@raishin/vanguard-frontier-agentic 3.0.0-alpha.7 → 3.0.1

package/skills/sap/sap-ai-core-generative-ai-hub-governance/references/workflow-and-output.md

@@ -0,0 +1,75 @@
+# Workflow and output contract — SAP AI Core Generative AI Hub Governance
+
+Use this reference for all classification, severity assignment, and output formatting.
+
+## Governance domain taxonomy
+
+| Domain | Scope |
+|--------|-------|
+| `Model Access` | Resource group isolation, AI API service key scope, model deployment access, separation of duties between aicore_admin/genai_manager/genai_viewer roles |
+| `Data Privacy` | Classification of grounding data sources, personal data in prompts and embeddings, embedding storage location, data residency compliance, right-to-erasure for vectorized data |
+| `Prompt Injection Risk` | Unguarded template variables in orchestration configs, system-prompt integrity, input/output content safety filter coverage, grounding output sanitization |
+| `Grounding Data` | Data classification before ingestion, cross-resource-group vector store sharing, sensitive data in shared vector stores, metadata exposure in retrieval results |
+| `Prompt Logging` | Prompt logging enablement state, retention period, access controls on log storage, compliance with data residency for logged prompts containing personal data |
+| `Auditability` | Model version pinning, grounding source attribution in responses, audit log completeness for AI-assisted business decisions, explainability documentation |
+
+## Severity classification
+
+| Severity | Meaning | Examples |
+|----------|---------|---------|
+| `critical` | Regulatory breach, data exfiltration, or security bypass risk | Personal data ingested into a shared cross-tenant vector store with no isolation; orchestration endpoint accessible without authentication; prompt logs containing personal data stored outside the contracted data region |
+| `high` | Governance control gap with material privacy or security impact | No content safety filters on input or output for a customer-facing orchestration pipeline; confidential business data in grounding documents with no access control on the vector store; `aicore_admin` role granted to end-users without separation of duties |
+| `medium` | Audit or compliance gap | Model version not pinned (`latest` alias used) for auditable AI-assisted decisions; prompt logging enabled with no documented retention limit; no grounding source attribution in orchestration output for compliance-relevant responses |
+| `low` | Best practice deviation | Missing metadata classification on grounding documents (even for non-personal data); no documented model change approval process |
+
+## Common finding patterns
+
+### Model Access
+- `aicore_admin` role assigned to the same user who operates grounding pipelines (high — violates separation of duties)
+- AI API service key with `global` scope instead of resource-group-scoped key (high — over-permissioned key)
+- Multiple application teams sharing a single resource group with no isolation (high)
+
+### Prompt Injection Risk
+- Orchestration configuration with no `filtering_module_config` on the input path (high — prompt injection unfiltered)
+- Orchestration configuration with no `filtering_module_config` on the output path (high — harmful model output unfiltered)
+- Prompt template containing `{{ ?userInput }}` injected directly into system message without sanitization (high)
+- Grounding output (`{{ ?groundingOutput }}`) injected into prompt without content check (medium — indirect prompt injection via malicious grounding document)
+- Content safety thresholds set to maximum permissiveness (0 = allow) for all categories (high)
+
+### Grounding Data
+- Documents ingested into vector store without prior data classification review (high if organization handles personal or confidential data)
+- Vector store shared across resource groups or tenants without access control review (critical if different tenants)
+- Employee or customer PII present in grounding documents (critical — right-to-erasure obligations for vectorized data)
+- `metadata_params` exposing internal URLs or source identifiers to end-user output without review (medium)
+
+### Prompt Logging
+- Prompt logging enabled for a pipeline where end-user inputs may contain personal data, with no retention policy documented (medium to high depending on regulation)
+- Prompt logs stored in a data region different from where the personal data was originally collected (critical if GDPR cross-border transfer rules apply)
+- No role restriction on who can read prompt logs (high)
+
+### Auditability
+- Model version set to `latest` or floating alias for a pipeline that produces audit-relevant business output (medium)
+- No grounding source citation in orchestration response for compliance-relevant use case (medium)
+- No audit log entry for AI-assisted decisions that affect individual users (high for regulated industries)
+
+## Workflow
+
+1. **Receive artifacts** — orchestration configuration files, role assignment descriptions, resource group layouts, grounding pipeline design, data classification documentation, or user descriptions.
+2. **Classify each finding** by governance domain above.
+3. **Assign severity** (critical / high / medium / low).
+4. **Identify evidence level** (documentation-based / user-provided evidence / context7-supplementary / inference).
+5. **Recommend specific governance control** — content safety filter addition, data classification step, log access restriction, model version pin, erasure procedure.
