ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsMaterial2 min readDisconfirmAI Editorial

SAP Compliance Advisor Proposes Layered Agent Governance Framework at ASUG Tech Connect: Each Agent Requires a Deployment Manifest, System Card, and Continuous Monitoring

SAP cybersecurity and compliance advisor Srinivas Nandiwada presented a layered agent governance methodology at the 2026 ASUG Tech Connect event. The core artifacts include an agent registry in LeanIX, deployment manifests requiring re-approval for scope changes, system cards defining risk exposure surfaces, and a continuous monitoring framework post-launch. He argued that security and governance are enablers rather than blockers, and recommended prioritizing the highest-risk agents for initial framework validation.

2026-11-06 01:33 GMT+8

As enterprises move AI agents from experimental phases into production workflows, governance often becomes the weakest link. At the 2026 ASUG Tech Connect event, SAP cybersecurity and compliance advisor Srinivas Nandiwada presented a layered agent governance framework during a panel discussion, attempting to answer a practical question: after an agent goes live, who is responsible for managing it, how should it be managed, and what exactly needs to be managed.

Nandiwada’s approach breaks governance down into several layers, each with an escalation path to the next, aligned with current regulations such as the EU AI Act. The specific artifacts he outlined include: maintaining an active agent registry in LeanIX; requiring a deployment manifest for each agent, where any change to the agent's scope must undergo re-approval; completing a system card for every agent that defines all its risk exposure areas and operational boundaries; establishing a monitoring framework for each agent after it goes live; and retaining audit logs of all agent behaviors.

A guiding principle runs through this framework: security and governance are not obstacles, but enablers. Nandiwada specifically advised starting by validating the highest-risk agents within the framework, rather than beginning with the safest tasks. He also proposed a guideline consistent with the EU AI Act but potentially controversial: fully autonomous agents should only be used for low-risk, bounded tasks and never for decisions affecting people.

Sign in / Sign up
ReadingResearchRadarInvestment framework

The article also recorded the real-world status of attendees' organizations. Nandiwada noted that currently, only a minority of organizations possess post-launch monitoring capabilities for agents. One customer suggested using LeanIX to begin cataloging agents, including those you may not currently have control over in your area of the business. Another customer expressed confusion about how to secure internal support for safe governance when not subject to the EU AI Act. During the discussion, it was suggested that security cases could be built around other emerging regulations or current liability exposures from potentially affected parties.

The boundaries of this framework are also worth noting. It stems from statements made by a single compliance advisor at SAP during one customer event, and the article itself provides no evidence that this framework has been independently validated for effectiveness. Nandiwada’s methodological value lies in translating abstract governance principles into an actionable list of artifacts, but whether enterprises can truly implement it depends on their own data foundations, process maturity, and personnel skills—as the article repeatedly emphasizes, customers must own their own strategy and data.

Sources

  • diginomica.comdiginomica↗
Continue researching →