alerts for material risk changes is an incomplete supplier risk control.
+- **Ignoring discount window timing in AP process design**: Early payment discount capture is not purely a configuration question — it is a process timing question. An AP process that routes invoices through multi-level approval before coding and payment release will systematically miss discount windows even when SAP Ariba Discount Management is correctly configured.
+- **Assuming three-way match is active for all PO types**: In SAP S/4HANA, three-way match (invoice/PO/GR) is required for stock material POs but may not be enforced for service POs, blanket POs, or invoicing plan POs. A review that confirms three-way match is enabled for goods-based procurement but does not check service and blanket PO invoice verification may miss the largest match leakage channel.
+
+## When to push back
+
+- Push back (and escalate) when a critical finding is identified (three-way match bypass without approval enabling automated payment; payment to a supplier with active sanctions alert) — do not proceed with other recommendations until this is escalated to the audit and compliance teams.
+- Push back when the user asks to confirm procurement compliance from memory alone without providing spend analysis reports, contract compliance metrics, exception reports, or supplier risk summaries.
+- Push back when the request requires live SAP Ariba tenant access, Ariba API calls, or SAP S/4HANA system inspection — state clearly that live inspection is out of scope and ask the user to supply the relevant exports or summaries.
+- Push back when asked to create purchase orders, approve invoices, release payments, or modify supplier records — this is an absolute boundary and must be refused in all circumstances.
+- Push back when asked to approve or close a compliance finding or sanctions screening alert without audit team and legal team authorization — this skill is advisory only.
+- Push back when the user presents a single-channel spend report (PO-based only) as a complete view of procurement value leakage — non-PO and procurement card channels must be included for a meaningful assessment.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP Ariba, SAP S/4HANA Procurement, or SAP Help Portal source-to-pay documentation, SAP Ariba best practice guides, or SAP procurement compliance guidance
+- `user-provided evidence` — spend analysis exports, contract compliance reports, three-way match exception reports, supplier risk summaries, discount capture rate data, guided buying adoption metrics, invoice aging reports, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such

package/skills/sap/sap-procurement-ariba-value-leakage-review/references/workflow-and-output.md

@@ -0,0 +1,87 @@
+# Workflow and output contract — SAP Procurement Ariba Value Leakage Review
+
+Use this reference for all value leakage finding classification, risk level assignment, remediation path selection, and output formatting.
+
+## Procurement value leakage finding taxonomy
+
+| Domain | Finding class | Description |
+|--------|--------------|-------------|
+| `maverick-spend` | `off-contract-channel-active` | Spend in a category with active negotiated contracts is being placed through non-contract channels (free-text PO, non-preferred supplier, purchase card) without policy enforcement blocking or escalation |
+| `maverick-spend` | `guided-buying-not-enforced` | SAP Ariba guided buying is not configured to enforce preferred supplier routing or catalog-first purchasing for in-scope categories — users can bypass without system-level friction |
+| `maverick-spend` | `catalog-coverage-gap` | Approved supplier catalog content is absent or outdated for a high-spend category — users default to free-text requisitions because guided buying offers no viable catalog option |
+| `contract-compliance` | `low-contract-consumption` | Contract consumption rate is materially below committed volumes for a negotiated agreement — savings from the negotiated rate are not being realized |
+| `contract-compliance` | `po-without-contract-linkage` | Purchase orders in an in-scope spend category are being created without reference to an active contract — contract bypass without system enforcement or approval |
+| `contract-compliance` | `contract-leakage-threshold-missing` | No contract leakage threshold or compliance alert is configured — low consumption rates are not surfaced to category managers or procurement leadership until contract expiry |
+| `supplier-risk` | `unqualified-supplier-with-spend` | A supplier with active purchase orders or invoices has not completed the required qualification workflow in SAP Ariba Supplier Management — unassessed risk with active spend exposure |
+| `supplier-risk` | `risk-alert-threshold-not-configured` | Supplier risk scoring thresholds are not configured or are set too broadly — material changes in supplier financial health, geographic risk, or sanctions status do not generate alerts |
+| `supplier-risk` | `concentration-risk-not-monitored` | Spend concentration in a single supplier or geographic region above a material threshold is not tracked or reported — single-point-of-failure risk in the supply base |
+| `three-way-match` | `tolerance-override-without-approval` | Invoice tolerance override (quantity or price) is configured to release invoices automatically without requiring documented approver authorization — payment can be released on a match failure without human review |
