# Weekly review W39: who signs for the agent's decision > Ten items, 18-24 September 2026: the AI agent as a privileged actor in SAP, UiPath FUSION 2026 launches, agent oversight and Claude Opus 5.5. - Source: https://snok.ai/en/news/blog/weekly-review-w39-who-signs-for-the-agents-decision/ - Author: Jacek Bugajski - Published: 2026-09-25 --- **Ten items from the week of 18-24 September 2026, with a note on what each one changes in your systems.** At FUSION 2026 UiPath moved into general availability tools that until recently were in preview. Anthropic lowered the price of a frontier-class model. Agents increasingly run in production, with permissions to company systems. One question runs through this week's ten items: an agent, a model or a tool proposes - who approves the proposal, and where does the trail stay? A SecurityBridge co-founder calls it "human in the lead". Daniel Dines, UiPath's founder, makes it a condition for deployment. Jev practitioners write it down as a rule: the model proposes, the code decides. ## 1. An AI agent in SAP is a privileged actor On 10 September Ivan Mans, co-founder of SecurityBridge, published a piece in Forbes Technology Council on AI agents as a new attack surface in SAP. The argument: an agent in SAP S/4HANA, SAP BTP or SAP Joule operates inside trusted flows, with credentials granted in good faith. The question is no longer "will we let an attacker in" but "what can the agent inside do, and can we prove it". The author describes three risk patterns. First, prompt injection moves inside the trust boundary, because the agent reads data someone may have crafted. Second, privilege escalation becomes ambient - an agent chaining many API calls assembles a level of access no human was ever granted. Third, the software supply chain extends into artefacts generated and configured by AI. His answer sits in the application layer, not the model: runtime application self-protection watching agent-initiated actions, API security with least privilege, and software composition analysis that covers AI-generated code. Model guardrails limit what the agent is told to do, not what a compromised agent can reach. On top of that, "human in the lead": the agent prepares, and a named person authorises any action with consequences and signs the audit trail. **What it means:** the article ends with a board question worth asking before any agent goes live on SAP data: which decisions are we letting AI make in production, and who signs for them? In the author's view, if the answer is "we don't know", the deployment is not ready. *Source: Ivan Mans, "Agentic AI Is The New Attack Surface: How Can SAP Application Security Teams Repel It?", Forbes Technology Council, 10 September 2026. Status: confirmed - article read on 24 September 2026; the three risk patterns, the principle and the board question match the text.* ![A robot arm works inside a locked server cage, an access badge on a lanyard hanging from its wrist, while the supervisor's chair stands empty](https://snok.ai/images/blog/snok-weekly-digest-w39-01-ramie-w-klatce.webp) ## 2. Mitigate first, patch second In a TechIntelPro interview published on 21 September, Ivan Mans moves the SAP security conversation from visibility to risk reduction. The starting point is prioritising by exploitability rather than CVSS score. A 9.8 in an unused component with no exposure is less urgent than a 7.0 on an internet-facing Fiori gateway that is exploited in practice. The order of work he proposes: mitigation first - a virtual patch, a restricted ICF service, a blocked RFC destination, tightened authorisations - and only then the real fix with regression tests. In his words, mitigation can often remove 80 per cent of the risk within an hour, without touching code or transports. He adds that most SAP vulnerabilities leave traces when exploited, so monitoring lets you schedule the fix for a maintenance window instead of a night shift. Detection in the SIEM, a ticket in ServiceNow, the fix in SAP - three tools and three people to close one finding. Mans calls it an ownership problem. A second observation: RISE changes who runs the system, not who bears the consequences of an incident. **What it means:** before you buy another detection tool, decide who owns closing a finding from alert to fix. Without that, faster detection only gives you a longer queue. *Source: "How Do You Turn SAP Security Visibility Into Real Risk Reduction?", TechIntelPro, interview with Ivan Mans, 21 September 2026. Status: confirmed - interview read on 24 September 2026. The 80 per cent figure is the interviewee's claim, not a measurement.