SyntaAI Documentation

Overview

SyntaAI builds AI agents for SAP, starting with the on-premise ECC and S/4HANA systems that most companies will run for years to come. Everything follows one rule: AI proposes, a person approves. Agents find, classify and propose. No agent remediates or executes a change in SAP on its own.

Syntaai Labs

Labs is a tool, like an IDE for SAP agents. You decide what the agent checks; Labs makes sure it only reads. An agent is a private service with a fixed set of tools chosen from the library, plus any custom reports and skills you add.

Getting started

1. Sign up at labs.syntaai.com with your e-mail or Google account. Open sign-up: every new account starts on the Free plan.
2. Choose your role: Security or GRC, Basis, FI, MM, SD, ABAP. Labs builds a first agent from a role template so you have something to ask within a minute.
3. Plan: in the Studio, describe what you want checked in a sentence. Syntaai Agent proposes the smallest set of tools that does the job and shows the SAP transactions each tool covers.
4. Build: confirm, and the build runs with visible steps: plan checked, safety checked, saved as a version, set as your agent, server online, ready to connect.
5. Ask: switch the chat to Chat mode and ask your agent directly, or add its address to your AI chat app as a connector.

The Studio

The Studio is a full-page chat with a sidebar (your agents, your templates, role templates) and an agent panel with tabs:

Tool library

Tools are grouped by role. Security: privileged users, inactive users, standard users, password policy and security parameters, a segregation-of-duties check against a ruleset of transaction-pair conflicts, role details and comparisons, and a compliance report mapped to SOX, ISO 27001, NIST and GDPR controls. Basis: a health summary, short dumps, update errors, client settings, SNC, parameter baseline, tRFC and qRFC queues, task lists. Business: purchase-to-pay, order-to-cash, record-to-report and EWM warehouse tools. Each tool shows the SAP transactions it corresponds to.

Labs plans and limits

Current prices are on labs.syntaai.com. Daily limits reset at midnight UTC.

Builder credits (messages to Syntaai Agent that plan and build) and the daily number of questions you can ask your agent in the Studio also depend on the plan. Using the agent in your AI chat app costs no builder credits. Your own server and a pipeline template are shown as coming soon.

Deploy to your SAP BTP

On Pro and Business, the same agent you built on practice data deploys in one click into your company's SAP BTP subaccount (Cloud Foundry) and reads your own ECC or S/4HANA through your SAP Cloud Connector. Nothing is installed in the SAP system. This path has been proven end to end against both an S/4HANA and an ECC system.

Prerequisites

• A BTP subaccount with Cloud Foundry enabled. A free trial subaccount works for a first run; Labs includes a five-step guide.
• Entitlements: XSUAA (application), Destination (lite), Connectivity (lite), and memory for two small apps. The subaccount check lists anything missing with the cockpit path.
• SAP Cloud Connector connected to the subaccount, with the SAP system mapped to a virtual host.
• A read-only RFC user in SAP with the PFCG role Labs generates.

Steps

1. Region. Pick the region of your subaccount, named as in the cockpit and grouped by provider. The one-time code used next is region-bound.
2. Check my subaccount. Paste a one-time code from the cockpit into the panel. It is used inside one request and never stored. Labs reads your orgs and spaces, quota, memory, service plans and existing apps.
3. SAP connection. Host, instance, client and RFC user name; no password. Labs produces the sheet for your Basis team: Cloud Connector mapping, the destination S4H_RFC, and the PFCG role (S_RFC for the read function, S_TABU_NAM for exactly the agent's tables).
4. Data. Deploy with demo data first if SAP is not connected yet: fictional rows generated for the agent's tables, or built from CSV exports you upload. Switch to the live system later; the address does not change.
5. Deploy. A new one-time code; Labs pushes the apps and streams the log. Redeploy reuses the same connector address.
6. Connect. Add the agent's address to your AI chat app and sign in through your subaccount's XSUAA role collection.

Business accounts can download the deploy package (runtime, bridge, deploy scripts, README, PFCG role text) to run the same deployment themselves. Trial subaccounts stop their apps overnight; "start my apps" in the chat restarts them.

Syntasec agents

Syntasec's agents each take one job your SAP security team does by hand. Every agent reads SAP, works out what to do, and proposes. A person approves and executes any change.

Audit Agent

Every audit cycle, the auditor asks for the same 20 to 25 ITGC controls, each with several evidence items: a screenshot of the selection screen, screenshots of the results, and the underlying data as a download. The Audit Agent produces exactly those artefacts.

