Your CFO wants SAP AI results next quarter – here’s where to start

The challenge

Last month, I sat down with a CIO for a manufacturing company in Johannesburg. He stopped me mid-sentence: “Please don’t say ‘AI transformation’, I’ve heard it forty times this quarter. Just tell me one thing I can actually implement before my board meeting in six weeks.”

He’s not alone. Every SAP leader I talk to says the same thing: “I know AI is supposed to transform my operations. But where do I actually start, and how do I show value before I’m asked to justify the investment?”

Their CFO wants measurable ROI. Their team is drowning in overnight backlogs of blocked purchase orders, customs declarations stuck in queues, and vendor inquiries piling up across time zones. They don’t need a strategy deck. They need one use case they can implement in weeks and present at their next board meeting.

That’s exactly what this series delivers…

Each use case includes the business context, measurable value, architecture, and implementation steps. No theory, just working patterns you can adapt to your SAP environment on AWS.

Pick the use case closest to your pain point, share it with your team, and tell us what you’d build first.

What this series covers

Over the coming posts, we walk you through seven use cases where Agentic AI agents execute SAP workflows autonomously. Each post covers two use cases, beginning with the business context and value, then detailing the technical implementation.

Here is the series structure:

●  This post (Blog 1): Series introduction, the shared architecture, and our first use case, automating trade declarations with SAP Global Trade Services

●  Blog 2: Real-time supplier delivery monitoring and supply chain disruption analysis

●   Blog 3: GRC user authorization automation and SAP configuration research

●   Blog 4: Vendor payment inquiry resolution and demand forecasting with foundation models

Each post follows the same format: business context, value delivered, architecture overview, and implementation walkthrough.

Current state of SAP workflow execution

SAP processes in most organizations today operate within these constraints:

●  Time-zone dependency: Purchase orders require human reviewers, and approvals queue when reviewers are offline.

●  Data consistency challenges: Vendor master data entered manually across regions accumulates inconsistencies over time.

●  Scale limitations on repetitive tasks: Manual invoice matching at high volume increases error rates proportionally.

●  Delayed exception handling: Failed goods receipts or blocked transactions remain unaddressed until the next staffed window.

●  Batch-driven decision cycles: Overnight batch jobs mean operational decisions rely on data that is hours old.

These constraints are inherent to architectures that require human presence at each processing step. With Agentic AI, you can adopt a different execution model, one that reasons over live SAP data instead of following predefined rules.

How Agentic AI operates

Rule-based automation executes predefined logic: if condition X is met, perform action Y. This execution model is effective for predictable, structured scenarios. For variable data formats or contextual decisions that fall outside a predefined rule set, a different approach is required.

With Agentic AI, you get autonomous reasoning built into your SAP workflows. An agent reads live data from SAP and determines what actions are required based on current context. It then executes those actions independently, without waiting for manual approval.

When the agent encounters a scenario outside its confidence threshold, it escalates to a human reviewer. The escalation includes full context: what data was analyzed and what action the agent recommends.

For example, an agent monitoring procurement identifies a blocked purchase order at 2am. It queries the vendor’s transaction history and validates the payment block against vendor master data. Based on the results, it either resolves the block automatically or prepares a structured summary for human review.

Business value of Agentic AI for SAP

With Agentic AI agents across your SAP landscape, you get five measurable advantages:

●  Continuous execution: Your agents operate 24/7 across SAP and AWS services, removing time-zone dependencies from process execution.

●  Unified data processing: Both structured data (SAP tables, ERP records) and unstructured data (emails, PDFs, contracts) are handled within a single workflow.

●  Reduced manual intervention: Routine tasks that previously required human action execute automatically, reallocating team capacity to higher-complexity work.

●  Improved data quality: Continuous automated validation identifies and addresses errors at the point of entry, rather than during periodic reviews.

●  Real-time decision support: Actions are based on live data rather than batch-processed snapshots, supporting faster operational response.

Shared architecture

Every use case in this series follows a consistent architecture pattern. This shared foundation means each subsequent use case builds on components you already understand.