+6. **Prioritize** — critical and high severity first; data privacy before auditability; prompt injection risk before logging.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Artifacts reviewed and governance domains in scope
+2. Finding(s) per domain with severity and evidence label
+3. Specific governance control recommendation per finding
+4. Data privacy summary — whether personal data was identified in grounding pipeline scope and what protections are in place
+5. Content safety coverage summary — input and output filter status per orchestration pipeline reviewed
+6. Prioritized remediation sequence (critical → high → medium → low)
+7. Escalation trigger if live AI Core access, prompt log inspection, or vector store query is required to complete the governance assessment — do not proceed with live access

package/skills/sap/sap-ai-governance-security-architecture-protocol/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: sap-ai-governance-security-architecture-protocol
+description: Cross-functional coordination protocol governing handoff contracts between SAP AI Governance, Security, and Architecture. Activates on AI Core workloads, Generative AI Hub deployments, Joule governance events, RAG design reviews, prompt-injection risk, data-leakage risk, model-access control gaps, and auditability of AI-generated outputs. Advisory and audit only — no live mutation.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: ai
+  lifecycle: experimental
+---
+
+# SAP AI Governance / Security / Architecture Protocol
+
+## Purpose
+
+This skill is a cross-functional coordination and handoff contract between four complementary advisory roles: SAP AI Core and Generative AI Hub governance review, Joule governance and adoption assessment, SAP security/IAM/GRC/SoD analysis, and SAP CAP architecture review. It defines when each role activates, what evidence each role requires before it can produce output, how findings are handed off between roles, who holds decision rights over AI workload deployments and access control changes, and what approval is required before any irreversible change is recommended to a downstream guarded-mutating operator.
+
+This protocol never mutates. It never invokes or bypasses any guarded-mutating operator gate. It produces governance advisory packages, risk assessments, and escalation triggers only.
+
+## When to use
+
+Activate this protocol when one or more of the following conditions apply:
+
+- An AI Core workload is being planned, deployed, or reviewed — including custom model deployments, fine-tuning jobs, inferencing endpoints, or resource group configurations on SAP AI Core.
+- A Generative AI Hub integration is in scope — including proxy model consumption via the Generative AI Hub API, foundation model selection, token budget governance, or cost attribution for generative AI usage.
+- Joule is being governed or adopted — including Joule skill configuration, Joule integration with SAP applications, scope of Joule access to SAP business data, and change management for AI-assisted business process execution.
+- A RAG (Retrieval-Augmented Generation) design is under review — including document grounding strategy, vector store selection (SAP HANA Cloud vector engine or external), embedding model governance, data ingestion pipeline design, and retrieval access controls.
+- Prompt injection risk has been identified or reported — any scenario where user-controlled or externally sourced text may influence an LLM system prompt, tool call, or agent reasoning path in an SAP AI workload.
+- Data leakage risk exists — where sensitive SAP business data (customer records, financial data, HR data) may be transmitted to a foundation model, embedded in a vector store without access controls, or exposed via an AI-generated output channel.
+- Model-access control gaps have been found — including missing authentication on AI Core inferencing endpoints, overly broad role assignments to Generative AI Hub consumers, or absent content filtering on model outputs.
+- Auditability of AI-generated outputs is required — where regulatory, compliance, or internal audit requirements mandate that AI-generated business decisions, documents, or recommendations are traceable to model version, input, and output artifacts.
+
+## Participating agents
+
+The following agents are parties to this protocol. Each operates in its own advisory domain. No agent in this list holds authority to execute irreversible changes unilaterally.
+
+- `sap-ai-core-genai-hub-governance-reviewer-agent` — reviews SAP AI Core resource group design, model deployment governance, Generative AI Hub proxy configuration, token budget controls, and cost attribution. Primary entry point for AI workload governance reviews.
+- `sap-joule-governance-adoption-agent` — assesses Joule skill configuration, business process scope, data access permissions granted to Joule, user adoption governance, and change management for AI-assisted workflows.
+- `sap-security-iam-grc-sod-reviewer-agent` — reviews identity and access management, GRC policy compliance, segregation of duties (SoD) conflicts in AI role assignments, and security architecture for AI workloads. Activated for any finding involving authentication, authorization, content filtering, or regulatory compliance.
+- `sap-cap-architecture-reviewer-agent` — reviews SAP Cloud Application Programming model (CAP) service design where CAP services expose AI capabilities, provide grounding data for RAG pipelines, or act as orchestration layers between Joule/Generative AI Hub and SAP business data. Activated when the AI workload has a CAP service layer.
+
+## Required evidence
+
+Before this protocol can produce a handoff package, the activating party must supply:
+
+1. **AI workload description** — a written description of the AI workload or scenario under review, including the SAP AI product(s) involved, the business use case, and the data sources accessed.
+2. **Architecture diagram or topology description** — a description or diagram of how the AI components interact: model source, grounding data path, orchestration layer, output consumers, and human-in-the-loop controls.
+3. **Data classification** — what categories of SAP business data are in scope (e.g., customer PII, financial records, HR data, public catalog data) and their classification level under the organization's data classification policy.
+4. **Access control inventory** — current role assignments for AI Core resource groups, Generative AI Hub scopes, Joule skill permissions, and any CAP service authorization policies.
+5. **Compliance scope** — which regulatory frameworks or internal compliance requirements apply to this workload (e.g., EU AI Act risk category, GDPR, SOX, industry-specific AI governance policies).
+
+Optional but recommended:
+
+- Existing threat model or security assessment for the AI workload.