How it runs

1. Run. Launch from the desktop app or schedule it. The agent attaches to your own SAP GUI session, so it inherits your authorizations. No service account, no stored SAP password.
2. Capture. Transaction by transaction: enter the selection criteria, screenshot it, execute, screenshot every page of results, export the data as a real .xlsx. Read and display only.
3. Package. A folder per control, a Word document with every screenshot inline, a combined workbook, and a SHA-256 hash recorded at capture time. It lands in your SharePoint.

More: Audit Agent.

User Admin Agent

Unlocks, password resets, role requests, new joiners, and "why can't I run this transaction?" tickets, read from ServiceNow, Microsoft Teams or a pasted message, and resolved in one conversation.

The resolve loop

ticket → find the user across every connected system → propose the fix → admin confirms → execute → ticket closed with a work note.

Supported operations

• Unlock, password reset, role assignment, new user setup
• Access errors: reads an authorization trace (SU53 / STAUTHTRACE) to find the exact role behind the failure, then proposes it

Runs where your admins already work: SAP ECC and S/4HANA, Microsoft Teams (Copilot Studio), your AI chat app, or the web console. More: User Admin Agent.

Agent Lens

Agent Lens inventories every system (B), communication (C) and service (S) user of an SAP system, plus the RPA bots, AI users and integration users you register, and works out what each one is from how it is actually used.

Evidence sources (read-only)

Classification

Background-job, workflow, ALE/IDoc, RFC integration, system service, monitoring or API-client user, or unclassified when the evidence is not there. Each classification carries its confidence (hard, medium, rule-based, or set by a person) and the evidence rows behind it. Agent Lens never calls an identity an AI agent on its own: "Confirm as AI agent" and "Not an agent" are a person's decisions, recorded with a reason.

Access resolution

Valid roles with composite roles expanded, profiles such as SAP_ALL and SAP_NEW, sensitive transactions, any-transaction access, debug and replace, RFC, table and user-administration capabilities, and org levels as written in the role. Anything that could not be read is shown as "not read".

Registered agents

Declare each RPA bot, AI user or integration user with an owner, a purpose, what it is expected to run and where from. Agent Lens baselines it and opens a finding on drift: unexpected host, unusual hours, a spike in activity, dialog logons by a machine user, new critical access. Findings go to e-mail, Microsoft Teams or your SIEM. Each registered agent is recertified on a cycle you set (180 days by default).

Agent Lens is part of Syntasec on SAP BTP: it runs in your own subaccount, reads SAP through your Cloud Connector, and signs your team in through XSUAA role collections. More: Agent Lens.

Syntasec platform

Under the agents sits a security engine that continuously reads your SAP landscape. The agents use it for grounding; your team can use it directly.

Threat severity levels

Full capability reference: Syntasec platform.

Safety model

• Read-only by design. Labs agents can only read. Syntasec agents read, and propose changes that a person executes. No agent creates, changes or deletes anything in SAP on its own.
• AI proposes, humans approve. Every change in Syntasec waits for a person. In the User Admin Agent that is a one-time confirmation code; in Agent Lens every decision carries a mandatory reason.
• Least access. In Labs the runtime refuses tables outside the agent's allowed list and blocks password and hash fields; the generated PFCG role covers only the read function and the agent's tables. The Audit Agent inherits your own authorizations and holds no credential.
• Everything logged. Every tool call, with who asked, what ran, when and on which system. Syntasec decisions land in an append-only log.
• Data stays yours. Syntasec runs on your infrastructure or in your SAP BTP subaccount; evidence lands in your SharePoint. A Labs agent deployed to your BTP never sends your SAP data through the Labs cloud.
• Honest about what it saw. A source that was not read or a day without data is named in the result, never shown as "nothing found".

AI engine options

Syntasec is AI-agnostic. The reasoning layer runs on the engine your policies allow:

Syntaai Labs builds agents with Claude models; which model depends on the plan and is named on the Labs pricing page.

Deployment options

Typical time to a live Syntasec pilot is two to four weeks. More: Syntasec on SAP BTP.

Support

• Labs questions and access: contact@syntaai.com, or the Contact page on labs.syntaai.com.
• Syntasec walkthroughs and pilots: book a 20-minute walkthrough.
• Guides: Build your first SAP agent in Labs, Deploying a Labs agent to SAP BTP, Agent Lens explained, and the free Prompt Library.