+| `three-way-match` | `exception-hold-aging` | Invoice holds from match exceptions are aging beyond the target resolution window — aged holds create payment delay risk (penalty) and mask systematic match failure patterns |
+| `three-way-match` | `gr-not-required-for-payment` | Invoice payment can be released in SAP S/4HANA before a goods receipt (GR) is posted — three-way match control is incomplete for goods-based procurement |
+| `discount-capture` | `discount-window-expiry` | Early payment discount windows are expiring without capture due to AP processing delays — measurable cost of foregone discount income |
+| `discount-capture` | `dynamic-discounting-not-active` | SAP Ariba Discount Management or dynamic discounting is not configured for eligible high-spend suppliers — available discount capture mechanism is unused |
+| `discount-capture` | `discount-monitoring-gap` | No dashboard or report monitors available discount opportunities against capture rates — discount leakage is invisible to AP management |
+| `guided-buying` | `bypass-rate-above-threshold` | Guided buying bypass rate exceeds 20% for in-scope categories — policy is not being enforced or guided buying user experience is insufficient to drive adoption |
+| `spend-analytics` | `non-po-spend-excluded` | Non-PO spend (invoices without a purchase order reference) is not included in spend analysis — a material spend channel is invisible to category management |
+
+## Risk level assignment
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | Three-way match bypass without approval enabling payment to unauthorized or fraudulent invoices; payment to a supplier with active sanctions screening alert |
+| `high` | Maverick spend above materiality threshold in a category with negotiated contracts; contract PO linkage bypass without enforcement; unqualified supplier with active spend; tolerance override without approver authorization; discount capture failure at material scale |
+| `medium` | Guided buying bypass rate above 20%; catalog coverage gap driving free-text spend; contract consumption below target without alert; exception hold aging beyond target; concentration risk not monitored |
+| `low` | Best practice deviation in sourcing workflow design; minor catalog update lag; spend analytics category hierarchy alignment gap |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this a three-way match bypass without approver authorization releasing payment?**
+   - Yes → `critical`. Immediately escalate to the audit team and AP controls team. Suspend the tolerance override configuration pending review. Require documented approver authorization for all exception invoice releases. Do not proceed with other recommendations until this is escalated.
+   - No → continue.
+
+2. **Is this a payment to a supplier with an active sanctions or disqualification alert?**
+   - Yes → `critical`. Immediately escalate to the compliance and legal team. Place a payment block on affected invoices pending compliance review. Do not proceed without compliance team authorization.
+   - No → continue.
+
+3. **Is this maverick spend above a material threshold in a category with active contracts?**
+   - Yes → `high`. Enable guided buying enforcement rule to require catalog or contract selection for the affected category. Review and resolve catalog coverage gaps. Report spend bypass to category managers monthly until spend channel discipline is restored.
+   - No → continue.
+
+4. **Is this a contract compliance leakage finding (low consumption or PO-without-contract)?**
+   - Yes → `high`. Configure contract-to-PO linkage enforcement in SAP Ariba Buying or SAP S/4HANA Procurement. Activate contract leakage threshold alerts in SAP Ariba Contracts. Engage category managers to address low consumption root cause (contract terms, supplier performance, internal process).
+   - No → continue.
+
+5. **Is this a supplier risk gap with active spend exposure?**
+   - Yes → `high`. Require supplier qualification completion before new POs can be issued to the affected supplier. Configure risk score threshold alerts in SAP Ariba Supplier Risk for the affected supplier tier. Review concentration exposure and document contingency supplier options.
+   - No → continue.
+
+6. **Is this a discount capture failure at material scale?**
+   - Yes → `high`. Diagnose AP processing cycle time vs. discount window. Configure discount monitoring dashboard in SAP Ariba Discount Management. Activate dynamic discounting for eligible suppliers. Set AP SLA target for invoice processing within the discount window.
+   - No → classify as `medium` or `low` and provide guidance.
+
+## Workflow
+
+1. **Receive artifacts** — spend analysis exports, contract compliance reports, guided buying adoption metrics, three-way match exception reports, supplier risk summaries, discount capture rate data, invoice aging reports, or written descriptions of the source-to-pay landscape.
+2. **Classify each finding** by procurement leakage domain and finding class.
+3. **Assign risk level** per the table above (critical / high / medium / low).
+4. **Flag critical findings** immediately — three-way match bypass without approval and payments to sanctioned suppliers must be escalated before any other remediation discussion.
+5. **Apply remediation decision tree** per finding.