+- Prompt template or system prompt (redacted of sensitive instructions and internal context if necessary).
+- Token budget configuration and cost attribution setup.
+- Audit log configuration for AI-generated output traceability.
+
+## Redaction policy
+
+All evidence submitted to this protocol must be redacted before processing:
+
+- Remove all OAuth tokens, API keys, service keys, and AI Core resource group credentials.
+- Remove all personally identifiable information (PII) from example prompts, RAG grounding documents, and model output samples.
+- Remove all proprietary system prompt content, internal business logic, and trade-secret instructions from prompt templates beyond what is necessary to assess the governance risk.
+- Remove all customer names, personal identification numbers, and financial account data from example payloads.
+- Label redacted fields with `[REDACTED]`.
+
+This protocol does not store, persist, or transmit evidence artifacts or prompt content. Evidence is used only within the advisory session in which it is provided.
+
+## Decision rights
+
+| Decision | Owner | Protocol role |
+|----------|-------|---------------|
+| Approve AI Core model deployment to production | AI Platform Lead + CISO or delegate | Protocol produces risk assessment; human approves |
+| Approve Generative AI Hub foundation model selection | AI Governance Board or delegate | Protocol produces model governance assessment; human approves |
+| Approve Joule skill activation for a business process | Business Process Owner + Joule Governance Lead | Protocol produces scope and risk summary; human approves |
+| Approve RAG grounding data pipeline to production | Data Owner + AI Platform Lead + Privacy Officer | Protocol produces data governance assessment; human approves |
+| Approve role assignment to AI Core resource group | IAM Lead + AI Platform Lead | Protocol produces SoD and least-privilege finding; human approves |
+| Remediate prompt injection risk in a deployed endpoint | AI Platform Lead + Security Lead | Protocol produces remediation recommendation; human approves and executes |
+| Approve content filtering configuration | AI Platform Lead + CISO | Protocol produces configuration recommendation; human approves |
+| Mandate auditability controls for AI-generated outputs | Compliance Officer + AI Governance Board | Protocol produces auditability gap assessment; human mandates controls |
+
+## Escalation owners
+
+- **AI Governance Board or delegate** — primary escalation point for foundation model selection, token budget governance, and AI policy compliance.
+- **CISO or Security Lead** — escalation point for prompt injection risk, data leakage risk, model-access control gaps, and content filtering findings.
+- **Data Protection Officer / Privacy Officer** — escalation point for PII in grounding data, GDPR-relevant AI processing, and cross-border data transfer in model inference.
+- **Compliance Officer** — escalation point for regulatory compliance (EU AI Act categorization, SOX impact of AI-generated financial outputs, industry-specific AI governance).
+- **AI Platform Lead** — escalation point for AI Core resource group design, Generative AI Hub configuration, and deployment governance.
+- **Joule Governance Lead** — escalation point for Joule skill scope, business process impact of AI-assisted execution, and Joule adoption change management.
+- **Enterprise Architect** — escalation point for CAP service design defects, RAG architecture risks, and AI workload topology findings.
+
+## Irreversible-action gate
+
+The following actions are classified as irreversible or high-consequence and require explicit human approval before any recommendation is executed:
+
+- Deploying a custom model to a production AI Core resource group (cannot be instantly rolled back without re-deploying the previous version).
+- Granting a Joule skill access to a new category of SAP business data (immediately expands AI's data access scope; rollback requires skill reconfiguration and redeployment).
+- Enabling a new foundation model in the Generative AI Hub for production consumer access (immediately available to all authorized consumers).
+- Removing content filtering from an AI Core inferencing endpoint (immediately eliminates output safety controls for all consumers of that endpoint).
+- Deleting or overwriting a vector store index used for RAG grounding (immediate data loss; requires full reingestion to restore).
+- Revoking an AI Core resource group credential used by a production AI application (immediately breaks all applications using that credential).
+
+This protocol does not invoke any guarded-mutating operator gate. It produces a signed handoff package. A human must present that package to the appropriate operator gate and confirm approval before any mutation proceeds.
+
+## Approval requirements
+
+| Action type | Minimum approvers | Approval form |
+|-------------|------------------|---------------|
+| Production model deployment | AI Platform Lead + CISO or delegate | Written sign-off in change record with risk assessment attached |
+| Foundation model selection change | AI Governance Board | Board approval record with governance assessment |
+| Joule skill data scope expansion | Business Process Owner + Privacy Officer | Written approval with data classification review |
+| RAG grounding pipeline production promotion | Data Owner + AI Platform Lead + Privacy Officer | Written sign-off with data flow diagram attached |
+| Content filtering configuration change | AI Platform Lead + CISO | Written approval with threat model reference |
+| AI Core credential rotation | AI Platform Lead | Written approval with rotation procedure and consumer impact assessment |
+
+## Audit package
+
+At session close, this protocol produces an audit package containing:
+
+1. **Workload summary** — AI products in scope, business use case, data classification, and compliance frameworks.
+2. **Evidence inventory** — list of evidence artifacts received (types only; no raw content), with redaction confirmation.
+3. **Per-role findings** — advisory output from each activated agent role, labelled by evidence level, risk tier, and governance domain.
