SAP BTP Best Practices
Related Skills
- sap-btp-cloud-platform: Use for technical implementation details, CLI commands, and runtime configurations
- sap-btp-connectivity: Use for connectivity patterns, destination configuration, and Cloud Connector setup
- sap-btp-service-manager: Use for service lifecycle management and programmatic service operations
- sap-btp-developer-guide: Use for development workflows, CAP integration, and application patterns
- sap-cap-capire: Use when designing CAP applications on BTP or implementing multitenancy
- sap-ai-core: Use for AI Core platform setup, model deployment, and orchestration configuration
- sap-cloud-sdk-ai: Use for SDK-level AI integration in CAP or standalone BTP applications
- sap-fiori-tools: Use for UI deployment strategies and frontend application guidelines
When to Use This Skill
Use this skill when designing a BTP account model, setting up governance, choosing commercial/environment patterns, establishing security and authentication defaults, designing CI/CD and operations practices, or reviewing a BTP landscape before implementation.
Quick Start
- Identify the target account model: global account, directories, subaccounts, environments, and regions.
- Choose the runtime path: Cloud Foundry, Kyma, ABAP Environment, or a hybrid portfolio.
- Apply security defaults from Security and Authentication.
- Use the relevant implementation skill for detailed execution:
sap-btp-cloud-platform, sap-btp-connectivity, sap-btp-service-manager, sap-cap-capire, or sap-fiori-tools.
- Record production-specific gaps in the project plan before changing
last_verified.
Documentation-audited SAP BTP implementation guidance based on official SAP documentation. The last_verified date remains stale until the source refresh and any live account checks are completed.
Quick Links:
Table of Contents
- Platform Fundamentals
- Account Model Setup
- Security and Authentication
- Connectivity
- Governance and Teams
- Development
- AI Development
- Deployment and Delivery
- High Availability and Failover
- Operations and Monitoring
- Cost Management
- Bundled Resources
Platform Fundamentals
Account Hierarchy
Global Account (SAP contract)
├── Directory (optional, up to 7 levels)
│ └── Subaccount (region-specific, apps run here)
│ ├── Cloud Foundry Org → Spaces
│ └── Kyma Cluster → Namespaces
└── Subaccount
Key Points:
- Global account = contract with SAP (one per commercial model)
- Directory = groups subaccounts (max 7 levels deep)
- Subaccount = deployed in specific region, enables runtimes
- Use labels for virtual grouping (Dev/Test/Prod, cost centers)
Environments
| Environment |
Use Case |
Key Features |
| Cloud Foundry |
Polyglot apps |
Multiple buildpacks, spaces |
| Kyma |
Cloud-native K8s |
Open-source, namespaces |
| ABAP |
ABAP extensions |
RAP, cloud-ready ABAP |
| Neo |
Legacy |
Migrate away - HTML5, Java, HANA XS |
Commercial Models
- Consumption-Based (BTPEA/CPEA): Flexible access, best for pilots
- Subscription-Based: Fixed-cost for known service needs
Best Practice: Start with consumption-based, move to subscription for stable workloads.
Account Model Setup
Simple Model (3 subaccounts)
Global Account
├── Dev Subaccount
├── Test Subaccount
└── Prod Subaccount
Best for: Initial implementations, single team, <3 projects
Directory Model (scalable)
Global Account
├── Directory: HR
│ ├── hr-dev / hr-test / hr-prod
├── Directory: Sales
│ ├── sales-dev / sales-test / sales-prod
└── Directory: Central IT
├── api-management
└── shared-services
Best for: Multiple teams, cost allocation, complex governance
Naming Conventions
| Entity |
Convention |
Example |
| Subaccount |
Natural language |
"HR Development" |
| Subdomain |
Lowercase, hyphens |
hr-dev-acme |
| CF Org |
Company prefix |
acme-hr-dev |
| CF Space |
Consistent across stages |
hr-recruiting |
Tip: Derive CF org/Kyma names from subaccount names for consistency.
