Protect, govern, and understand AI agents and non-human identities operating inside your business-critical applications.
Consider a request to pay a known vendor for a purchase. An orchestrator assigns one sub-agent to find the vendor and another to create and pay the invoice. The first agent cannot find the intended vendor - so, using the invoking human's delegated access, it creates one because agents are biased for actions. The second agent then creates and pays the invoice. From a human standpoint, what began as a routine payment to a known vendor becomes a high-value payment to a newly created entity. Every entitlement in the chain looked appropriate in isolation. The business risk was invisible until the transaction was done.
This is the problem access governance was not designed to solve. Access tells you what an identity can do. Action governance asks what it actually did - on behalf of which human, across which chain of agents, inside which application - and whether that action should have been allowed. And it requires a different approach.
The Application Layer Is the Blind Spot
Most security approaches focus on the agent layer - the model, the code, the platform where an agent was created. That visibility matters, but it misses where the business transaction actually happens: inside SAP, Salesforce, Oracle, ServiceNow, and the other applications that run the enterprise.
Native agents embedded in these platforms - SAP Joule, Salesforce Agentforce, Oracle AI agents, Microsoft Copilot - have deeper, more trusted access to application data than any external tool. They run inside the platform. Their traffic never leaves the application perimeter. No CASB, no NHI tool, no traditional IAM sees what they execute.
The scale of the gap is not theoretical. According to the 2026 Global Survey on SoD Risk Management in SAP Environments (de Jong, SAP Secure Together Community, n=100), 38% of deep-dive respondents already have AI-driven actions reaching production SAP transactions. Of the 21 organizations with AI agents in production, only 2 have fully enforced SoD guardrails. The survey puts it plainly:
The same survey found that 62% of practitioners do not assess indirect SoD through BTP, middleware, or APIs - the exact layers where agents and automation operate. These are not edge cases waiting to be discovered. They are gaps that are open right now, in production, at organizations that believe they have governance in place.
Introducing Zuma for Apps
Today, I am really happy to introduce Zuma for Apps - a new solution from the Saviynt Enterprise AI Identity Security Platform that governs AI agents and non-human identities operating inside business-critical applications.
Zuma for Apps connects human context, agent intent, delegated authority, fine-grained application access, activity, and business risk. It answers the question that access governance alone cannot: should this exact action - by this agent - on behalf of this human - have happened?
It does this through three capabilities.
Discover: See the Complete Action Chain
AI agents can originate inside applications, be built externally, or coordinate across other agents and tools. Zuma for Apps maps the complete chain: the humans who can invoke an agent, the authority delegated to it, the sub-agents and tools it can call, and the fine-grained entitlements it can exercise inside target applications.
Because Saviynt connects directly to the application layer - built on 15 years of application connector depth across SAP, Salesforce, Oracle, etc. - visibility extends beyond access inventory to include activity, security configuration, and transaction data. The result is not a disconnected list of agents. It is a complete view of what every identity in the chain can do, and what it actually did.
This same depth extends to static non-human identities: service accounts, batch users, integration users, and technical system accounts. The survey found that 38% of organizations have excluded non-human accounts from SoD analysis entirely - leaving a population that 66% have catalogued but none are governing. A registry without governance is just a list. Zuma for Apps closes that gap.
Governance: Evolve SoD, Certification, and Provenance for Agents
Traditional SoD asks whether one identity holds two conflicting functions. In an agentic workflow, the conflict may emerge across a human, an orchestrator, multiple sub-agents, and multiple applications. Zuma for Apps evaluates the complete chain - cross-identity, cross-application, and event-driven - rather than assessing each identity in isolation.
Every delegation is attributable. Every credential is appropriately scoped. The full path from intent to execution is verifiable. This is the provenance layer that turns autonomous action into auditable accountability.
From potential access risk to realized business exposure. Traditional controls show what an identity could do. Application activity and transaction intelligence make it possible to determine what it actually did.