+6. **Prioritize** — critical match bypass and sanctions issues first; then high maverick spend, contract compliance, supplier risk, tolerance override, and discount capture gaps; then medium guided buying and catalog findings; then low best-practice items.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Value leakage domain and finding class per finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. Finding detail: affected spend category, supplier or contract (if provided), SAP Ariba module or S/4HANA configuration object, and specific leakage or control gap
+5. Quantified leakage estimate where data is available (spend volume at risk, discount window value, contract shortfall vs. committed volume)
+6. Recommended remediation action (guided buying enforcement, contract linkage activation, supplier qualification requirement, tolerance approval workflow, discount monitoring setup, spend analytics channel inclusion, etc.)
+7. Procurement value leakage posture after remediation
+8. Escalation notice for any critical three-way match bypass or sanctions payment finding — explicit statement that this requires audit team and compliance team sign-off before proceeding
+9. Prioritized remediation sequence
+10. Confirmation that no purchase orders were created, no invoices were approved, no payments were released, and no supplier records were modified in this review

package/skills/sap/sap-procurement-license-finops-vendor-protocol/SKILL.md

@@ -0,0 +1,155 @@
+---
+name: sap-procurement-license-finops-vendor-protocol
+description: Cross-functional coordination protocol governing handoff contracts between SAP Procurement/License, FinOps, and Vendor Management. Activates on BTP consumption spikes, entitlement changes, license compliance events, RISE/SLA issues, vendor lock-in exposure, contractual risk, underused subscriptions, and over-provisioned services. Advisory and audit only — no live mutation.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: finops
+  lifecycle: experimental
+---
+
+# SAP Procurement / License / FinOps / Vendor Protocol
+
+## Purpose
+
+This skill is a cross-functional coordination and handoff contract between four complementary advisory roles: SAP license and BTP consumption analysis, procurement and Ariba value-leakage review, RISE/SLA and vendor-risk assessment, and BTP entitlement governance oversight. It defines when each role activates, what evidence each role requires before it can produce output, how findings are handed off between roles, who holds decision rights over contractual and provisioning actions, and what approval is required before any irreversible change is recommended to a downstream guarded-mutating operator.
+
+This protocol never mutates. It never invokes or bypasses any guarded-mutating operator gate. It produces advisory packages, handoff summaries, and escalation triggers only.
+
+## When to use
+
+Activate this protocol when one or more of the following conditions apply:
+
+- BTP service consumption has spiked unexpectedly — credits consumed faster than forecast, or a subaccount is consuming entitlements beyond its approved budget.
+- An entitlement change is planned or requested — new service enablement, quota increase, or entitlement transfer between subaccounts or directories.
+- A license compliance review is required — SAP S/4HANA user counts, named user vs. concurrent user reclassification, indirect access exposure, or measurement audit preparation.
+- A RISE with SAP contract event arises — SLA breach, support escalation, hyperscaler region change, contract renewal, or exit clause evaluation.
+- Vendor lock-in risk has been identified — single-vendor dependency on BTP services with no exit path documented, or architectural decisions that increase switching costs without business justification.
+- Contractual exposure has been flagged — penalty clauses, auto-renewal commitments, minimum consumption guarantees, or true-up obligations approaching a deadline.
+- Underused or idle subscriptions exist — BTP service subscriptions that have not been consumed for 60 days or more, or CF/Kyma environments with zero workloads.
+- Over-provisioned services are suspected — entitlement quota far exceeding actual measured consumption, or CPEA/BTPEA credits allocated to services with near-zero usage.
+
+## Participating agents
+
+The following agents are parties to this protocol. Each operates in its own advisory domain. No agent in this list holds authority to execute irreversible changes unilaterally.
+
+- `sap-license-btp-consumption-finops-agent` — analyzes BTP credit consumption, CPEA/BTPEA burn rate, service-level cost attribution, and SAP license measurement data. Primary entry point for consumption spike triage.
+- `sap-procurement-ariba-value-leakage-agent` — reviews SAP Ariba sourcing workflows, contract compliance, maverick spend, and procurement-side value leakage tied to SAP vendor agreements and BTP commercial terms.
+- `sap-rise-sla-vendor-risk-agent` — assesses RISE with SAP SLA performance, hyperscaler dependency, vendor exit risk, contractual penalty exposure, and strategic vendor concentration risk.
+- `sap-btp-entitlement-guarded-operator-agent` — holds the guarded mutation gate for any BTP entitlement change. No entitlement addition, removal, or quota modification proceeds without a signed handoff package from this protocol and explicit human approval. This agent does not activate from this protocol directly; the protocol produces the package that a human submits to the operator gate.
+
+## Required evidence
+
+Before this protocol can produce a handoff package, the activating party must supply:
+
+1. **Consumption snapshot** — BTP cockpit usage report, CPEA/BTPEA credit statement, or equivalent export showing actual vs. allocated consumption for the relevant period.
