Two tracks: infrastructure diagrams for FoolproofDefault extraction and governance plumbing, and SAP-track companions that sit beside each public solution page.
Six diagrams from the Skynome reference architecture: FILE-first default, MDG DRF→CPI, Azure connector, GRS ingest, Meter, and trust boundaries.
FoolproofDefault Path B — governed extract to AL11, middleware pickup, zero Azure creds on S/4.
Open diagram →FoolproofDefault Path A — DRF outbound through Integration Suite; Azure auth stays in BTP.
Open diagram →Customer-subscription collector with Managed Identity — never authenticates to SAP.
Open diagram →Tenant-scoped telemetry → evidence store → explainable Pass/Fail/Unknown/N-A score.
Open diagram →Non-blocking local-first telemetry. Direct ABAP→Monitor is Phase 3.
Open diagram →Customer SAP · customer Azure · Skynome SaaS ownership and allowed protocols.
Open diagram →Architecture views for dual-crisis, extraction governance, RISE, private edition, landing zones, ILM, and FinOps — each linked to its solution page.
ECC 2027 and ODP Dec 2026 as one coordinated control plane.
Open diagram →ODP-free extract paths: FILE, DRF→CPI, optional Mode A — with GRS Domain 7 evidence.
Open diagram →Shared-responsibility gates: custom code, filesystem, network, agents, batch.
Open diagram →Path selection, cutover planes, and hyperscaler landing for PE landscapes.
Open diagram →SAP-aware LZ topology with policy, private endpoints, and Protected B residency.
Open diagram →Archive before size — ILM, retention, and analytics landing without ODP.
Open diagram →SAPS-aligned sizing, HA overhead, storage tiers, and attributed spend into GRS D2.
Open diagram →| Shorthand | Decision |
|---|---|
| FILE / AL11 | AL11 displays directories; it is not a transfer service. Use approved logical paths, ABAP authorization, a supported transfer route, and manifest validation. |
| ODP compliant | Say “no ODP RFC replication API use in this design.” Absence of RODPS_REPL alone does not prove licensing compliance. |
| DRF to lake | There is no native DRF→ADLS sink. DRF outbound → BTP/CPI mapping → Azure landing bridge. |
| Azure Connector | Customer-owned Functions Premium (or VM) worker. Never authenticates to SAP. Outbound evidence only. |
| Live evidence | Polling and upstream latency govern freshness. Show observed/received time, expiry, and coverage — do not promise real-time. |
| Seven domains | Only D1, D2, D4–D5, and D7 are labelled in current GRS. Do not invent D3/D6 meanings. |
Documented
Vendor documents the underlying feature. Does not certify the full Skynome solution.
Conditional
Feasible only after release, contract, identity, network, and testing gates are met.
Excluded
Skynome intentionally disallows it in this baseline.
NotSupported
The stated technology or deployment model does not provide the depicted capability.
Unverified
No code, tenant, contract, or test evidence supplied. Release gate remains open.
Start with a Governance Readiness Score, then use these diagrams as the shared language with architecture and security stakeholders.
Get your score