The Frankenstein architecture: Cross-vendor agents and the gap Klein didn't close in Orlando

1. Saueressig’s term and its expansion in the DACH discourse

Frankenstein architecture is a term coined by SAP board member Thomas Saueressig, originally used in a Computerwoche interview on November 10, 2025. Saueressig used it to describe on-premise AI agent architectures interconnected via "tunnels and gateways": expensive, difficult to maintain, and prone to rapid obsolescence. The concept was subsequently expanded in DACH analyst commentary regarding the DSAG Investment Report 2026 (e3mag.com March 2026, it-daily.net March 2026) to cover a broader issue: AI agents from SAP, Salesforce, Workday, and Microsoft operating in parallel on the same enterprise systems without a centralized governance layer.

In a broader sense, the definition is as follows: Frankenstein architecture is a configuration in which multiple AI agents from different vendors simultaneously access productive business data and processes without the existence of shared identity propagation, a unified audit trail at the tool-call granularity level, or a consistent escalation path between vendor ecosystems.

2. Three data points that define the gap

Three independently documented data points illustrate the situation.

First: The community inventory. The marianfoo registry at github.com/marianfoo/sap-ai-mcp-servers lists more than 30 independent MCP server projects for SAP systems as of April 2026. Categories include: ADT bridges (read and write access), transport orchestration, BW/4HANA modeling, SuccessFactors HR operations, SAP Cloud ALM ITSM API, security and compliance auditing, SAP Cloud Integration, BTP destinations, AI Core lifecycle, HANA Cloud, Datasphere, Analytics Cloud, and Knowledge Graph. There is no unified audit trail across these servers.

Second: The shadow AI finding. The Digital Chiefs analysis "Chief AI Officer 2026" from April 2026 reports that 78 percent of employees use AI tools without IT approval, while only 14 percent of companies have clarified AI accountability at the board level. With AI budget growth at 87 percent, it is clear that investment and governance are decoupled.

Third: SAP’s own position. Christian Klein, CEO of SAP SE, addressed this in his Q1/2026 earnings call (April 2026) and confirmed the statement live during the Sapphire 2026 keynote in Orlando on May 11, 2026: "We plan to announce some fundamental changes to our portfolio to infuse this deep domain know-how into SAP's AI agents, and we will govern the agentic AI layer for our customers." (Source: Constellation Research April 2026, Diginomica April 2026, IgniteSAP April 2026, SAVIC Technologies May 11, 2026 post-keynote analysis).

These three data points frame the problem. Between 30+ community MCP servers, 78 percent shadow AI, and an SAP announcement regarding the governance of its own agent layer, there is a structural gap. The question is: Who controls what happens across this gap?

3. Three approaches with varying scope

Three approaches are currently observable in the market, each with a different scope.

Approach 1: Platform governance by the dominant vendor. Klein’s Sapphire statement is the announcement that SAP will assume the governance role for SAP-native agents within SAP systems. The LeanIX AI Agent Hub (introduced in Q1/2026) is the designated inventory dashboard for this purpose. The Joule Studio Agent Builder (GA Q1/2026) provides built-in audit trails for the agents created within it. The SAVIC Technologies analysis from May 11, 2026, describes three structural decisions from the keynote: domain-aware Joule agents, SAP Sovereign Cloud expansion in India, and Business Data Cloud expansion (positioned as core business following the completed Reltio acquisition on May 7, 2026).

Approach 2: Community evolution toward Enterprise-MCP. ARC-1 (ABAP Relay Connector, "arc one"), released by Marian Zeis on April 27, 2026, positions itself as a "Secure ADT MCP Server for Enterprise SAP Development." It features five differentiators compared to earlier community projects: centralized deployment, secure defaults, layered security, user-based identity, and auditability. ARC-1 is not the end of this movement, but a significant step from the experimental phase toward enterprise-grade infrastructure.

Approach 3: Comprehensive change governance on the SAP side. The Solutive AG approach, categorized as an Enterprise Change Control Tower (Q2/2026 vendor framing), sits above the ALM layer. Decisions regarding production changes are made in a dedicated layer, regardless of whether the change was initiated by a human developer, a Joule agent, or a community MCP server. This is a vendor categorization, not an established analyst label. However, the underlying problem—a cross-vendor governance gap, regulatory overlap, and pressure for platform consolidation—is independently verified.

4. Five risks beyond the SAP governance boundary

Risk 1: Limited reach of SAP governance. Klein's statement refers explicitly to "SAP's AI agents." The scope boundary is clear: SAP governs SAP agents within SAP systems. What happens when Microsoft Copilot, Salesforce Agentforce, or a Workday agent writes to an SAP system via an API is not covered by this commitment. Klein's statement sharpens the "Frankenstein" question rather than resolving it.