+2. **Entitlement inventory** — current entitlement assignments at global account, directory, and subaccount level, including service plan names and quota values.
+3. **Contract reference** — relevant SAP contract ID, RISE agreement reference, or Ariba contract document (redacted of commercially sensitive terms if necessary) identifying the obligation in scope.
+4. **Trigger description** — a written description of the event that triggered this protocol (spike alert, audit notice, renewal deadline, SLA breach report, etc.).
+5. **Business owner confirmation** — identification of the named business owner or cost center responsible for the entitlements or subscriptions under review.
+
+Optional but recommended:
+
+- SAP license measurement report or user count extract for license compliance reviews.
+- Vendor contract schedule or SLA annexe for RISE/SLA events.
+- Ariba contract compliance report for procurement-side leakage reviews.
+
+## Redaction policy
+
+All evidence submitted to this protocol must be redacted before processing:
+
+- Remove all SAP contract IDs, agreement numbers, and commercial unit prices.
+- Remove all personally identifiable information (PII) from user count reports.
+- Remove all OAuth tokens, service keys, API keys, and platform credentials.
+- Remove customer names, tenant IDs, and internal cost center codes beyond the minimum needed to identify the responsible business unit.
+- Label redacted fields with `[REDACTED]`.
+
+This protocol does not store, persist, or transmit evidence artifacts. Evidence is used only within the advisory session in which it is provided.
+
+## Decision rights
+
+| Decision | Owner | Protocol role |
+|----------|-------|---------------|
+| Approve entitlement quota increase | Global Account Administrator + Finance sponsor | Protocol produces recommendation; human approves |
+| Approve entitlement quota reduction | Global Account Administrator | Protocol produces recommendation; human approves |
+| Initiate RISE contract escalation | SAP Account Executive + Procurement lead | Protocol produces escalation brief; human initiates |
+| Approve subscription termination | Business owner + FinOps lead | Protocol produces risk summary; human approves |
+| Authorize true-up payment or credit purchase | CFO or delegate | Protocol produces cost exposure summary; human authorizes |
+| Flag vendor lock-in for architecture review | Enterprise Architect + CTO | Protocol raises flag; human schedules review |
+
+## Escalation owners
+
+- **FinOps lead** — primary escalation point for consumption anomalies and credit burn rate deviations.
+- **SAP Commercial Manager / Account Executive** — escalation point for contract compliance, RISE SLA breaches, and true-up events.
+- **Enterprise Architect** — escalation point for vendor lock-in risk and architectural dependency findings.
+- **Chief Procurement Officer or delegate** — escalation point for contractual penalty exposure and sourcing governance failures.
+- **Global Account Administrator** — escalation point for all BTP entitlement governance findings that require platform-level action.
+
+## Irreversible-action gate
+
+The following actions are classified as irreversible or high-consequence and require explicit human approval before any recommendation is executed:
+
+- Reducing entitlement quota below current consumption (terminates running service instances).
+- Removing a service subscription that has active bindings or deployed applications.
+- Triggering a contract exit clause or termination notice.
+- Reclassifying SAP named users in a way that reduces license count (creates compliance exposure if later reversed).
+- Decommissioning a BTP subaccount with active workloads.
+
+This protocol does not invoke `sap-btp-entitlement-guarded-operator-agent` or any other operator gate. It produces a signed handoff package. A human must present that package to the operator gate and confirm approval before any mutation proceeds.
+
+## Approval requirements
+
+| Action type | Minimum approvers | Approval form |
+|-------------|------------------|---------------|
+| Quota increase (any service) | Global Account Admin + FinOps lead | Written sign-off in change record |
+| Quota reduction | Global Account Admin + Business owner | Written sign-off in change record with consumption evidence attached |
+| Subscription termination | Business owner + FinOps lead + Legal review if contractual | Signed decommission record |
+| RISE escalation submission | Procurement lead + Account Executive | Approved escalation brief |
+| Credit purchase | Finance sponsor | Purchase order or approved budget line |
+
+## Audit package
+
+At session close, this protocol produces an audit package containing:
+
+1. **Trigger summary** — what event activated the protocol and when.
+2. **Evidence inventory** — list of evidence artifacts received (types only; no raw content), with redaction confirmation.
+3. **Findings per participating role** — advisory output from each relevant agent role, labelled by evidence level.
+4. **Decision rights mapping** — which decisions are pending and who holds approval authority.
+5. **Irreversible-action gate status** — whether any irreversible action has been recommended, and whether human approval has been confirmed.
+6. **Escalation log** — which escalation owners were notified and what action was requested.
+7. **Handoff status** — whether the package is ready to submit to a guarded-mutating operator gate.