+4. **Threat model summary** — key identified threats (prompt injection, data leakage, model access, output auditability) with likelihood and impact assessment.
+5. **Compliance gap summary** — gaps against declared regulatory frameworks (EU AI Act, GDPR, SOX, internal AI policy).
+6. **Decision rights mapping** — pending decisions and named approvers for each recommended action.
+7. **Irreversible-action gate status** — whether any irreversible action has been recommended, and whether human approval has been confirmed.
+8. **Escalation log** — which escalation owners were notified and what action was requested.
+9. **Handoff status** — whether the package is ready to submit to a guarded-mutating operator gate.
+
+The audit package must be retained for the duration of the AI workload's production lifecycle and for the post-decommission retention period required by applicable regulatory frameworks.
+
+## Refusal conditions
+
+This protocol refuses to proceed when:
+
+- No AI workload description or architecture topology has been provided — advisory output without evidence is not reliable.
+- A request is made to directly invoke any guarded-mutating operator gate from within this protocol — all operator gates are human-mediated only.
+- Raw OAuth tokens, API keys, or AI Core resource group credentials are present in submitted evidence without redaction — request redaction before proceeding.
+- A full system prompt containing proprietary business logic or internal instructions is submitted without redaction — accept only the minimum structural elements needed to assess governance risk.
+- A request is made to recommend an irreversible action without identifying the human approver — the approver must be named before the package is finalized.
+- A request is made to assess the safety or harmlessness of specific AI-generated content — this protocol assesses governance posture, not content safety of individual outputs.
+- The trigger event is outside the scope defined in "When to use" — redirect to the appropriate protocol or skill.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP AI Core documentation, SAP Generative AI Hub documentation, SAP Joule documentation, SAP CAP documentation, NIST AI RMF, ISO/IEC 42001, or OWASP LLM Top 10.
+- `user-provided evidence` — architecture diagrams, access control inventories, compliance scope declarations, audit log configurations, or workload descriptions supplied by the user.
+- `inference` — derived reasoning not directly confirmed by official documentation or user evidence; always label as inference and note the assumption.
+
+## Response minimum
+
+Every protocol session must return, at minimum:
+
+- **Trigger classification** — which "When to use" condition(s) activated the protocol.
+- **Participating roles activated** — which of the four agents' advisory domains are relevant to this session.
+- **Evidence received** — inventory of what was supplied, with confirmation of redaction compliance.
+- **Threat model summary** — key threats identified (prompt injection / data leakage / model access / auditability) with confidence level.
+- **Findings per domain** — advisory output for each activated role, with evidence labels and risk tier.
+- **Compliance gap summary** — gaps against declared regulatory frameworks.
+- **Decision rights table** — who must approve each pending action.
+- **Irreversible-action gate status** — whether irreversible actions are in scope and whether human approval has been confirmed.
+- **Audit package readiness** — whether the session is complete enough to produce a handoff package.
+- **Next step** — the specific human action required to proceed (e.g., "Present this package to the AI Governance Board and CISO for production model deployment approval").

package/skills/sap/sap-ai-governance-security-architecture-protocol/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP AI Governance / Security / Architecture Protocol"
+  short_description: "Cross-functional coordination protocol for AI Core workloads, Generative AI Hub, Joule governance, RAG designs, prompt-injection risk, data-leakage risk, model-access control, and auditability of AI-generated outputs. Advisory only — no live mutation."
+  default_prompt: "Use $sap-ai-governance-security-architecture-protocol to coordinate a cross-functional AI governance advisory session. Classify the trigger condition, identify which participating agent roles are relevant, inventory the evidence provided (confirming redaction), produce a threat model summary and per-domain findings with evidence labels, map decision rights to named approvers, confirm irreversible-action gate status, and return an audit package ready for human review before any operator gate submission."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/what-is-sap-ai-core"
+      description: "SAP AI Core service guide — primary reference for AI Core resource groups, model deployment governance, and security architecture"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-ai-governance-security-architecture-protocol/metadata.json

@@ -0,0 +1,35 @@
+{
+  "id": "sap-ai-governance-security-architecture-protocol",
+  "name": "SAP AI Governance / Security / Architecture Protocol",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Cross-functional coordination protocol for SAP AI Governance, Security, and Architecture. Governs handoff contracts for AI Core workloads, Generative AI Hub deployments, Joule governance, RAG designs, prompt-injection risk, data-leakage risk, model-access control gaps, and auditability of AI-generated outputs. Advisory and audit only — no live mutation, no operator gate bypass.",
+  "source_type": "original",
+  "category": "ai",
+  "official_docs": [
+    "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/what-is-sap-ai-core",
+    "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/resource-groups",
+    "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/security",
+    "https://help.sap.com/docs/sap-ai-launchpad/sap-ai-launchpad/generative-ai-hub-in-sap-ai-launchpad",
+    "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/consume-foundation-models",
+    "https://help.sap.com/docs/joule/joule/about-joule",
+    "https://help.sap.com/docs/sap-hana-cloud/sap-hana-cloud-database/sap-hana-cloud-sap-hana-database-vector-engine",
+    "https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf",
+    "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
+    "https://www.iso.org/standard/81230.html"
+  ],
+  "security_notes": "This protocol accepts only user-provided architecture descriptions and access control inventories. Never accept or process OAuth tokens, API keys, AI Core service keys, resource group credentials, system prompt content containing proprietary business logic, or PII from model inputs or outputs without prior redaction. This protocol does not invoke any guarded-mutating operator gate. All irreversible AI workload actions (model deployment, data scope expansion, content filter removal) require named human approval before a handoff package is submitted to an operator. Prompt content submitted as evidence must be minimally scoped to the governance question and stripped of sensitive internal context.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-ai-governance-security-architecture-protocol",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-ai-governance-security-architecture-protocol/references/official-sources.md

@@ -0,0 +1,99 @@
+# Official sources — SAP AI Governance / Security / Architecture Protocol
+
+Use this reference when grounding findings on SAP AI Core governance, Generative AI Hub configuration, Joule adoption, SAP HANA Cloud vector engine for RAG, AI security architecture, and applicable AI governance frameworks.