Security and Authentication
Identity Provider Setup
Always use SAP Cloud Identity Services - Identity Authentication
Corporate IdP → Identity Authentication (proxy) → SAP BTP
Critical Steps:
- Add multiple administrators (different time zones)
- Enable MFA for all admins
- Configure security alerts
- Set up backup admins in SAP ID Service
Authorization Methods
| Method |
Best For |
Notes |
| Provisioning |
Production, many users |
Centralized roles, automated offboarding |
| Federation |
Simple scenarios |
Real-time sync, but doesn't scale well |
| Manual |
Testing only |
Quick setup, not production-ready |
Destination Authentication
Recommended:
PrincipalPropagation - SAP on-premise systemsOAuth2SAMLBearerAssertion - Third-party systemsOAuth2JWTBearer - User token exchange
Avoid in Production:
BasicAuthenticationOAuth2Password
See: references/security-and-authentication.md for complete guidance
Connectivity
Remote System Access
- Internet Services: Destinations with authentication
- On-Premise Systems: Destinations + Cloud Connector
Cloud Connector
- Lightweight on-premise agent
- Secure tunnel to SAP BTP (no inbound ports)
- Fine-grained access control
- Supports RFC and HTTP protocols
- Enables principal propagation
Note: Each subaccount needs separate Cloud Connector config.
Governance and Teams
Required Teams
Platform Engineering Team (Center of Excellence):
- Manages cloud landscape infrastructure
- Handles account operations, build infrastructure
- Creates governance and compliance guidelines
- Does NOT manage individual application lifecycles
Cloud Development Teams:
- Follow DevOps (develop AND operate)
- Responsible for application lifecycle
- Regular maintenance (e.g., UI updates every 6 months)
Essential Documentation
- Onboarding Doc: Organization, app IDs, timeline, tech stack
- Security Doc: Data sensitivity, policies, auth framework
- Services Catalog: Templates for destinations, builds, schemas
Development
Programming Models
SAP CAP (Cloud Application Programming Model):
- Framework with languages, libraries, tools
- Supports Java, JavaScript, TypeScript
- Enterprise-grade services and data models
ABAP Cloud:
- Modern ABAP for cloud-ready apps
- RAP (RESTful ABAP Programming Model)
- Extensions for ABAP-based products
Development Lifecycle
- Explore: Business opportunity, team roles
- Discover: Use cases, technology options
- Design: UX design, domain-driven design
- Deliver: Landscape setup, development
- Run and Scale: Feedback, optimization
AI Development
SAP BTP provides AI capabilities through SAP AI Core for:
- Generative AI (LLMs, RAG)
- Narrow AI (classical ML)
Key Resources:
Best Practices:
- Use service keys for secure authentication
- Implement PII data masking
- Build RAG with SAP HANA Cloud Vector Engine
- Configure content filtering
- Monitor model drift
Use Cases: 20+ samples including chatbots, PDF extraction, procurement.
CAP + AI Integration Patterns:
- Use SAP Cloud SDK for AI (
@sap-ai-sdk/orchestration) inside CAP event handlers — never raw HTTP calls to LLM providers
- Bind AI Core service instance to CAP app via MTA (plan:
extended) — credentials are managed by BTP, not in code
- Always process LLM calls asynchronously in production: return
202 Accepted, process in background via cds.spawn. LLM responses can take 30-60 seconds, exceeding BTP load balancer timeouts
- Externalize prompts into JSON files or CDS entities so they can be updated without redeployment
- Use HANA Cloud
Vector(1536) type in CDS entities for RAG scenarios with the HANA Vector Engine
- Allocate at least 512MB memory for Node.js containers processing large text payloads with the AI SDK
- Implement resilience: validate LLM outputs before writing to the database (prevent injection attacks), cache frequent responses for cost control
See: references/ai-development-best-practices.md for patterns and examples. For CAP-specific code patterns, see sap-cap-capire skill. For SDK integration, see sap-cloud-sdk-ai skill.
Deployment and Delivery
Deployment Methods
Cloud Foundry/Neo:
- Package as MTA archive
- Deploy via: BTP Cockpit, CF CLI, Business Application Studio
Kyma:
- Docker images (Dockerfile or Cloud Native Buildpacks)
- Helm charts for production
- Deploy via SAP Continuous Integration and Delivery
CI/CD Approaches
SAP Continuous Integration and Delivery:
- Low expertise required
- Ready-to-use infrastructure
- Direct SAP support
Project "Piper":
- High expertise required
- Jenkins-based
- Open-source community support
Best Practice: Combine CI/CD with SAP Cloud Transport Management for governance + agility.
