Unverified50% confidenceDecision RuleExact time
The security review for an AI Agent connecting to an SAP system should follow a specific order of checks: the Agent service account identity and least-privilege SAP roles; a default read-only tool allowlist with write as the exception; network paths and separated DEV/PRD MCP endpoints; secret storage, token lifecycle and rotation owner; log/SIEM evidence with sample correlated events; a disable/rollback drill within 15 minutes; and a signed use case scope with explicit non-goals.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
VerifiedAI Agents should default to read-only mode, and high-risk actions such as write operations, delete operations, and network requests require explicit authorization.75% similarVerifiedAI Agent tool permissions are typically divided into mutually independent tiers such as read, search, internet access, edit/write, and command execution.72% similarVerifiedWhen using AI Agents, the principle of least privilege should be followed, avoiding granting sensitive permissions such as email, files, and servers from the outset, to guard against risks such as prompt injection attacks.71% similarUnverifiedA reliable AI Agent human approval mechanism must satisfy at least three key properties: reachability, low friction, and tamper-proof audit logs.71% similarUnverified涉及删除、覆盖、权限变更等敏感操作时，AI Agent 应先明确列出影响范围并等待用户显式确认后再执行71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008208API
curl https://kongchang.com/api/v1/knowledge/claims/1008208MCP
get_claim(id=1008208)