+
+**Evidence level**: documentation-based (SAP Help Portal, NIST, OWASP LLM Top 10, ISO/IEC 42001). No live-system evidence is collected by this protocol.
+
+## SAP AI Core — governance and security
+
+- What is SAP AI Core
+  https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/what-is-sap-ai-core
+  source_owner: SAP SE
+  topic_supported: SAP AI Core product overview, runtime architecture, inferencing endpoint lifecycle, resource group model, BTP integration
+  why_needed: Baseline taxonomy for classifying AI Core workload governance findings — required to distinguish resource group, model deployment, and inferencing endpoint risks
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Resource groups in SAP AI Core
+  https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/resource-groups
+  source_owner: SAP SE
+  topic_supported: AI Core resource group isolation model, tenant separation, resource group scoping for model deployments and scenarios
+  why_needed: Primary reference for assessing isolation posture between AI workloads — required when evaluating whether resource group design provides adequate tenant and data separation
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Security in SAP AI Core
+  https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/security
+  source_owner: SAP SE
+  topic_supported: AI Core authentication (OAuth 2.0 client credentials), authorization model, secure credential handling, network security, data encryption at rest and in transit
+  why_needed: Primary security reference for AI Core — defines the authentication and authorization model used to assess model-access control gaps and missing security controls
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Generative AI Hub
+
+- Generative AI Hub in SAP AI Launchpad
+  https://help.sap.com/docs/sap-ai-launchpad/sap-ai-launchpad/generative-ai-hub-in-sap-ai-launchpad
+  source_owner: SAP SE
+  topic_supported: Generative AI Hub overview, foundation model catalog, prompt editor, model proxy API, token consumption, chat and completion endpoints
+  why_needed: Primary reference for Generative AI Hub governance — defines the model access model, proxy API scope, and token consumption mechanics used to assess cost attribution and access control findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Consume foundation models via SAP AI Core
+  https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/consume-foundation-models
+  source_owner: SAP SE
+  topic_supported: Foundation model deployment via SAP AI Core, model configuration parameters, content filtering options, inference API integration patterns
+  why_needed: Defines how foundation models are accessed and configured — required to assess content filtering gaps, model version governance, and inference API authentication posture
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Joule
+
+- About Joule
+  https://help.sap.com/docs/joule/joule/about-joule
+  source_owner: SAP SE
+  topic_supported: Joule product overview, Joule skill architecture, integration with SAP applications, natural language processing of SAP business data, user interaction model
+  why_needed: Primary reference for Joule governance findings — defines the scope of Joule's data access, skill activation model, and integration surface with SAP business applications
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP HANA Cloud vector engine — RAG grounding
+
+- SAP HANA Cloud vector engine
+  https://help.sap.com/docs/sap-hana-cloud/sap-hana-cloud-database/sap-hana-cloud-sap-hana-database-vector-engine
+  source_owner: SAP SE
+  topic_supported: HANA Cloud vector store capabilities, embedding storage, vector similarity search, access control for vector store data, integration with SAP AI Core for RAG
+  why_needed: Primary reference for RAG grounding architecture assessments when SAP HANA Cloud is used as the vector store — required to evaluate data access controls and retrieval authorization in RAG pipelines built on HANA Cloud
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## AI governance frameworks — secondary references
+
+- NIST AI Risk Management Framework (AI RMF 1.0)
+  https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf
+  source_owner: NIST (US National Institute of Standards and Technology)
+  topic_supported: AI risk identification, measurement, management, and governance across the AI lifecycle; four core functions: GOVERN, MAP, MEASURE, MANAGE
+  why_needed: Secondary governance framework reference — used to classify AI governance findings against an internationally recognized framework and to assess compliance gap severity for organizations that have adopted NIST AI RMF
+  evidence_level: secondary
+  last_verified: 2026-06-19
+
+- OWASP Top 10 for Large Language Model Applications
+  https://owasp.org/www-project-top-10-for-large-language-model-applications/
+  source_owner: OWASP Foundation
+  topic_supported: LLM01 prompt injection, LLM02 insecure output handling, LLM03 training data poisoning, LLM06 sensitive information disclosure, LLM08 excessive agency, LLM09 overreliance, and related LLM-specific risks
+  why_needed: Secondary security reference — provides classification taxonomy for prompt injection, data leakage, and model-access control findings in SAP AI workloads; maps findings to OWASP LLM Top 10 categories for security team communication
+  evidence_level: secondary
+  last_verified: 2026-06-19
+
+- ISO/IEC 42001:2023 — AI Management System
+  https://www.iso.org/standard/81230.html
+  source_owner: ISO (International Organization for Standardization)
+  topic_supported: AI management system requirements, AI policy, risk management integration, AI impact assessment, auditability and traceability of AI systems
+  why_needed: Secondary governance framework reference — used when organizations have declared ISO/IEC 42001 compliance as a requirement; maps auditability, impact assessment, and governance gap findings to ISO standard clauses
+  evidence_level: secondary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal documentation describes the designed capabilities, configuration options, and security architecture of SAP AI Core, Generative AI Hub, Joule, and SAP HANA Cloud. It does not prove the governance posture, access control configuration, or threat exposure of a specific AI workload deployment. Users must supply architecture descriptions, access control inventories, compliance scope declarations, and audit log configurations for concrete advisory output. NIST AI RMF, OWASP LLM Top 10, and ISO/IEC 42001 are secondary references that provide classification frameworks; they do not supersede SAP product documentation for SAP-specific configuration guidance.