* ![A steel repair clamp on a pressurised pipe, with a new pipe section waiting on a trolley beside it for the maintenance window](https://snok.ai/images/blog/snok-weekly-digest-w39-02-opaska-naprawcza.webp) ## 3. The ABAP package on disk, the SAP system untouched `abap-adt-cli` is an open command-line tool that pulls a whole ABAP package onto a laptop as plain files, lets you edit it with any tool and pushes the changes back under a chosen transport. It runs on the ADT REST API that Eclipse uses, so according to the author nothing has to be installed in the SAP system. It needs a system with ADT enabled - standard on SAP NetWeaver and SAP S/4HANA, according to the author - and a user with the `S_DEVELOP` authorisation. Two details matter for teamwork. Editing one method writes a transport entry for that method, not a lock on the whole class, so a colleague can work on another method in their own transport. According to the README, the password goes into the operating system keychain, never into a file. The author also states that the source never passes through a model; the transfer is plain HTTPS between the machine and the SAP system, and the AI assistant reads files from disk. It is the missing link between a coding agent and an SAP system - the code stays local. **What it means:** the `S_DEVELOP` authorisation plus transport writes from a laptop is a real change to the risk surface. Before the tool reaches the team, the system owner has to approve it and the tool's code has to be reviewed - it is a single-author project with no vendor support. *Source: the `vaibhavgoel-github-1986/abap-adt-cli` repository on GitHub, README, read on 24 September 2026. Status: confirmed as documented; we have not run the tool. The repository was created on 13 September 2026; MIT licence according to the README (no separate licence file).* ![A gloved hand slides a tray of components through a stainless steel pass-through hatch in a cleanroom wall onto a bench next to a closed laptop](https://snok.ai/images/blog/snok-weekly-digest-w39-03-sluza-podawcza.webp) ## 4. The agent as an asset you must be able to restore Help Net Security publishes a weekly roundup of security product launches. In the edition of 18 September, four of the six items treated AI agents as an asset in their own right. Cohesity Agent Resilience discovers, protects and restores the infrastructure behind agents. Akuity Agentic Control Plane gives agents operational context and permissions in software delivery. Tuskira Vector runs autonomous red teaming of the external attack surface. Dataminr Advanced for Corporate Security applies agentic AI to protecting people, locations and operations. The pattern is clear: the agent has stopped being a feature of a security tool and become something you have to inventory, scope, protect and be able to restore. Backup is no longer only about data. **What it means:** a continuity plan that does not say how to restore an agent after compromise or failure has a gap. An inventory of agents, their permissions and dependencies comes before any product choice - without it you do not know what to protect. *Source: Help Net Security, "New infosec products of the week: September 18, 2026", 18 September 2026. Status: confirmed - the product list matches the source. "A new category" is our observation from one week of launches, not a product assessment.* ![Two identical robot arms in a production cell, one working at the line, the other waiting in a protective cradle as a spare](https://snok.ai/images/blog/snok-weekly-digest-w39-04-ramie-zapasowe.webp) ## 5. UiPath FUSION 2026: from pilot to production At UiPath FUSION 2026 in Las Vegas, UiPath announced on 23 September general availability of several products that had been in preview. UiPath Cartographer drafts and maintains a company's Map of Work from documents, systems and people, with every fact carrying its source and verifier. Process Atlas ships inside Cartographer, with 83 expert-attested processes across seven industries. UiPath for Coding Agents and UiPath Delegate are also generally available; the vendor describes Delegate as a governed agent on your desktop for tasks people would otherwise do by hand. Maestro splits into two products: Maestro Orchestrate for long-running processes and Maestro Automate for short agent and API flows. Automate is available on Automation Cloud, for Community and paid plans; availability in Automation Suite is listed as to be confirmed. Automation Suite gets the full agentic stack on Linux, including on-premises. The second axis of the announcements is agent oversight. Model Hub shows which models are used, where and how they are routed. Runtime Checker validates agent behaviour against policy while it runs. Add the LLM-as-Judge guardrail, Compliance Packs that map regulatory standards to controls, and identity and access policies. Decision Ledger, a record of production decisions, stays in preview and on the roadmap, with no general availability date. In an article the same