See: references/deployment-and-delivery.md for detailed configs
High Availability and Failover
Multi-Region Architecture
Custom Domain URL
│
Load Balancer
├── Region 1 (active)
└── Region 2 (passive/active)
Failover Implementation
Four Core Principles:
- Deploy in Two Regions: Near users and backend systems
- Keep Synced: CI/CD pipeline or Cloud Transport Management
- Define Detection: Monitor 5xx errors, timeouts
- Plan Failback: Visual differentiation, user-driven
Legal: Check cross-region data processing restrictions.
See: references/failover-and-resilience.md for implementation details
Operations and Monitoring
Go-Live Checklist
- Deploy to production
- Set go-live timeframe (avoid quarter-end)
- Embed in SAP Fiori Launchpad
- Provision business users
- Configure role collections
Monitoring Tools
SAP Cloud ALM (Enterprise Support):
- Real User Monitoring
- Health Monitoring
- Integration and Exception Monitoring
- Job Automation Monitoring
SAP Cloud Logging:
- Observability across CF, Kyma, Kubernetes
SAP Alert Notification:
- Multi-channel notifications (email, chat, ticketing)
Cost Management
Best Practices
- Check Costs and Usage monthly
- Provide minimal required entitlements
- Use labels for cost allocation
- Set up automated alerts (Usage Data Management + Alert Notification)
Contract Strategies
- Consolidate subscriptions in one global account
- Use hybrid accounts for mixed workloads
- Note: Consumption credits non-transferable between global accounts
Bundled Resources
This skill provides comprehensive reference documentation:
Account & Governance
Security & Connectivity
references/security-and-authentication.md (13K lines)
- Complete auth methods comparison
- Destination configuration
- Kyma RBAC manifests
- Identity lifecycle management
Deployment & Operations
High Availability
references/failover-and-resilience.md (12K lines)
- Multi-region architecture
- Load balancer configurations
- Failover automation scripts
Templates & Examples
references/templates-and-examples.md (18K lines)
- Complete code templates
- Kubernetes RBAC manifests
- MTA descriptors
- Helm charts
- CI/CD configs
AI Development
references/ai-development-best-practices.md (6K lines)
- Generative AI patterns
- RAG implementation
- 20+ use cases catalog
Progress Tracking
- Implementation status
- Coverage details
- Validation checklists
Administration Tools
| Tool |
Use Case |
| SAP BTP Cockpit |
GUI for all admin tasks |
| btp CLI |
Terminal/automation scripting |
| REST APIs |
Programmatic administration |
| Terraform Provider |
Infrastructure as Code |
| SAP Automation Pilot |
Low-code/no-code automation |
Shared Responsibility Model
SAP Manages:
- Platform software updates/patches
- Infrastructure and OS monitoring
- BTP service monitoring
- Capacity management and incidents
- Global account provisioning
- HANA database operations
- Kyma
kyma-system namespace
You Manage:
- Global account strategy and subaccount config
- Application development, deployment, security
- Role assignments and integrations
- Application monitoring and health checks
- Open source vulnerability scanning
- Triggering HANA revision updates
Last Updated: 2026-06-16
Review Progress: See SAP_SKILLS_REVIEW_PROGRESS.md
Next Review: Source refresh pending; do not advance last_verified without primary-source evidence.