package/skills/sap/sap-ai-governance-security-architecture-protocol/references/safety-checklist.md

@@ -0,0 +1,38 @@
+# Safety checklist — SAP AI Governance / Security / Architecture Protocol
+
+Use before finalizing any finding, handoff package, or escalation trigger. This checklist is mandatory for all advisory sessions involving AI workload deployments, data scope changes, content filter modifications, or regulatory compliance assessments.
+
+## Non-negotiables
+
+- Do not accept or process OAuth tokens, API keys, AI Core service keys, resource group credentials, or certificate private keys. Refuse immediately and request redaction before proceeding.
+- Do not accept system prompt content containing proprietary business logic, internal instructions, or trade-secret content beyond the structural minimum needed to assess a specific governance risk (e.g., whether user input is interpolated into a system prompt without sanitization).
+- Do not accept PII — customer names, personal identification numbers, health data, payment card data — in example prompts, RAG grounding document samples, or model output excerpts. Request redaction before processing.
+- Do not invoke or recommend invoking any guarded-mutating operator gate from within this protocol. All operator gates are human-mediated only. This protocol produces the package; a human submits it.
+- Do not recommend removing content filtering from an inferencing endpoint without first identifying the compensating control that will replace it. Content filter removal without a compensating control immediately exposes all consumers of that endpoint.
+- Do not classify a finding as `critical` without tracing the specific threat to user-provided evidence or official SAP/OWASP/NIST documentation. Severity inflation without evidence is not permitted.
+- Do not produce regulatory compliance determinations (EU AI Act high-risk classification, GDPR lawful basis assessment, SOX materiality judgment) as authoritative legal advice. Label such assessments as `inference` and recommend engagement with legal counsel or a qualified compliance officer.
+- Do not evaluate the content safety of specific AI-generated outputs (e.g., whether a particular model response is harmful or biased). This protocol assesses governance posture, access controls, and auditability; content safety evaluation of individual outputs is out of scope.
+
+## What people get wrong
+
+- **Conflating resource group isolation with data isolation**: SAP AI Core resource groups provide workload separation within a tenant, but they do not automatically enforce data-level access controls for grounding data in vector stores or object storage. A RAG pipeline that stores all customer data in a single HANA Cloud vector store without row-level or schema-level access controls is not data-isolated, even if the AI Core resource group is scoped correctly.
+- **Treating the Generative AI Hub as a safe transmission channel for all SAP data**: The Generative AI Hub routes inference requests to foundation models, which may be hosted by third-party providers (OpenAI, Anthropic, Google, etc.) under SAP data processing agreements. The specific data processing agreement terms, data residency, and model training opt-out status must be confirmed for each foundation model before transmitting regulated or sensitive data. Do not assume all Generative AI Hub models are covered by the same data governance terms.
+- **Underestimating indirect prompt injection in RAG pipelines**: Prompt injection via user input (direct injection) is well-understood. Indirect prompt injection — where malicious instructions are embedded in a document that is retrieved as grounding context — is less commonly assessed but equally dangerous in RAG architectures. Any SAP scenario that ingests externally sourced documents (supplier invoices, customer emails, third-party reports) into a RAG grounding store is potentially exposed to indirect injection.
+- **Assuming Joule is read-only**: Joule can execute actions in SAP applications depending on the skills and permissions configured. A Joule skill that is granted write access to SAP business data (creating purchase orders, approving workflows, modifying master data) has execution scope, not just retrieval scope. The governance review must assess the action scope of each Joule skill, not just its data access scope.