Risk 2: Loss of identity at the tool call. When an AI agent writes an ABAP change via an MCP server, the SAP transport log typically records a service user. The identity of the originating agent—which model, which conversation, and which human sent the prompt—is lost unless an additional layer persists this information. The DX Heroes analysis from April 2026 documents this as a structural gap in the MCP enterprise landscape.

Risk 3: Audit trail fragmentation across vendor boundaries. Each vendor produces its own audit trail: AWS Bedrock AgentCore with Cedar policies, Atlassian Rovo with OAuth 2.1 plus domain allowlisting, and SAP Joule Studio with its built-in trail. As of May 2026, consolidating these trails at a uniform level of granularity—tool call with identity, timestamp, result, and escalation—is not yet production-ready.

Risk 4: The irreversible nature of SAP transports exacerbates the gap. SAP Note 11599 documents that productive ABAP transports are technically irreversible. There is no native rollback. A wrong decision made by an unidentified agent in a non-consolidated audit environment cannot be systemically undone after the fact. The crucial question is not whether the system works, but whether humans still have the choice to reject its actions.

Risk 5: Personal liability meets structural deficit. At the intersection of NIS2 (personal liability of management under § 38 BSIG, in effect since December 6, 2025) and the EU AI Act (Article 26 operator obligations as of August 2, 2026, not postponed by the Digital Omnibus), the operator bears responsibility for processes that they cannot fully track within the current architecture.

5. Five operational consequences for operators

First: Maintain an agent inventory. Which AI agents currently have read or write access to which SAP systems? You need a cross-vendor list including the source (SAP-native, community MCP, third-party), scope of authorization, responsible party, and date of the last audit. The LeanIX AI Agent Hub covers the SAP-native view; a complete view requires additional tools or manual maintenance.

Second: Propagate identity with every tool call. The central technical lever is the question: Who sent the original prompt, and is this person identifiable in the audit entry? For ABAP write access via MCP servers, this means using user-specific identities rather than generic service accounts. ARC-1 implements this principle; older community servers do not do so consistently.

Third: Define an escalation path. In cases of ambiguity regarding deployment decisions (where quality gates are partially green and partially yellow), a clearly defined human decision-maker is required, provided with a readable briefing template. Use a 30-second format covering the risk statement, affected business process, test coverage, and recommendation. This layer determines whether the architecture acts in a consolidated manner despite the use of different vendor agents, or remains fragmented.

Fourth: Make vendor boundaries explicit. When negotiating contracts with SAP, Microsoft, and Salesforce, you should ask specific questions: What audit trail is produced, in what format can it be exported, what identity information does it contain, and how does the auditor access this information in an emergency? Blanket assurances that "we govern our agents" are insufficient for NIS2 or EU AI Act compliance.

Fifth: Appoint a CAIO or assign the role functionally. Digital Chiefs identifies EU AI Act and ISO 42001 governance as the most defensible CAIO mandate. The operational consequence: a named individual with responsibility for risk assessment, incident management, and accountability. Examples from 2026: Jonathan von Rueden as CAIO of SAP SE.

6. Tool landscape: Cross-vendor governance in May 2026

Tools that cover individual parts of cross-vendor agent governance are grouped into three layers.

¹ Solutive AG is the initiator of the Change Orchestration Institute. ESM Suite is a product of Solutive AG.

Solutive AG is the initiator of the Change Orchestration Institute. ESM Suite is a product of Solutive AG. Statements regarding ESM Suite are provided by the vendor.

How to read the table: No single tool covers all four functional areas. As of May 2026, cross-vendor audit consolidation is simply not a production-ready solution. What exists are partial solutions within each vendor's own platform ecosystem. The operational consequence: anyone requiring a holistic "Frankenstein" answer must combine tools.

7. What Klein left unanswered in Orlando

The "Frankenstein architecture" describes a scenario in which multiple AI agents from different vendors interact with productive business systems simultaneously without an overarching governance layer. Saueressig introduced the term to the discourse in November 2025; Klein positioned SAP's own response in the Sapphire keynote on May 11, 2026: "We will govern the agentic AI layer for our customers." This response is clear in its scope (SAP agents, SAP systems) and equally clear in what it leaves unanswered (cross-vendor identity, cross-vendor audit).

For SAP user companies, the operational consequence is: inventory, identity propagation, escalation path, contractual vendor boundary clarity, and CAIO responsibility. Pure platform governance from a single vendor is not the whole picture. This applies regardless of which vendor makes the claim.