Secure Autonomous Agents in SAP Systems: A Control-Property Review Evaluated on a Reconstructed SAP FI Authorization Model

{"Secure":[0],"Autonomous":[1,17],"Agents":[2,286],"in":[3,258,449,651,751,755,809,922],"SAP":[4,13,170,692,852,860],"Systems:":[5],"A":[6,179,421,557],"Control-Property":[7,157],"Review":[8,158],"Evaluated":[9],"on":[10,526,716,792,846],"a":[11,39,44,55,75,122,127,132,153,161,168,190,197,229,304,331,337,391,450,461,493,497,561,565,604,726,759,806,841,847,858],"Reconstructed":[12],"FI":[14,171,324,853],"Authorization":[15],"Model":[16],"AI":[18],"agents":[19],"are":[20,540,638,888],"being":[21],"given":[22],"authority":[23],"to":[24,33,52,302,477,517,520,569,593,666,730,766,906],"act":[25],"inside":[26],"enterprise":[27],"resource":[28],"planning":[29],"(ERP)":[30],"systems":[31],"—":[32,48,140,149,211,262,442,577,780,793,856],"post":[34],"the":[35,68,71,79,89,103,156,193,201,207,222,233,263,277,313,319,353,364,375,380,388,396,407,414,440,468,478,485,488,508,527,570,581,589,609,621,639,652,657,663,669,673,683,686,690,694,697,700,704,708,717,723,738,746,752,774,782,786,788,799,821,823,826,829,873,895,902],"credit":[36],"memo,":[37],"change":[38,568],"vendor's":[40],"bank":[41],"detail,":[42],"release":[43,877],"transport":[45,393],"into":[46],"production":[47],"rather":[49,910],"than":[50,221,232,241,616,773,911],"merely":[51],"suggest":[53],"that":[54,82,142,145,188,270,289,306,327,351,404,625,659,706],"person":[56],"do":[57],"so.":[58],"Almost":[59],"every":[60,265,349,475,649,925],"one":[61,136,542,551],"of":[62,99,163,369,418,427,434,580,612,762,802,850,897],"those":[63],"deployment":[64],"decisions":[65,298,403,412],"travels":[66],"with":[67,78,152,805],"same":[69,80,90,323],"reassurance:":[70],"agent":[72,458],"runs":[73,438,715],"under":[74,460],"named":[76,124,129,750],"user,":[77],"authorisations":[81],"user":[83],"already":[84],"had,":[85],"so":[86,359],"it":[87,134,213,227,250,437,523,576,617,757,899],"inherits":[88],"controls.":[91],"That":[92],"sentence":[93],"is":[94,108,113,181,192,204,239,275,328,399,492,620,642,644,654,740,745,771,790,794,817,820,838,879,927],"doing":[95],"an":[96,554,851],"enormous":[97],"amount":[98],"load-bearing":[100],"work":[101,530],"across":[102,299],"industry":[104],"right":[105],"now.":[106],"It":[107,112],"not":[109,246,487,496,504,681,736,857,880],"obviously":[110],"wrong.":[111],"also,":[114],"mostly,":[115],"untested.":[116],"This":[117,677,837],"study":[118,844],"tests":[119],"it.":[120,370,506,630],"For":[121],"single":[123,128,332],"control":[125,143,180,223,266,372,451,783,797],"against":[126,167,330,869],"property":[130,146,203],"at":[131,147,395],"time,":[133],"asks":[135],"deliberately":[137],"narrow":[138],"question":[139],"can":[141,373,424,626],"decide":[144],"all?":[148],"and":[150,160,196,295,431,500,522,547,549,578,601,636,648,662,672,703,713,776,798,828,833,876,882,886,901,935],"answers":[151],"diagnostic":[154],"instrument,":[155,822],"(CPR),":[159],"set":[162],"pre-registered":[164,695],"experiments":[165,314],"run":[166],"reconstructed":[169,691,848],"(Financial":[172],"Accounting)":[173],"authorization":[174,854],"surface.":[175],"The":[176,186,237,322,371,482,513,606,633,733,890],"central":[177],"idea.":[178],"neither":[182],"\\"strong\\"":[183],"nor":[184],"\\"weak.