day, Daniel Dines states the condition plainly: no accountable Map owner, no agentic deployment. **What it means:** the agentic automation conversation moves from "does it work" to "who owns the map and who signs for the agent's decision". Licensing terms and EU region availability need to be checked separately - the announcement does not settle them. *Sources: UiPath, "The biggest product announcements from UiPath FUSION 2026" and the platform update press release, 23 September 2026; the Maestro Automate product page; Daniel Dines, "Every company already has a map of work. Most can't see it.", LinkedIn, 23 September 2026. Status: confirmed with the vendor on 24 September 2026. General availability of Maestro Orchestrate is not announced in these materials - we only report the product split.* ![A hand places the last piece on a detailed scale model of an entire plant, with the real plant visible through the glass wall behind](https://snok.ai/images/blog/snok-weekly-digest-w39-05-makieta-zakladu.webp) ## 6. Agent oversight as a category criterion On 14 September Gartner published the Magic Quadrant for Business Orchestration and Automation Technologies, evaluating 20 vendors. UiPath was placed in the Leaders quadrant - we covered the recognition itself in a [separate post](https://snok.ai/en/news/blog/uipath-leader-gartner-magic-quadrant-boat/). For this issue the category definition matters more. According to Gartner, BOAT is a consolidated platform that orchestrates and automates processes and tasks with varying degrees of autonomy and complexity. It requires native orchestration of AI agents, oversight of them and coordination of many agents at once, connected through the Model Context Protocol, APIs and the user interface. **What it means:** agent oversight is not an add-on to the platform but the threshold for entering the category. When you choose a platform for agentic automation, ask about oversight first - who sees what the agent did, who can stop it and where the trail stays - and only then about the feature count. *Source: Gartner, "Magic Quadrant for Business Orchestration and Automation Technologies", 14 September 2026, licensed reprint (read on 19 September 2026). Status: confirmed.* *GARTNER is a registered trademark and service mark, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.* ![A turntable in a new locomotive depot with tracks radiating outward, its bridge lining up a single locomotive with its assigned track](https://snok.ai/images/blog/snok-weekly-digest-w39-06-obrotnica.webp) ## 7. Claude Opus 5.5 and cheaper long context On 22 September Anthropic released Claude Opus 5.5. API pricing in the vendor's documentation: USD 4 per million input tokens and USD 20 per million output tokens, against USD 5 and 25 for Claude Opus 5 - 20 per cent less in both cases. The one-million-token context comes at standard pricing. The biggest change is in cache reads: USD 0.20 per million tokens against USD 0.50, which is 60 per cent less. Long agentic sessions, where the same context returns at every step, get cheaper most of all. Anthropic adds that in its own tests the cost of typical tasks falls by around 40 per cent because the model uses fewer tokens - that is the vendor's measurement, not ours. **What it means:** a cheaper frontier model means more agents in production, and so more decisions someone has to sign for. It also moves the break-even point for local models on workloads with long, repeated context - the numbers need to be run again. *Sources: Anthropic, Claude platform pricing documentation, read on 24 September 2026; Claude Opus 5.5 launch page, 22 September 2026. Status: prices and date confirmed with the vendor; percentage differences calculated in this session.* ![Two electric motors on a test bench in a new laboratory, an older large one and a newer, more compact one with an amber indicator lit](https://snok.ai/images/blog/snok-weekly-digest-w39-07-nowa-generacja.webp) ## 8. The model proposes, the code decides On 15 September TypeSafe AI came out of stealth with a USD 40 million round led by DCVC and a model called Jev. It is a "System One" model: it takes unstructured state and returns a typed decision with a probability distribution - a choice from a closed list, a score on a rubric or the probability that a statement is true. It generates no text. The vendor quotes 70-500 ms per end-to-end request and a price of USD 42 per billion input tokens. Within a week a wave of open implementations of the same idea followed, including ones that run locally on Apple Silicon, along with tools built on the API, for example for compacting the context of coding assistants. The uses mentioned most often are query and model routing, retrieval control in RAG, result re-ranking, escalation to a human and choosing an agent's next step. The