Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Governed SAP Data Extraction with zapliance

1. zapliance Solution Architecture

The zapliance operating model is built on a clear technical separation of two layers:

    1. Data extraction
    2. Data processing

Data extraction uses RFC to create copies of customer-approved SAP data, stored in a zapAnalytics project database. All subsequent processing performed by agents, including AI-supported analysis and result generation, operates exclusively on these data copies and does not interact with SAP production systems.

Key takeaway: RFC talks to SAP. Agents talk to the extracted dataset.


2. Role of SAP RFC

Remote Function Call (RFC) is a long-established SAP communication architecture and the standard mechanism used by zapAnalytics to communicate with SAP systems.

Within the zapliance architecture, RFC is used exclusively for deterministic extraction of customer-approved SAP data.

Every extraction is initiated by an authorized customer user, either manually or through a customer-configured schedule.

SAP Reference

SAP documents RFC-based extraction for SAP Signavio Process Intelligence, including RFC_READ_TABLE as well as controls for table selection, filtering, partitioning, scheduling, monitoring, and security.

The official SAP documentation can be found here: 


3. Separation Between Extraction and Processing

Layer 1: Data Extraction

During extraction:

    • zapAnalytics connects to SAP through RFC
    • Only standard RFC modules are used
    • Customer-approved SAP data is extracted
    • Copies of the extracted data are stored in the project database

The extraction process is deterministic and governed by predefined rules. Agents are not involved in deciding what data is extracted.

The customer defines:

    • Which SAP systems are accessed
    • Which data is extracted
    • Which SAP user is configured for the extraction
    • Which permissions are granted
    • When extraction is executed

 

Layer 2: Data Processing

After extraction has been completed:

    • Processing (performed by agents) operates on the data copies stored in the project database
    • RFC is no longer used, and an SAP connection is no longer required

Agents do not autonomously:

    • Establish SAP connections
    • Initiate data extractions
    • Execute additional RFC requests
    • Expand the approved extraction scope

Their processing work is limited to the data that has already been extracted through the approved extraction process (layer 1).


4. Governance and Control Principles 

1. No autonomous agent access to SAP

The extraction scope is defined by the customer, and every data extraction is initiated by the customer. Agents do not autonomously interact with SAP systems, perform self-initiated data extractions or expand the extraction scope.

Once extraction has been completed, agents work exclusively with copies of the extracted data stored in the project database.

2. Use of standard SAP technology

SAP connectivity uses RFC, a long-established SAP standard interface.

No proprietary or undocumented SAP access mechanisms are required.

3. Deterministic data extraction

The extraction process follows predefined rules.

The customer defines and controls:

    • Which data is extracted
    • When it is extracted
    • Which RFC user is used
    • Which RFC permissions are involved

4. Governance remains under customer control

The customer authorizes and controls:

    • The creation of the RFC user
    • The RFC permissions
    • The SAP connection
    • The data scope
    • The execution of each extraction


5. Wilma

zapAgent Wilma is the user-driven conversational AI member of your governance team.

Wilma operates as a chat agent within LibreChat and is part of the data processing layer (layer 2). She is not involved in data extraction and has no SAP connection.

Wilma works exclusively with copies of the extracted data already existing in the project database.


Summary

zapAnalytics uses standard SAP RFC connectivity for governed and deterministic data extraction. During subsequent processing, including AI-supported analysis, agents do not access SAP.

Instead, they operate exclusively within the processing layer and work on data copies stored in the project database.

This architectural separation ensures that processing and AI functionality remain isolated from SAP systems.