The architecture has four layers:

Ingestion layer:  Data enters the workflow from multiple sources depending on the use case – documents (PDFs, emails) stored in Amazon S3, events from SAP BTP, or direct user requests. Where document processing is required, structured field extraction is performed by Amazon Bedrock or Amazon Textract.

Orchestration layer: Agents run on Amazon Bedrock AgentCore Runtime, with model access via the Amazon Bedrock API. AgentCore Identity validates that users have access to the agents, with outbound authentication through an Identity Provider (IdP) such as Okta, Entra ID, or Ping. AWS Lambda handles orchestration logic, and a Knowledge Base (RAG) provides domain-specific reference data. AgentCore Observability monitors the entire agentic workflow.

Action layer: Agents connect to SAP S/4HANA through OData APIs for bidirectional data access – retrieving master data for validation and writing results back to SAP. Notifications are delivered via Amazon SNS with a context summary and confidence score. Human-in-the-loop reviewers receive the full context, risk assessment, and recommended action before approving changes to SAP.

Observability layer: AgentCore Observability monitors the entire agentic workflow. Activity is logged in Amazon CloudWatch, with logs and activity records stored in Amazon DynamoDB, and API-level activity tracked through AWS CloudTrail.

Security architecture

The architecture implements security controls at every layer:

●   Transport encryption: Agent-to-SAP communication uses HTTPS. Mutual TLS is enforced where SAP supports it.

●   Least-privilege access: Each agent operates under its own scoped AWS Identity and Access Management (IAM) role with permissions limited to its specific tools and actions. Elevated permissions are not passed between agents in multi-agent workflows.

●   Data encryption: Sensitive data (vendor payment details, user authorization records) is encrypted at rest using AWS KMS and in transit using TLS.

●   Human-in-the-loop controls: Actions that modify financial records, compliance-relevant data, or SAP master data require human confirmation before execution.

●   Audit trails: Agent actions in this workflow are recorded in CloudWatch and DynamoDB, supporting both operational monitoring and compliance reporting.

Amazon Bedrock does not use customer data to train or improve foundation models.

Use case 1: Automating trade declarations with SAP Global Trade Services

With the shared architecture established, this section demonstrates it in practice with the first use case.

Business context

Import declarations in SAP GTS require data from supplier documents (PDFs, emails, and Excel files) that arrive in inconsistent formats and at all hours. When a commodity code is missing or a field is ambiguous, the declaration cannot proceed. This results in:

●   Declaration failures in SAP GTS that trigger manual review cycles

●   Shipments held at customs while corrections are made

●    Cost accumulation for every hour a shipment remains in hold status

●    Processing delays when documents arrive outside staffed hours

The required data exists within the supplier documents. The technical challenge is extracting it, validating it against trade regulations and SAP master data. The agent then writes it into SAP GTS continuously and without manual effort.

Business value

With an Agentic AI agent for trade declarations, you gain value in four areas:

●  Processing speed: Declarations are processed the moment the supplier document arrives, regardless of time of day. Based on testing in a standard RISE with SAP environment, processing times dropped significantly. A document received at 2am can typically be processed significantly faster without requiring human intervention overnight.

●  Data accuracy: The agent validates extracted fields in this workflow against SAP master data and trade regulations. Only after validation does it write to SAP GTS, eliminating manual data-entry errors.

●  Compliance assurance: All agent actions within this workflow are logged with a full audit trail, so you can answer customs inquiries with a complete record: what data was used, where it came from, and who made the final decision.

●  Operational continuity: Trade compliance processing no longer depends on staff availability across time zones. The agent handles routine volume, and your team focuses on complex cases that require human judgment.

Architecture

The following diagram illustrates the end-to-end architecture for this use case. The customer’s AWS account contains the ingestion, orchestration, and observability components. The SAP AWS account contains SAP S/4HANA within a RISE with SAP VPC.

The architecture spans two AWS accounts:

Customer AWS account:

●  Ingestion (1–2): Documents enter Amazon S3, then Amazon Bedrock LLM extracts structured fields.

