D1AI Sovereignty
57.1
Governance Readiness Score
SAP ECC 6.0 EhP7 · 800 users · Canada
Demo environment · Oct 23, 2026
FI actuals and Treasury still leave ECC through ODP-RFC on SAP’s temporary opt-out. That opt-out expires December 2026 (SAP Note 3731818). After that, these pipelines stop.
△ SAP Note 3255746
The June 2026 patches block unrestricted ODP-RFC calls. Laurentian’s FI actuals and Treasury pipelines are on the temporary opt-out, which expires December 2026 (SAP Note 3731818).
2022
SAP publishes Note 3255746. Third-party use of the ODP APIs is unsupported and intended for internal use only.
2 Feb 2024
Customers and third-party applications are no longer permitted to use ODP APIs to access SAP ABAP sources.
9 Jun 2026
Security patches block unrestricted calls from non-SAP applications that rely on the ODP-RFC interface.
Dec 2026
The temporary opt-out expires (SAP Note 3731818). No further opt-out after that. Laurentian’s FI actuals and Treasury pipelines are on that opt-out today.
Score = 6 / (8 × 4) × 100 = 18.8.
| # | Question | Answer | 0–4 |
|---|---|---|---|
| 7.1 | Have all ODP RFC-based extraction pipelines been migrated to compliant methods since the June 2026 enforcement? | Still on fallback mechanism — running on temporary fallback, no migration started | 1 |
| 7.2 | What percentage of data pipelines use SAP-approved extraction methods? | 25–50% | 1 |
| 7.3 | Has the migration from ODP-RFC been completed before the December 2026 fallback expiry? | No plan — no migration underway; will fail when fallback expires | 0 |
| 7.4 | Which SAP-approved extraction methods are in use? | Certified methods planned but not yet deployed | 1 |
| 7.5 | Can the organization demonstrate SAP Note 3255746 compliance in an audit? | No evidence — unable to demonstrate compliance | 0 |
| 7.6 | Is there policy enforcement preventing new pipelines from using banned ODP RFC methods? | Manual review — architecture review board checks new pipelines | 2 |
| 7.7 | Has SAP Note 3439624 self-assessment been run and its output documented? | Not run — Note 3439624 has not been executed in this SAP system | 0 |
| 7.8 | Has the June 2026 SAP security patch (Note 3255746 enforcement) been applied, or is the system still on the temporary fallback mechanism? | Patch not applied — system still pre-enforcement; fallback in use | 1 |
Question 7.7 is SAP Note 3439624, the self-assessment available since 13 April 2026. It identifies current ODP-RFC usage across systems.
| Pipeline | Mechanism | Exposure |
|---|---|---|
| FI actuals → Fabric | ADF SAP CDC | Temporary opt-out, expires December 2026 (Note 3731818) |
| Treasury → Synapse | Fivetran | Temporary opt-out, expires December 2026 (Note 3731818) |
| GL balances → ADLS | File drop | Design only · outside this block |
A policy design and an audit, not live enforcement. Automated enforcement is on the roadmap.
Score = 8 / (6 × 4) × 100 = 33.3.
| # | Question | Answer | 0–4 |
|---|---|---|---|
| 3.1 | Is there a policy enforcement layer that gates AI agent actions, especially SAP write-backs? | None — agents can write to SAP without a policy gate | 0 |
| 3.2 | Are human-in-the-loop controls enforced for irreversible actions? | Never — irreversible actions can run without confirmation | 0 |
| 3.3 | Is prompt injection defense deployed? | Basic — one layer only | 2 |
| 3.4 | Do AI agents cite sources and abstain when uncertain? | Recommended — not technically enforced | 2 |
| 3.5 | Is there an AI incident response process? | Documented only — not tested | 2 |
| 3.6 | Are AI outputs validated against SAP before execution? | Sometimes — high-risk actions only | 2 |
An agent proposes a write-back through an unclassified custom BAPI.
The policy blocks the irreversible write before anything reaches ECC.
The block is logged with the actor and the object.
Domain 3 stays at 33.3, Developing. A perfect Domain 3 would reach 49.8 and would still be Developing. AI is what the board asks about. Data extraction is where the score moves.
The Operational Control Plane for SAP on Hyperscaler. Opening 42.0, Developing. After the Domain 7 plan, 52.1, Maturing. A perfect Domain 3 alone reaches 49.8, still Developing. The engagement is an ODP Compliance Review, $15,000–$25,000, available as an advisory assessment. This page is a specimen, not a tenant reading.