+- **Missing the SoD risk in AI admin role assignments**: AI platform administrator roles (AI Core admin, Generative AI Hub admin) are often granted to a small group of platform engineers. If the same individuals can both deploy models and approve model governance decisions, this is a SoD violation in the AI governance process. Separate the model deployment operator role from the model governance approval role.
+- **Conflating model version control with model governance**: Capturing the model version in deployment metadata is necessary but not sufficient for auditability. Full auditability of AI-generated outputs in regulated processes requires capturing the model version, the input (prompt + grounding context), and the output at the time of generation — not just the deployed model version.
+
+## When to push back
+
+- Push back when the user submits a complete system prompt without redaction of proprietary business logic or internal instructions. Request the minimum structural excerpt needed to assess the specific governance risk.
+- Push back when the user asks for a legal determination on EU AI Act risk category, GDPR lawful basis, or SOX materiality. Provide a governance framework assessment; recommend legal counsel for authoritative determination.
+- Push back when the user asks to directly execute an AI Core model deployment, Joule skill reconfiguration, or content filter change from within this protocol. This protocol is advisory only; redirect to the operator gate with the completed handoff package.
+- Push back when no architecture description or access control inventory has been provided. AI governance findings without evidence of the workload topology are unreliable; request the minimum topology description before proceeding.
+- Push back when the user asks to assess content safety of a specific AI-generated output (e.g., "is this response harmful?"). This is out of scope; refer to SAP's responsible AI policies and appropriate content safety tooling.
+- Push back when a request requires live access to SAP AI Launchpad, AI Core APIs, or Joule administration interfaces. This protocol accepts only user-provided artifacts; live system access is out of scope.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP AI Core documentation, SAP Generative AI Hub documentation, SAP Joule documentation, SAP HANA Cloud vector engine documentation, NIST AI RMF, OWASP LLM Top 10, or ISO/IEC 42001
+- `user-provided evidence` — architecture descriptions, access control inventories, compliance scope declarations, audit log configurations, or workload descriptions supplied by the user
+- `inference` — derived reasoning not directly confirmed by official documentation or user evidence; always label explicitly, note the assumption, and recommend validation before acting on the finding

package/skills/sap/sap-ai-governance-security-architecture-protocol/references/workflow-and-output.md

@@ -0,0 +1,89 @@
+# Workflow and output contract — SAP AI Governance / Security / Architecture Protocol
+
+Use this reference for trigger classification, role activation logic, threat model structure, finding severity, governance domain taxonomy, handoff sequencing, and output format.
+
+## Trigger classification taxonomy
+
+| Trigger class | Description | Primary role activated |
+|---------------|-------------|----------------------|
+| `ai-core-workload` | AI Core model deployment, resource group design, or inferencing endpoint governance | sap-ai-core-genai-hub-governance-reviewer-agent |
+| `genai-hub` | Generative AI Hub proxy configuration, foundation model selection, token budget, cost attribution | sap-ai-core-genai-hub-governance-reviewer-agent |
+| `joule-governance` | Joule skill scope, data access permissions, adoption change management | sap-joule-governance-adoption-agent |
+| `rag-design` | RAG architecture review: grounding data pipeline, vector store, embedding governance, retrieval access control | sap-ai-core-genai-hub-governance-reviewer-agent + sap-cap-architecture-reviewer-agent |
+| `prompt-injection` | User-controlled or external text influencing system prompt, tool calls, or agent reasoning | sap-security-iam-grc-sod-reviewer-agent + sap-ai-core-genai-hub-governance-reviewer-agent |
+| `data-leakage` | SAP business data transmitted to foundation model, embedded without access controls, or exposed in AI output | sap-security-iam-grc-sod-reviewer-agent + sap-ai-core-genai-hub-governance-reviewer-agent |
+| `model-access-control` | Missing authentication on inferencing endpoints, overly broad role assignments, absent content filtering | sap-security-iam-grc-sod-reviewer-agent |
+| `output-auditability` | Regulatory or audit requirement for AI-generated output traceability | All four roles activated; sap-security-iam-grc-sod-reviewer-agent leads compliance mapping |
+
+## Governance domain taxonomy
+
+| Domain | Scope | Typical findings |
+|--------|-------|-----------------|
+| `ai-workload-governance` | AI Core resource groups, model lifecycle, deployment controls, token budgets | Missing lifecycle gate for model promotion, unscoped resource group access, absent token budget enforcement |
+| `data-governance` | Grounding data classification, PII in vector stores, cross-border AI inference, data retention for AI inputs/outputs | PII in RAG grounding data without access controls, unclassified data ingested into vector store |
+| `access-control` | Authentication on inferencing endpoints, authorization for Generative AI Hub consumers, Joule skill scope, SoD in AI role assignments | Missing OAuth on AI Core endpoint, overly broad Generative AI Hub scope, SoD conflict in AI admin role |
+| `threat-posture` | Prompt injection paths, insecure output handling, model supply chain risk, excessive agency in AI agents | Direct prompt injection via user input, indirect injection via grounding documents, LLM08 excessive agency in Joule |
+| `auditability` | AI-generated output traceability, model version logging, input/output audit trail, human-in-the-loop controls | No audit log for AI-generated financial outputs, model version not captured in output metadata |
+| `compliance` | EU AI Act risk category, GDPR AI processing obligations, SOX impact of AI outputs, ISO/IEC 42001 gap | High-risk AI system not assessed under EU AI Act, GDPR lawful basis not established for AI processing of personal data |
+
+## Threat model structure
+
+For each session, produce a threat model summary covering:
+
+1. **Prompt injection** (OWASP LLM01) — assess whether user-controlled or externally sourced content can influence the system prompt, tool selection, or agent reasoning path. Confidence: confirmed / probable / possible / not applicable.