1---2name: sap-btp-best-practices3description: SAP BTP best practices for enterprise architecture, account management, security, and operations, with verification evidence tracked in the repository ledger. Use when planning BTP implementations, setting up account hierarchies, configuring environments, implementing authentication, designing CI/CD pipelines, establishing governance, building Platform Engineering teams, implementing failover strategies, or managing application lifecycle on SAP BTP. Keywords: SAP BTP, account hierarchy, global account, directory, subaccount, Cloud Foundry, Kyma, ABAP, SAP Identity Authentication, CI/CD, governance, Platform Engineering, failover, multi-region, SAP BTP best practices4license: GPL-3.05---6
7# SAP BTP Best Practices
8
9## Related Skills
10
11- **sap-btp-cloud-platform**: Use for technical implementation details, CLI commands, and runtime configurations
12- **sap-btp-connectivity**: Use for connectivity patterns, destination configuration, and Cloud Connector setup
13- **sap-btp-service-manager**: Use for service lifecycle management and programmatic service operations
14- **sap-btp-developer-guide**: Use for development workflows, CAP integration, and application patterns
15- **sap-cap-capire**: Use when designing CAP applications on BTP or implementing multitenancy
16- **sap-ai-core**: Use for AI Core platform setup, model deployment, and orchestration configuration
17- **sap-cloud-sdk-ai**: Use for SDK-level AI integration in CAP or standalone BTP applications
18- **sap-fiori-tools**: Use for UI deployment strategies and frontend application guidelines
19
20## When to Use This Skill
21
22Use this skill when designing a BTP account model, setting up governance, choosing commercial/environment patterns, establishing security and authentication defaults, designing CI/CD and operations practices, or reviewing a BTP landscape before implementation.
23
24## Quick Start
25
261. Identify the target account model: global account, directories, subaccounts, environments, and regions.
272. Choose the runtime path: Cloud Foundry, Kyma, ABAP Environment, or a hybrid portfolio.
283. Apply security defaults from [Security and Authentication](#security-and-authentication).
294. Use the relevant implementation skill for detailed execution: `sap-btp-cloud-platform`, `sap-btp-connectivity`, `sap-btp-service-manager`, `sap-cap-capire`, or `sap-fiori-tools`.
305. Record production-specific gaps in the project plan before changing `last_verified`.
31
32Documentation-audited SAP BTP implementation guidance based on official SAP documentation. The `last_verified` date remains stale until the source refresh and any live account checks are completed.
33
34**Quick Links**:
35- **Official Guide**: [https://github.com/SAP-docs/btp-best-practices-guide](https://github.com/SAP-docs/btp-best-practices-guide)
36- **SAP Help Portal**: [https://help.sap.com/docs/btp/btp-administrators-guide](https://help.sap.com/docs/btp/btp-administrators-guide)
37
38---
39
40## Table of Contents
41
421. [Platform Fundamentals](#platform-fundamentals)
432. [Account Model Setup](#account-model-setup)
443. [Security and Authentication](#security-and-authentication)
454. [Connectivity](#connectivity)
465. [Governance and Teams](#governance-and-teams)
476. [Development](#development)
487. [AI Development](#ai-development)
498. [Deployment and Delivery](#deployment-and-delivery)
509. [High Availability and Failover](#high-availability-and-failover)
5110. [Operations and Monitoring](#operations-and-monitoring)
5211. [Cost Management](#cost-management)
5312. [Bundled Resources](#bundled-resources)
54
55---
56
57## Platform Fundamentals
58
59### Account Hierarchy
60
61```
62Global Account (SAP contract)
63├── Directory (optional, up to 7 levels)
64│ └── Subaccount (region-specific, apps run here)
65│ ├── Cloud Foundry Org → Spaces
66│ └── Kyma Cluster → Namespaces
67└── Subaccount
68```
69
70**Key Points**:
71- Global account = contract with SAP (one per commercial model)
72- Directory = groups subaccounts (max 7 levels deep)
73- Subaccount = deployed in specific region, enables runtimes
74- Use labels for virtual grouping (Dev/Test/Prod, cost centers)
75
76### Environments
77
78| Environment | Use Case | Key Features |
79|-------------|----------|--------------|
80| **Cloud Foundry** | Polyglot apps | Multiple buildpacks, spaces |
81| **Kyma** | Cloud-native K8s | Open-source, namespaces |
82| **ABAP** | ABAP extensions | RAP, cloud-ready ABAP |
83| **Neo** | Legacy | **Migrate away** - HTML5, Java, HANA XS |
84
85### Commercial Models
86
87- **Consumption-Based** (BTPEA/CPEA): Flexible access, best for pilots
88- **Subscription-Based**: Fixed-cost for known service needs
89
90**Best Practice**: Start with consumption-based, move to subscription for stable workloads.
