Admin setup: connect SAP services

After Installation, a Platform Operator connects Boidra Platform to your SAP BTP services. Only the database is required to ingest and view traces; each step below switches on more of the platform.

Everything here uses SAP's standard mechanisms (service bindings, the Destination service, XSUAA role collections). Nothing in SAP's own products is modified.

Who can do this

Settings and environments need the Platform Operator role (PlatformAdmin scope). See Roles & scopes.

Checklist

#	Connect	Needed for	Where
1	SAP HANA Cloud	Storing spans and app state in production	Service binding / DATABASE_URL
2	SAP BTP XSUAA	Sign-in, roles, approvals, a real audit trail	Service binding + role collections
3	SAP AI Core	LLM judges, AI-written reports, Detect Issues	Destination service + Settings
4	Model prices	Cost per agent, model and use case	Settings → price table
5	Judge prompts	What the LLM judges check	Settings → judges
6	Environments	Dev → QA → Prod and production guardrails	Landscape
7	Joule	Using your agents and approved assets from Joule	SAP BTP + Joule, and each user's profile
8	Your agents	Telemetry flowing in	Each agent's OTLP exporter

1. Database (SAP HANA Cloud)

In production the backend stores everything in SAP HANA Cloud. Bind your HANA Cloud instance to the app; the binding supplies the connection. Outside BTP, set DATABASE_URL instead (see Installation). Tables are created on first start.

2. Sign-in and roles (SAP BTP XSUAA)

1. Create an XSUAA service instance from the app's security descriptor (six scopes, four role templates) and bind it to the app. The BTP approuter signs people in before the app loads.
2. In your subaccount, open Security → Role Collections and add users, or your identity provider's groups, to the role collection for each role: Agent Engineer, FinOps Controller, Platform Operator, Release Approver.

Until XSUAA is bound, the backend runs in local-development mode: everyone has every scope and actions are recorded as dev@localhost. Bind it before real users arrive, because audit entries recorded without it cannot be re-attributed later. See Roles & scopes and How approval works.

3. SAP AI Core

Boidra Platform calls SAP AI Core for its LLM-assisted features: the LLM judges in Evaluation, the AI-written usage reports, and Detect Issues. It reaches AI Core through the SAP BTP Destination service, so no AI Core credentials are stored in Boidra.

1. Bind the Destination service to the app.

2. Create a destination for AI Core in your subaccount (Connectivity → Destinations), using the values from your AI Core service key, the standard SAP way:

   Field	Value
   Name	AICORE (the default the platform looks for)
   Type	HTTP
   URL	Your AI Core API URL (AI_API_URL from the service key)
   Authentication	OAuth2ClientCredentials
   Client ID / Client Secret	clientid / clientsecret from the service key
   Token Service URL	The service key's url + /oauth/token

3. Open Settings in Boidra Platform and set the AI Core destination name and the resource group your models are deployed in.

Until this is done, the LLM-assisted features return 503 (AI Core not configured); everything else works. AI Core's foundation-model catalog also gives the platform model versions and retirement dates, so it can warn when an agent calls a model that is about to be retired.

4. Model prices

Cost is calculated from token counts and the price table on the Settings page. Check the prices for the models your agents use so that cost per agent and per use case, the spend charts and budget alerts match what you pay. See Snapshots & Usage.

5. Judge prompts

Each LLM judge (for example safety, correctness and tool-call correctness) is backed by a built-in prompt that you can edit on the Settings page, so judges check against your own standards. Evaluation is still in development; see Evaluation.

6. Environments (Landscape)

Define the environments your agents move through, for example Dev, QA and Prod, on the Landscape screen, and mark which ones are production. Destructive actions in a production environment ask you to type its name to confirm; see How approval works.

Agents that report in before they are assigned land in Unassigned, where they stay visible until someone maps them to an environment; nothing is dropped.

7. Joule

Boidra Platform does not change Joule. There are two separate connections:

Make an agent available in Joule (done in SAP). Use SAP's standard Bring Your Own Agent flow over the A2A protocol:

1. The agent publishes an Agent Card (/.well-known/agent.json) describing its skills.
2. Create a BTP destination that points at the agent, so Joule reaches it without credentials in its own configuration.
3. Call the agent from a Joule dialog function (action type agent-request) that references that destination.

A worked example with a real agent is in our article Connect any agent to SAP Joule with A2A. Once the agent is instrumented, every Joule conversation that reaches it shows up in Boidra Platform.

Connect Joule Work for installed assets (done by each user). People connect their own Joule Work account from their profile in the AI Asset Dashboard, so assets they install are available where they work. See Role-based suggestions.

8. Your agents

Point each agent's OpenTelemetry exporter at the platform:

export OTEL_EXPORTER_OTLP_ENDPOINT="https://<your-boidra-host>/otel"

The Instrumentation overview covers the SAP Cloud SDK for Python and JavaScript, the OpenTelemetry SDK and raw OTLP.

Check it works

• The Summary page shows your agents once their first spans arrive.
• Detect Issues or a judge run returns a result instead of 503: AI Core is connected.
• A person with only the FinOps Controller role sees an Approve button disabled with "requires the Release Approver role": XSUAA and roles are working.