Joule Agents: Operational Governance for the Autonomous Enterprise
SAP's "Autonomous Enterprise" framing arrived at Sapphire 2026 with real numbers behind it — more than 50 domain-specific Joule Assistants orchestrating over 200 specialized agents — and since October 2026 SAP has been rolling out general availability of those assistants and agents, Joule Work, and Joule Studio in phases. That changes the hard question. For two years the question was "can we build an agent?" Now that agents are abundant and can act on enterprise systems, the question is "can we govern a fleet of them?" That is where autonomous-enterprise ambitions are most likely to stall: not on capability, but on the operating discipline to let dozens of agents act without losing track of what they can touch, what they did, and who approved it. This guide lays out the operational governance an agent estate actually needs — the two control layers SAP is rolling out, the registry that keeps an inventory, how agent-to-agent and tool protocols stay governed, and the lifecycle and audit habits that keep autonomy accountable.
Two control layers, and why you need both
The most useful thing SAP got right in the 2026 agent architecture is the separation of two distinct control questions. One is a business question — should this action happen, given policy? The other is an infrastructure question — can this action happen, technically, and within what boundary? SAP answers them in two different layers, and the reason both are necessary is simple: an application-level policy cannot, on its own, contain an agent that has access to shells, files, networks, and APIs. You need a runtime that technically constrains what the agent can reach, not just a policy that says what it ought to do.
The upper layer is the Joule Studio runtime, where agents built in Joule Studio run. It applies business authorization, role-based policy, and process context before a request reaches execution, and in SAP's reference architecture it also gates production: an agent needs governance approval in the deployment pipeline before it reaches users. The lower layer is NVIDIA OpenShell, NVIDIA's open-source secure runtime for autonomous agents, which SAP engineers are co-developing and embedding in the SAP Business AI Platform. Each agent runs in an isolated environment, its file-system and network access is policy-controlled, and runtime-level containment limits the damage if the agent's logic fails. In SAP's framing, OpenShell answers whether an action can safely execute, and the Joule Studio runtime answers whether it should happen at all. SAP's TechEd 2026 guide lists runtime-level isolation with configurable policies and guardrails, delivered through the Joule Studio runtime and the NVIDIA Open Agent Safety Platform, with general availability rolling out in phases. Treat the two layers as one control and you will eventually find an agent doing something policy forbade but the runtime allowed, or blocked from something it was authorized to do.
The registry: you cannot govern what you cannot see
The first failure of a growing agent estate is not a rogue agent — it is losing the list. When agents are created across teams, built in Joule Studio, shipped inside SAP solutions, and brought in from partners, the inventory fragments, and an un-inventoried agent is an ungoverned one. SAP AI Agent Hub is SAP's answer: a vendor-agnostic registry of AI agents, MCP servers, and large language models, built on SAP LeanIX and generally available since Sapphire in May 2026. SAP says it discovers assets automatically from SAP, Microsoft, Google, AWS, Databricks, and ServiceNow, and agents deployed on the Joule Studio runtime become discoverable there. Each entry gets a fact sheet recording identity, ownership, technology, and governance status, and an agent that has not passed verification stays in a pending state. The point of a registry is not bureaucracy; it is that every other control — policy, audit, retirement, risk rating — depends on first having a complete, current list of what exists and what each agent can touch.
In practice the discipline is to make the registry the single source of truth and to refuse to run production agents that are not in it. That sounds strict, but it is the same lesson data products taught: the moment an asset has an owner and a visible record, accountability follows; the moment it does not, it quietly degrades. SAP's design supports the rule. In its reference architecture, registering an agent in the hub triggers creation of the agent's identity in SAP Cloud Identity Services, and SAP says production workflows can call only verified MCP servers, with access withdrawn if a server's verification status changes. Treat the Agent Hub the way you would treat a CMDB for agents — if it is not registered, it does not run.
Governing how agents talk: A2A and MCP
Agents become powerful — and risky — when they stop working alone. SAP's architecture leans on two open protocols here. Agent-to-Agent (A2A) lets Joule agents collaborate with other SAP and third-party agents inside standardized workflows; agents built in Joule Studio support it natively, and SAP planned general availability of Joule's bi-directional A2A capabilities for Q4 2026. Model Context Protocol (MCP) standardizes how an agent reaches tools and data sources. Together they push toward cross-agent, cross-vendor execution, where a workflow is no longer trapped inside one assistant or one vendor's ecosystem.