common denominator: these are decisions, not texts. The engineering note on building systems with Jev sets out a rule: the model proposes a branch, the code decides whether it may run. Confidence thresholds follow consequences - a low-risk label can pass automatically, while publishing, payments, data deletion and outgoing messages need deterministic checks, often human approval. Probability never bypasses permissions, budgets or limits. **What it means:** much of what an agent does between tool calls is deciding, and today we pay for those decisions as if they were prose. More important than the price, though, is the division of responsibility - it can be written into an agent architecture as a requirement whichever model you choose. Generating no text rules out type errors, not errors of judgement. *Sources: TypeSafe AI, announcement of 15 September 2026 and product page; the "Jev Engineering" working note, September 2026. Status: funding, founders, price and latency confirmed with the vendor on 24 September 2026 as its own claims; user reports on costs and speed-ups are left out because they have not been measured independently.* ![A high-speed parcel sorter in a new logistics hub, its diverter arm sending one box onto a side lane while the others continue straight](https://snok.ai/images/blog/snok-weekly-digest-w39-08-bramka-sortujaca.webp) ## 9. Typed decisions without sending data out The "Parallel Constrained Decoding" demo on Hugging Face shows the same mechanism in a local version. An MLX-based engine scores every field of a JSON schema at once instead of generating tokens one by one. The author reports measurements on an Apple M4 Max with a 4-bit Qwen2.5-1.5B model: 75 ms instead of 420 ms for fintech fraud routing and 68 ms instead of 380 ms for a code security audit, both with four fields. With a 28-field schema the speed-up rises to about seven times. It also guarantees a syntactically valid schema and gives a confidence score per field. A typed decision can be computed entirely on the machine, without sending content to an external API. It is a route for data that may not leave the organisation. **What it means:** the speed-up is about decoding mechanics, not quality of judgement. A small instruction-tuned model is not a model specialised in decisions - latency and accuracy have to be measured separately, on your own examples. *Source: "Parallel Constrained Decoding", Hugging Face Spaces (drinkmoonshine), model card and README, read on 24 September 2026, Apache 2.0 licence. Status: figures match the source; they are the demo author's measurements, not independently confirmed.* ![Close-up of dozens of gold test probes pressing onto a green circuit board at the same time](https://snok.ai/images/blog/snok-weekly-digest-w39-09-igly-testowe.webp) ## 10. Open weights, a research licence On 20 September the Qwen team released Qwen-Image-2.1, one model for image generation and editing. The visual part has 7 billion parameters, the text encoder is Qwen3-VL 8B, and the model supports native transparency and up to ten reference images. According to their authors, community quantisations run it on a card with 12 GB of memory. The licence is the Qwen Research License, whose scope-of-use clause allows non-commercial purposes only and requires a separate commercial licence from the vendor. Marketing graphics, a blog cover or a proposal illustration are commercial use. Comparative results come from the Qwen team's own benchmark - not an independent measurement, so we do not quote it. **What it means:** open weights do not mean the decision on business use is yours. Read the licence before the test, not after the rollout. This is not legal advice - the licence terms are for a lawyer to interpret. *Sources: the `Qwen/Qwen-Image-2.1` model card on Hugging Face, the QwenLM repository and licence file (release date 20 September 2026), read on 24 September 2026. Status: confirmed.* ![A professional cinema camera on a studio table, tethered to the tabletop with a steel security cable](https://snok.ai/images/blog/snok-weekly-digest-w39-10-kamera-na-lince.webp) ## One question for this week This week's ten items point to one step to take before production: give every agent decision a named owner. Not a team, not the platform vendor, but a person who knows what the agent can do, can stop it and answers for the trail of its actions. A missing list can stay hidden until the first audit or incident. **How we help:** SNOK's services include [security assessment of AI agents](https://snok.ai/en/offer/ai-automation/ai-security/), [SAP protection with SecurityBridge](https://snok.ai/en/offer/sap-security/securitybridge/) and [UiPath Maestro deployments](https://snok.ai/en/offer/ai-automation/uipath-maestro/). [Let's talk about your case](https://snok.ai/en/contact/).