91
92---
93
94## Account Model Setup
95
96### Simple Model (3 subaccounts)
97```
98Global Account
99├── Dev Subaccount
100├── Test Subaccount
101└── Prod Subaccount
102```
103Best for: Initial implementations, single team, <3 projects
104
105### Directory Model (scalable)
106```
107Global Account
108├── Directory: HR
109│ ├── hr-dev / hr-test / hr-prod
110├── Directory: Sales
111│ ├── sales-dev / sales-test / sales-prod
112└── Directory: Central IT
113 ├── api-management
114 └── shared-services
115```
116Best for: Multiple teams, cost allocation, complex governance
117
118### Naming Conventions
119
120| Entity | Convention | Example |
121|--------|------------|---------|
122| Subaccount | Natural language | "HR Development" |
123| Subdomain | Lowercase, hyphens | `hr-dev-acme` |
124| CF Org | Company prefix | `acme-hr-dev` |
125| CF Space | Consistent across stages | `hr-recruiting` |
126
127**Tip**: Derive CF org/Kyma names from subaccount names for consistency.
128
129---
130
131## Security and Authentication
132
133### Identity Provider Setup
134
135**Always use SAP Cloud Identity Services - Identity Authentication**
136
137```
138Corporate IdP → Identity Authentication (proxy) → SAP BTP
139```
140
141**Critical Steps**:
1421. Add multiple administrators (different time zones)
1432. Enable MFA for all admins
1443. Configure security alerts
1454. Set up backup admins in SAP ID Service
146
147### Authorization Methods
148
149| Method | Best For | Notes |
150|--------|----------|-------|
151| **Provisioning** | Production, many users | Centralized roles, automated offboarding |
152| **Federation** | Simple scenarios | Real-time sync, but doesn't scale well |
153| **Manual** | Testing only | Quick setup, not production-ready |
154
155### Destination Authentication
156
157**Recommended**:
158- `PrincipalPropagation` - SAP on-premise systems
159- `OAuth2SAMLBearerAssertion` - Third-party systems
160- `OAuth2JWTBearer` - User token exchange
161
162**Avoid in Production**:
163- `BasicAuthentication`
164- `OAuth2Password`
165
166**See**: `references/security-and-authentication.md` for complete guidance
167
168---
169
170## Connectivity
171
172### Remote System Access
173
174- **Internet Services**: Destinations with authentication
175- **On-Premise Systems**: Destinations + Cloud Connector
176
177### Cloud Connector
178
179- Lightweight on-premise agent
180- Secure tunnel to SAP BTP (no inbound ports)
181- Fine-grained access control
182- Supports RFC and HTTP protocols
183- Enables principal propagation
184
185**Note**: Each subaccount needs separate Cloud Connector config.
186
187---
188
189## Governance and Teams
190
191### Required Teams
192
193**Platform Engineering Team (Center of Excellence)**:
194- Manages cloud landscape infrastructure
195- Handles account operations, build infrastructure
196- Creates governance and compliance guidelines
197- **Does NOT** manage individual application lifecycles
198
199**Cloud Development Teams**:
200- Follow DevOps (develop AND operate)
201- Responsible for application lifecycle
202- Regular maintenance (e.g., UI updates every 6 months)
203
204### Essential Documentation
205
2061. **Onboarding Doc**: Organization, app IDs, timeline, tech stack
2072. **Security Doc**: Data sensitivity, policies, auth framework
2083. **Services Catalog**: Templates for destinations, builds, schemas
209
210---
211
212## Development
213
214### Programming Models
215
216**SAP CAP (Cloud Application Programming Model)**:
217- Framework with languages, libraries, tools
218- Supports Java, JavaScript, TypeScript
219- Enterprise-grade services and data models
220
221**ABAP Cloud**:
222- Modern ABAP for cloud-ready apps
223- RAP (RESTful ABAP Programming Model)
224- Extensions for ABAP-based products
225
226### Development Lifecycle
227
2281. **Explore**: Business opportunity, team roles
2292. **Discover**: Use cases, technology options
2303. **Design**: UX design, domain-driven design
2314. **Deliver**: Landscape setup, development
2325. **Run and Scale**: Feedback, optimization
233
234---
235
236## AI Development
237
238SAP BTP provides AI capabilities through **SAP AI Core** for:
239- **Generative AI** (LLMs, RAG)
240- **Narrow AI** (classical ML)
241
242**Key Resources**:
243- Repository: [SAP-samples/sap-btp-ai-best-practices](https://github.com/SAP-samples/sap-btp-ai-best-practices)
244- Documentation: [https://btp-ai-bp.docs.sap/](https://btp-ai-bp.docs.sap/)
245
246**Best Practices**:
247- Use service keys for secure authentication
248- Implement PII data masking
249- Build RAG with SAP HANA Cloud Vector Engine
250- Configure content filtering
251- Monitor model drift
252
253**Use Cases**: 20+ samples including chatbots, PDF extraction, procurement.