The governance implication is the one teams underestimate: every A2A hand-off and every MCP tool connection is a new trust boundary. When Agent A can invoke Agent B, and Agent B can reach a system through an MCP server, the effective reach of the chain is the union of what each link can do — and that is easy to lose track of. SAP's reference architecture routes these hops through its Agent Gateway, which applies authentication, principal propagation, and policy enforcement at every hop, so the identity behind a request travels with it. At TechEd 2026, SAP announced new gateway capabilities that let third-party agents invoke Joule Agents through a single governed entry point that enforces access control, with general availability rolling out in phases. It also announced the SAP Enterprise AI Gateway, built on SAP Integration Suite and planned for general availability in Q1 2027, to consolidate authentication, policy enforcement, routing, monitoring, usage tracking, and auditing for MCP, API, A2A, and LLM traffic. The rule I recommend is that interoperability does not relax the two-layer control: a third-party agent reached over A2A, or a tool reached over MCP, still passes through the business-policy and runtime gates, and still appears in the registry with its access scope recorded. Open protocols are a reason to tighten inventory and scoping, not to loosen them.
Lifecycle, audit, and the regulatory clock
Autonomy without an audit trail is not a strategy; it is a liability waiting for an incident. A governed agent should move through a deliberate lifecycle, and SAP AI Agent Hub now defines one in five stages: Define (goal, action space, and governance requirements), Verify (risk classification, identity and credentials, permission scoping, functional and resilience testing), Enforce (access policies, guardrails, consumption limits, and the ability to suspend or revoke), Monitor (telemetry in SAP Cloud ALM, plus periodic access reviews and risk-tier reassessment), and Optimize (improve the agent, or retire it with credentials revoked and audit records preserved). On the build side, SAP says new Joule Studio lifecycle features make production changes easier to track, approve, and reverse, giving compliance reviews and incident investigations a change history to work from. Whatever the tooling, record the risk rating, data-access scope, and approvals at each step, and log every consequential action so it can be reconstructed later.
The regulatory clock moved, but it did not stop. The EU's Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 27, 2026, postponed the AI Act's high-risk obligations to December 2, 2027, for stand-alone systems such as hiring or credit-scoring uses, and to August 2, 2028, for AI embedded in regulated products. Once those obligations apply, deployers of a high-risk system must assign human oversight to people with the competence and authority to exercise it, and keep the logs the system generates automatically, where under their control, for at least six months. Not every agent will be high-risk, but the practical effect is the same: "we have lots of agents" is not an acceptable answer to "show me your inventory, who oversees them, and what they did." SAP's AI Governance Assistant, planned for general availability in Q4 2026 inside SAP AI Agent Hub, is designed to propose EU AI Act risk classifications from your system documentation, as drafts for legal and compliance review. A registry with lifecycle stages and an audit log is precisely what turns that question from a panic into a report.
What to put in place before you scale
The sequence that works is unglamorous. Stand up the registry first and make it mandatory, so inventory never lags reality. Configure both control layers deliberately — business authorization, roles, and human-in-the-loop steps in Joule Studio, and the runtime policies and guardrails your agents execute under — and resist the temptation to grant broad access "to get moving," because the broad grant is the one nobody revisits. Record an owner, a risk rating, and a data-access scope for every agent, and wire logging in from the first deployment rather than after the first audit; Joule Studio's pre-deployment sandbox, where you can run test queries and inspect traces, is the place to catch surprises before production. Then let interoperability follow: turn on A2A and MCP connections only for chains whose combined reach you have actually mapped, and only to MCP servers you have verified. Start with a handful of well-governed agents and expand the pattern, exactly as you would with data products. As always, confirm current capabilities, availability, and compliance mappings against SAP's own documentation before committing a roadmap: as of November 2026, several pieces described here — the AI Governance Assistant, Joule's bi-directional A2A capabilities, and the SAP Enterprise AI Gateway — still carried planned general-availability dates.