●  Orchestration (3–6): AgentCore runtime receives extracted data. AgentCore Identity (4a) validates access and authenticates outbound calls through the IDP (4b). AgentCore Observability (5) monitors the workflow. AWS Lambda (6) manages orchestration logic.

●  Knowledge and validation (7a–7b): Lambda branches to Amazon Bedrock Knowledge Bases (7a) for trade regulations and commodity codes, and to the SAP GTS OData API (7b) for master data validation.

●  Agent action (8): The AI Agent on AgentCore runtime calls the SAP GTS OData API to create or update trade declarations.

●  Human-in-the-loop (9–10): Amazon SNS sends notifications to the human reviewer when confidence is insufficient.

●  Observability (11): Amazon CloudWatch, Amazon DynamoDB, and AWS CloudTrail record actions, audit trails, and API activity.

SAP AWS account:

●   SAP S/4HANA receives OData API calls from both the Lambda validation step (7b) and the AI Agent action step (8). Both calls originate from within a private subnet inside the RISE with SAP VPC.

Technical implementation

The agent automates the full workflow from incoming supplier document to completed SAP GTS trade declaration:

Step 1: Document ingestion. Supplier documents (PDFs, emails, Excel files) are stored in Amazon S3 as they arrive. S3 serves as the entry point, providing durable storage accessible to downstream components.

Step 2: Field extraction. Amazon Bedrock processes the documents using a large language model. It extracts structured fields from unstructured content: commodity codes, quantities, shipment dates, and vendor information.

Step 3: Trade regulation validation. The agent queries Amazon Bedrock Knowledge Bases containing trade regulations and commodity code references. When a field is incomplete or ambiguous, the agent uses retrieval-augmented generation (RAG) to attempt resolution before escalating.

Step 4: SAP master data validation. The agent calls the SAP GTS OData API to confirm that vendor IDs, commodity codes, and other fields match existing records in SAP S/4HANA.

Step 5: Decision and execution.

·   When confidence is sufficient, the agent writes the declaration directly into SAP GTS via the OData API without human intervention.

·    If confidence falls below the threshold, the agent escalates to a human reviewer. It sends a notification through Amazon SNS with a context summary and confidence score.

Step 6: Logging and audit. Amazon CloudWatch records actions and latency metrics. Amazon DynamoDB stores an immutable audit trail per declaration, capturing decisions, tool calls, and validation results.

Key outcomes

This agent delivers three specific results:

●    Zero manual data entry for import declarations

●    24/7 processing across time zones with no overnight backlogs

●     Proactive exception handling before customs deadlines, with the agent escalating full context while there is still time for human action

What comes next

In the next post we plan to cover two use cases:

1.  Intelligent supply service monitor: An agent that validates supplier delivery schedules in real time, scores each delivery for SLA breach risk, and writes enriched intelligence back into SAP before issues reach the warehouse floor.

2.  Supply chain disruption analysis agent: An agent that correlates external signals (weather events, geopolitical shifts, logistics bottlenecks) with active purchase orders and supplier data in SAP to identify disruption risk before it impacts operations.

Get started and share your feedback

To explore Amazon Bedrock AgentCore and begin building agents for your SAP environment, visit the documentation: https://docs.aws.amazon.com/bedrock/latest/userguide/agentcore.html

For sample agent implementations, visit the GitHub repository: https://github.com/aws-samples/agentic-ai-for-sap

We plan to cover supply monitoring and disruption analysis in the next post. Tell us in the comments which SAP workflow pairing is most relevant to your environment:

●   GRC access automation + SAP configuration research: Automating user authorization requests with segregation of duties checks, and using natural language to navigate SPRO hierarchies and execute supported configuration changes.

●    Vendor payment inquiries + demand forecasting: Autonomous resolution of routine vendor payment questions, and advanced forecasting with Amazon Chronos that validates results against live SAP data.

We would love to hear which workflow matters most for your operations. You can reach our team directly through the “Contact us” link on this page.