\\"":[185],"unit":[187],"carries":[189],"guarantee":[191,789],"control–property":[194,534],"pair,":[195],"pair":[198],"fails":[199],"whenever":[200,564],"protected":[202,571],"defined":[205,791],"outside":[206],"control's":[208,234],"observation":[209,769],"boundary":[210,770],"because":[212,226,436],"ranges":[214],"over":[215,406,785],"more":[216,611],"actions,":[217],"principals,":[218],"or":[219,225,917],"time":[220],"observes,":[224],"concerns":[228],"different":[230],"entity":[231],"predicate":[235],"names.":[236],"through-line":[238],"bigger":[240],"SAP:":[242],"autonomous":[243],"execution":[244],"does":[245,503,735],"create":[247],"these":[248],"gaps;":[249],"reveals":[251],"where":[252],"\\"local":[253],"compliance\\"":[254],"has":[255,865],"been":[256,867],"standing":[257],"for":[259,814],"\\"global":[260],"assurance\\"":[261],"assumption":[264],"environment":[267],"leans":[268],"on,":[269],"if":[271,668],"each":[272],"individual":[273],"transaction":[274],"compliant,":[276],"process":[278],"assembled":[279,341],"from":[280,342,656],"them":[281],"must":[282],"be":[283,518,627,907],"compliant":[284],"too.":[285],"don't":[287],"break":[288],"assumption;":[290],"they":[291],"move":[292],"fast":[293],"enough,":[294],"compose":[296],"enough":[297,300],"sessions,":[301],"make":[303],"gap":[305],"was":[307,515,524,543,599],"always":[308],"present":[309],"suddenly":[310],"visible.":[311],"What":[312,816],"find.":[315],"Three":[316],"measurements":[317],"anchor":[318],"paper:":[320],"Aggregation.":[321],"tolerance":[325],"group":[326],"complete":[329,842],"anomalous":[333],"document":[334],"cannot":[335,378],"discriminate":[336],"period-level":[338],"materiality":[339,357],"breach":[340],"individually":[343],"ordinary":[344],"documents.":[345],"Across":[346],"12,288":[347],"configurations,":[348],"setting":[350],"held":[352],"cumulative":[354],"outcome":[355],"below":[356],"did":[358],"by":[360,402,411],"refusing":[361],"legitimate":[362],"work;":[363,924],"best":[365],"retained":[366],"just":[367],"37.5%":[368],"throttle":[374],"total,":[376],"but":[377,685],"tell":[379],"two":[381,539],"workloads":[382],"apart.":[383],"Prevention":[384],"versus":[385],"detection.":[386],"On":[387],"transport-governance":[389],"surface,":[390],"harmful":[392,429],"identical":[394],"request":[397,415],"level":[398],"discriminated":[400],"only":[401,682,722],"range":[405],"transported":[408],"content,":[409],"never":[410],"reading":[413,467],"alone":[416],"(2,512":[417],"12,800":[419],"configurations).":[420],"governance":[422],"step":[423],"flag":[425],"40":[426,428],"releases":[430],"prevent":[432],"0":[433],"them,":[435],"after":[439],"import":[441],"perfect":[443],"detection,":[444],"zero":[445],"prevention,":[446],"both":[447],"green":[448],"matrix.":[452],"Attribution.":[453],"Under":[454],"principal":[455],"propagation":[456],"(an":[457],"acting":[459],"human's":[462],"just-in-time":[463],"identity),":[464],"no":[465],"procedure":[466],"recorded":[469,602],"audit":[470,559],"fields":[471],"beats":[472],"simply":[473],"assigning":[474],"action":[476],"busiest":[479],"actor,":[480],"unread.":[481],"record":[483],"names":[484],"person,":[486],"deciding":[489],"process;":[490],"this":[491,923],"schema":[494],"gap,":[495],"volume":[498],"one,":[499],"log":[501],"retention":[502],"repair":[505,778],"How":[507],"review":[509,885],"holds":[510],"itself":[511],"honest.":[512],"instrument":[514],"built":[516],"hard":[519],"please,":[521],"turned":[525],"authors'":[528],"own":[529,614],"first.":[531],"Of":[532],"eight":[533,582],"pairs":[535,583],"examined,":[536],"four":[537,579],"held,":[538],"contested,":[541,586],