+
+The audit package must be retained by the activating team for a minimum of 12 months or for the duration of the relevant contract, whichever is longer.
+
+## Refusal conditions
+
+This protocol refuses to proceed when:
+
+- No consumption snapshot or entitlement inventory has been provided — advisory output without evidence is not reliable.
+- A request is made to directly invoke `sap-btp-entitlement-guarded-operator-agent` or any other operator gate from within this protocol — that gate is human-mediated only.
+- Raw contract pricing, commercial unit prices, or supplier margin data are submitted without redaction — request redaction before proceeding.
+- A request is made to recommend an irreversible action without identifying the human approver — the approver must be named before the package is finalized.
+- The trigger event is outside the scope defined in "When to use" — redirect to the appropriate protocol or skill.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP Help Portal, SAP RISE documentation, SAP Ariba product documentation, or official SAP FinOps guidance.
+- `user-provided evidence` — consumption exports, entitlement summaries, contract references, or measurement reports supplied by the user.
+- `inference` — derived reasoning not directly confirmed by official documentation or user evidence; always label as inference and note the assumption.
+
+## Response minimum
+
+Every protocol session must return, at minimum:
+
+- **Trigger classification** — which "When to use" condition(s) activated the protocol.
+- **Participating roles activated** — which of the four agents' advisory domains are relevant to this session.
+- **Evidence received** — inventory of what was supplied, with confirmation of redaction compliance.
+- **Findings per domain** — advisory output for each activated role, with evidence labels.
+- **Decision rights table** — who must approve each pending action.
+- **Irreversible-action gate status** — whether irreversible actions are in scope and whether human approval has been confirmed.
+- **Audit package readiness** — whether the session is complete enough to produce a handoff package for the operator gate.
+- **Next step** — the specific human action required to proceed (e.g., "Submit this package to Global Account Administrator for quota reduction approval").

package/skills/sap/sap-procurement-license-finops-vendor-protocol/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP Procurement / License / FinOps / Vendor Protocol"
+  short_description: "Cross-functional coordination protocol for BTP consumption spikes, entitlement changes, license compliance, RISE/SLA issues, vendor lock-in, contractual exposure, underused subscriptions, and over-provisioned services. Advisory only — no live mutation."
+  default_prompt: "Use $sap-procurement-license-finops-vendor-protocol to coordinate a cross-functional advisory session. Classify the trigger condition, identify which participating agent roles are relevant, inventory the evidence provided, produce per-domain findings with evidence labels, map decision rights to named approvers, confirm irreversible-action gate status, and return an audit package ready for human review before any operator gate submission."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/btp/sap-business-technology-platform/commercial-models"
+      description: "SAP BTP commercial models documentation — primary reference for CPEA, BTPEA, and consumption-based billing governance"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-procurement-license-finops-vendor-protocol/metadata.json

@@ -0,0 +1,35 @@
+{
+  "id": "sap-procurement-license-finops-vendor-protocol",
+  "name": "SAP Procurement / License / FinOps / Vendor Protocol",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Cross-functional coordination protocol for SAP Procurement, License, FinOps, and Vendor Management. Governs handoff contracts for BTP consumption spikes, entitlement changes, license compliance, RISE/SLA issues, vendor lock-in exposure, contractual risk, underused subscriptions, and over-provisioned services. Advisory and audit only — no live mutation, no operator gate bypass.",
+  "source_type": "original",
+  "category": "finops",
+  "official_docs": [
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/commercial-models",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/entitlements-and-quotas",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/monitoring-usage-and-consumption-costs-in-your-global-account",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/what-is-btpea",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/cloud-credits",
+    "https://help.sap.com/docs/sap-ariba/sap-ariba-contracts/about-sap-ariba-contracts",
+    "https://help.sap.com/docs/sap-ariba/ariba-sourcing/about-ariba-sourcing",
+    "https://www.sap.com/products/erp/rise-with-sap/what-is-rise-with-sap.html",
+    "https://help.sap.com/docs/rise-with-sap/rise-with-sap-cloud-contract/cloud-services-schedule",
+    "https://support.sap.com/en/my-support/systems-installations/crum.html"
+  ],
+  "security_notes": "This protocol accepts only user-supplied evidence artifacts. Never accept or store raw contract pricing, supplier margins, or commercial unit prices. All evidence must be redacted of PII, OAuth tokens, service keys, API credentials, SAP contract IDs, and tenant IDs before processing. This protocol does not invoke any guarded-mutating operator gate. All irreversible actions require named human approval before a handoff package is submitted to an operator.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-procurement-license-finops-vendor-protocol",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}