+2. **Data leakage** (OWASP LLM06) — assess whether sensitive SAP business data (PII, financial, HR) is transmitted to a foundation model without adequate controls. Confidence as above.
+3. **Insecure output handling** (OWASP LLM02) — assess whether AI-generated outputs are validated and sanitized before being consumed by downstream systems or presented to users. Confidence as above.
+4. **Excessive agency** (OWASP LLM08) — assess whether the AI system (Joule, AI agent, CAP-orchestrated flow) can execute actions beyond what the business use case requires, or without adequate human-in-the-loop controls. Confidence as above.
+5. **Model-access control gap** — assess whether inferencing endpoints, Generative AI Hub scopes, or Joule skill permissions are properly authenticated and least-privilege scoped. Confidence as above.
+6. **Auditability gap** — assess whether AI-generated outputs that affect business decisions, financial records, or regulated processes are traceable to model version, input, and output artifacts. Confidence as above.
+
+## Finding severity classification
+
+| Severity | Criteria |
+|----------|---------|
+| `critical` | Active data leakage of PII or regulated data to an unapproved model; unauthenticated inferencing endpoint exposed to untrusted callers; confirmed prompt injection with demonstrated impact; regulatory breach (GDPR Article 83 exposure, SOX material impact from AI-generated financial output) |
+| `high` | Prompt injection vector identified but not yet confirmed exploited; Joule skill scope exceeding business process requirements with no compensating control; RAG grounding data containing unclassified sensitive data; missing content filtering on a customer-facing AI endpoint |
+| `medium` | Missing audit log for AI-generated outputs in a compliance-relevant process; SoD conflict in AI role assignment without mitigating control; overly broad Generative AI Hub consumer scope without usage monitoring; EU AI Act risk classification not performed for a deployed AI system |
+| `low` | Missing token budget enforcement with no current cost overrun; model version not captured in output metadata but no compliance requirement mandating it; Joule adoption change management plan not documented |
+
+## Workflow
+
+1. **Classify trigger** — identify which trigger class(es) apply from the workload description and evidence.
+2. **Activate relevant roles** — determine which of the four participating agent roles are relevant.
+3. **Inventory evidence** — list all artifacts provided; confirm redaction compliance; request missing mandatory items.
+4. **Produce threat model summary** — assess all six threat dimensions with confidence levels.
+5. **Classify governance domain** — map each finding to the governance domain taxonomy.
+6. **Produce per-role findings** — severity, evidence label, and recommended advisory action for each finding.
+7. **Map compliance gaps** — assess findings against declared regulatory frameworks.
+8. **Map decision rights** — for each recommended action, identify the named human approver.
+9. **Gate irreversible actions** — for any finding involving a listed irreversible action, confirm human approval is required; do not pre-approve.
+10. **Produce audit package** — assemble the audit package as defined in SKILL.md.
+
+## Output contract
+
+Return:
+
+1. **Trigger classification** — which trigger class(es) activated, with evidence label.
+2. **Roles activated** — which participating agent domains are in scope.
+3. **Evidence inventory** — types of artifacts received; redaction confirmation; missing mandatory evidence.
+4. **Threat model summary** — all six threat dimensions with confidence levels.
+5. **Per-domain findings** — governance domain, severity, evidence label, and recommended advisory action for each finding.
+6. **Compliance gap summary** — gaps against declared regulatory frameworks with applicable standard clauses.
+7. **Decision rights table** — pending decisions mapped to named approver roles.
+8. **Irreversible-action gate status** — list of any irreversible actions in scope; human approval status (confirmed / not yet / not applicable).
+9. **Escalation log** — escalation owners to notify and the action requested from each.
+10. **Audit package readiness** — complete / incomplete (with blocking items).
+11. **Next human step** — specific action required to proceed.
+
+## Handoff to guarded-mutating operator gate
+
+This protocol does not invoke any guarded-mutating operator gate directly. When the audit package is complete and human approval has been confirmed for all irreversible actions, the protocol produces a handoff summary containing:
+
+- Approved action type and scope (model deployment, Joule skill activation, content filter configuration, credential rotation).
+- AI workload identifier (AI Core scenario ID, Generative AI Hub deployment name, Joule skill name).
+- Governance domain and threat model basis for the action.
+- Named approvers who confirmed the action.
+- Timestamp of approval confirmation.
+- Reference to the change record where approval is documented.
+
+A human presents this handoff summary to the appropriate operator gate. The operator gate independently verifies approval before executing any mutation.