"withdrawn":[544],"as":[545,553,603],"misspecified":[546],"re-run,":[548],"exactly":[550],"survived":[552],"uncontested":[555],"mismatch.":[556],"specification-sensitivity":[558,824],"marks":[560],"verdict":[562],"\\"contested\\"":[563],"small,":[566],"defensible":[567],"property's":[572],"specification":[573],"would":[574],"flip":[575],"come":[584],"back":[585],"including":[587],"results":[588],"paper":[590,653,684,734,891],"had":[591],"hoped":[592],"claim.":[594],"One":[595],"headline":[596],"cost":[597,608],"result":[598],"retracted":[600],"loss.":[605],"method":[607],"authors":[610],"their":[613],"findings":[615],"confirmed,":[618],"which":[619],"most":[622],"trustworthy":[623],"thing":[624],"said":[628],"about":[629],"Reproducibility":[631],"discipline.":[632],"argument,":[634],"interpretation,":[635],"prose":[637],"authors';":[640],"what":[641,898],"mechanised":[643],"consistency.":[645],"Every":[646,711],"figure":[647,698],"number":[650],"generated":[655],"code":[658,946],"produced":[660],"it,":[661],"build":[664],"refuses":[665],"compile":[667],"written":[670],"claims":[671],"underlying":[674],"evidence":[675],"disagree.":[676],"deposit":[678],"therefore":[679],"contains":[680],"complete,":[687],"self-contained":[688],"testbed:":[689],"model,":[693],"experiments,":[696],"generators,":[699],"consistency-check":[701],"suite,":[702],"assembly":[705],"produces":[707],"manuscript":[709],"source.":[710],"experiment":[712],"check":[714],"Python":[718],"standard":[719],"library":[720],"alone;":[721],"figures":[724],"require":[725],"third-party":[727],"package.":[728],"Relationship":[729],"prior":[731],"work.":[732],"claim":[737],"principle":[739],"new.":[741],"Its":[742],"extent":[743],"form":[744],"classical":[747],"aggregation":[748],"problem,":[749],"multilevel-security":[753],"literature":[754],"1989;":[756],"specialises":[758],"published":[760],"characterisation":[761],"enforceable":[763],"security":[764],"policies":[765],"controls":[767],"whose":[768],"narrower":[772],"execution;":[775],"its":[777,893],"recommendation":[779],"give":[781],"state":[784],"horizon":[787],"history-based":[795],"access":[796],"mutable":[800],"attributes":[801],"usage":[803],"control,":[804],"real-world":[807],"instantiation":[808],"runtime":[810],"attribute-based":[811],"enforcement":[812],"products":[813],"SAP.":[815],"offered":[818],"here":[819],"audit,":[825],"measurements,":[827],"negative":[830],"results.":[831],"Scope":[832],"honesty":[834],"(please":[835],"read).":[836],"version":[839],"1.0,":[840],"independent":[843,883],"reported":[845],"model":[849],"surface":[855],"live":[859],"system.":[861],"No":[862,914],"modelled":[863],"mechanism":[864],"yet":[866],"verified":[868],"primary":[870],"vendor":[871],"documentation,":[872],"exact":[874],"product":[875],"scope":[878],"fixed,":[881],"practitioner":[884],"replication":[887],"planned.":[889],"states":[892],"scope,":[894],"limits":[896],"establishes,":[900],"external":[903],"validation":[904],"still":[905],"completed,":[908],"openly,":[909],"burying":[912],"them.":[913],"customer,":[915],"proprietary,":[916],"vendor-licensed":[918],"material":[919],"appears":[920],"anywhere":[921],"scenario":[926],"entirely":[928],"synthetic.":[929],"Authors.":[930],"Bindiya":[931],"Priyadarshini":[932],"(ORCID":[933,938],"0009-0005-7559-3896)":[934],"Martin":[936],"Pankraz":[937],"0009-0008-1567-4223).":[939],"Licensing.":[940],"Paper":[941],"text":[942],"CC":[943],"BY":[944],"4.0;":[945],"MIT.":[947]}