Roles & access
The SAP operations platform signs every caller in with SAP BTP XSUAA. It has two XSUAA instances: one for the landscape service, behind the Connectors, Agents and Known Solutions apps, and one for the MCP server, behind the tools the agents call. Each service checks scopes; the deploy creates role collections that bundle them.
Assign the role collections the standard SAP BTP way: in your subaccount, open Security > Role Collections and add users, or your identity provider's groups. A user without the right role collection gets no data from an app (HTTP 403). SAP Build Work Zone decides which tiles a user sees; the role collections decide what the services answer.
For administrators: the apps
The role collections of the landscape service:
| Role collection | Scopes | What it allows |
|---|---|---|
| Landscape Administrator | LandscapeAdmin, LandscapeRead, AgentAdmin | The Connectors app (upload, view, confirm and discard snapshots; pull SAP Integration Suite tenants), the confirmed landscapes, and the Agents app |
| Agent Administrator | AgentAdmin | The Agents app: the configuration of the agents |
| Landscape Reader | LandscapeRead | Read the confirmed landscapes |
| Agent Configuration Reader | AgentConfigRead | Read an agent's configuration (myConfig), for example to test an agent's settings |
| SAP Ops Known Solutions Admin | SolutionAdmin | The Known Solutions app: edit, retire and reactivate known solutions |
Names in your subaccount
Role collection names are unique in a subaccount. Where a subaccount already has role collections of these names, for example from a second deployment of the platform in another space, the deployment gives its own role collections other names in its extension descriptor, such as SAP Ops Landscape Administrator or Landscape Administrator (test). Look for the names your deployment uses.
For users and MCP clients: the tools
The role collections of the MCP server, for people and MCP clients that sign in themselves, such as an MCP client with a user login. The assistant does not need them: it gets its scopes with the deploy (below).
| Role collection | Scopes | What it allows |
|---|---|---|
| AIF MCP Monitoring | Monitor | AIF monitoring data, without business payloads (/mcp/aif) |
| AIF MCP Monitoring and Data | Monitor, Payload | AIF monitoring data and business payloads, and the search of messages by business key values |
| AIF MCP Landscape | LandscapeRead | The system landscape from confirmed snapshots (/mcp/landscape) |
| AIF MCP Integration Suite | CisMonitor | SAP Integration Suite monitoring, without payloads (/mcp/cis) |
| AIF MCP Grounding | GroundingRead | The grounding collections, retrieval only (/mcp/grounding) |
| AIF MCP Restart | Monitor, Restart | AIF monitoring data, and the restart and the cancel of AIF messages in error (/api/aif/v1, aif_restart_message, aif_cancel_message) |
| AIF MCP Known Solutions | SolutionRead | Search the known solutions (/mcp/solutions) |
| AIF MCP Known Solutions Editor | SolutionRead, SolutionWrite | Search the known solutions, and save them and their feedback (/mcp/solutions) |
Restart covers both the restart and the cancel of a message; the cancel has no scope of its own. Restarts and cancels also need the MCP server's switches, AIF_RESTART_ENABLED and AIF_CANCEL_ENABLED; see Settings.
Technical grants, without a secret
The platform deploy grants scopes to two technical clients, as authorities. No role collection and no shared secret are involved:
| Client | Gets | From |
|---|---|---|
| The assistant (its own XSUAA client) | AgentConfigRead, to read its configuration | The landscape service |
Monitor, Payload, Restart, LandscapeRead, CisMonitor, GroundingRead, SolutionRead, SolutionWrite | The MCP server | |
| The MCP server (its own XSUAA client) | LandscapeRead, SolutionRead, SolutionWrite, to read the landscape and to search and save the known solutions | The landscape service |
Because the grants are created by the platform, deploy the platform before the assistant: the assistant's XSUAA declares these scopes and cannot be updated before they exist.
A restart or a cancel that the assistant starts is recorded with the user who approved it, through the assistant's client. See How error resolution works.
Related
- Agents app: what each agent may use.
- Known solutions: the Known Solutions app in SAP Build Work Zone.
- Roles & scopes of Boidra Platform: the roles of the platform the agents are deployed with.