Zuma for Apps: $24.9M total exposure - $8.2M realized, $16.7M potential - attributed to human invoker and Vendor Processing Agent
Zuma for Apps connects access, delegated authority, agent activity, and business transactions so organizations can distinguish potential violations from realized exposure - and express that exposure in business and financial terms, not just policy counts.
For example, an organization may identify a conflict between maintaining vendor master data and approving an invoice. Zuma for Apps traces the transaction to the human who invoked the agent, the agent and sub-agents involved, the access exercised, the action completed, and the evidence in the target application. Security, application, audit, and risk teams share one view of the control violation and the business outcome, rather than working from separate access and transaction records.
A practical trust decision: when delegated authority is not enough. Consider a vendor-processing agent that autonomously releases a blocked invoice. The invoking human may have permission to release it - but the action falls outside the agent's intended purpose. That gap between inherited authority and authorized agent behavior is a critical signal.
Zuma's Trust Center brings together signals - scope drift, sensitive activity, credential hygiene, prior transactions, human oversight, and behavioral change - so reviewers can make decisions grounded in what the agent was designed to do, what it has done, and whether it should retain its access. A supervisory agent continuously evaluates those signals and escalates to a human when risk warrants it.
This changes certification from a static entitlement review into a decision grounded in what the agent was designed to do, what it can do, what it has done, and whether it should retain its access.
Protect: Enforce Policy Before Every Agent Action Executes
From Access Governance to Action Governance: agent actions evaluated in real time - Create PO → Approve PO blocked as SoD violation
Visibility and governance are necessary. High-risk actions also require a policy checkpoint at runtime. Through Zuma's Agent Access Gateway and Intent-Aware Runtime Authorization, Zuma for Apps evaluates each action using the identity behind it, the authority delegated, the agent's declared purpose, application-specific access, trust signals, and the business transaction being attempted - before the action executes.
For native agents such as SAP Joule, Saviynt registers as the MCP server inside Joule Studio. The agent has no direct path to SAP systems. Every skill invocation flows through Saviynt's policy engine first. The result is zero-trust for agents - not by interception, but by design.
When an action should be blocked or escalated, it is. When it should proceed, it does - with a complete, auditable decision record attached.
Six Capabilities for the Agentic Application Era
- A common control plane across human identities, static non-human identities, and AI agents.
- Fine-grained application intelligence across access, security models, activity, and business transactions.
- Evaluation of the complete identity chain - humans, orchestrators, agents, sub-agents, tools, and delegated authority.
- Cross-identity, cross-application, event-driven controls that can be evaluated and enforced at runtime by evaluating effective access.
- Transaction monitoring and evidence that connects access risk to realized business and financial exposure.
- Continuous trust and cost governance - as agents consume application resources and licensing costs scale with usage, Zuma for Apps brings agent activity, entitlement and its usage data, and cost accountability into a single control plane.
Why Saviynt
No other identity security platform has the application depth to govern at this layer. Understanding what a Joule skill actually does inside S/4HANA, what a Salesforce permission set permits at the record level, what an Oracle role grants across ERP and HCM - that knowledge is not something a security company builds with a connector in a year. It is the foundation Saviynt's Application Access Governance platform has been built on for 15 years.
Zuma for Apps extends that foundation. For existing Saviynt AAG customers, this is not a new program - it is the same control plane, extended to every agent that touches the applications you already govern.
Join the Design Partner Program
AI agents are changing how business gets done. Organizations should be able to adopt that innovation without surrendering security, control, or accountability.
We are inviting customers introducing AI agents into business-critical applications to help shape Zuma for Apps through our Private Preview Program. Contact your Saviynt account team to apply.
To learn more about Saviynt Application Access Governance, visit saviynt.com/products/application-access-governance-solutions. To experience Zuma's AI identity security capabilities today, start a free trial at saviynt.com/zuma-trial. Zuma for Apps capabilities are not included in the current trial and will be available initially through the Private Preview Program.
Survey citation: de Jong, T.-J. (2026). Segregation of Duties Risk Management in SAP Environments: 2026 Global Survey Report. SAP Secure Together Community. Licensed CC BY-ND 4.0.