254
255**CAP + AI Integration Patterns**:
256- Use SAP Cloud SDK for AI (`@sap-ai-sdk/orchestration`) inside CAP event handlers — never raw HTTP calls to LLM providers
257- Bind AI Core service instance to CAP app via MTA (plan: `extended`) — credentials are managed by BTP, not in code
258- Always process LLM calls asynchronously in production: return `202 Accepted`, process in background via `cds.spawn`. LLM responses can take 30-60 seconds, exceeding BTP load balancer timeouts
259- Externalize prompts into JSON files or CDS entities so they can be updated without redeployment
260- Use HANA Cloud `Vector(1536)` type in CDS entities for RAG scenarios with the HANA Vector Engine
261- Allocate at least **512MB** memory for Node.js containers processing large text payloads with the AI SDK
262- Implement resilience: validate LLM outputs before writing to the database (prevent injection attacks), cache frequent responses for cost control
263
264**See**: `references/ai-development-best-practices.md` for patterns and examples. For CAP-specific code patterns, see **sap-cap-capire** skill. For SDK integration, see **sap-cloud-sdk-ai** skill.
265
266---
267
268## Deployment and Delivery
269
270### Deployment Methods
271
272**Cloud Foundry/Neo**:
273- Package as MTA archive
274- Deploy via: BTP Cockpit, CF CLI, Business Application Studio
275
276**Kyma**:
277- Docker images (Dockerfile or Cloud Native Buildpacks)
278- Helm charts for production
279- Deploy via SAP Continuous Integration and Delivery
280
281### CI/CD Approaches
282
283**SAP Continuous Integration and Delivery**:
284- Low expertise required
285- Ready-to-use infrastructure
286- Direct SAP support
287
288**Project "Piper"**:
289- High expertise required
290- Jenkins-based
291- Open-source community support
292
293**Best Practice**: Combine CI/CD with SAP Cloud Transport Management for governance + agility.
294
295**See**: `references/deployment-and-delivery.md` for detailed configs
296
297---
298
299## High Availability and Failover
300
301### Multi-Region Architecture
302
303```
304Custom Domain URL
305 │
306 Load Balancer
307 ├── Region 1 (active)
308 └── Region 2 (passive/active)
309```
310
311### Failover Implementation
312
313**Four Core Principles**:
314
3151. **Deploy in Two Regions**: Near users and backend systems
3162. **Keep Synced**: CI/CD pipeline or Cloud Transport Management
3173. **Define Detection**: Monitor 5xx errors, timeouts
3184. **Plan Failback**: Visual differentiation, user-driven
319
320**Legal**: Check cross-region data processing restrictions.
321
322**See**: `references/failover-and-resilience.md` for implementation details
323
324---
325
326## Operations and Monitoring
327
328### Go-Live Checklist
329
3301. Deploy to production
3312. Set go-live timeframe (avoid quarter-end)
3323. Embed in SAP Fiori Launchpad
3334. Provision business users
3345. Configure role collections
335
336### Monitoring Tools
337
338**SAP Cloud ALM** (Enterprise Support):
339- Real User Monitoring
340- Health Monitoring
341- Integration and Exception Monitoring
342- Job Automation Monitoring
343
344**SAP Cloud Logging**:
345- Observability across CF, Kyma, Kubernetes
346
347**SAP Alert Notification**:
348- Multi-channel notifications (email, chat, ticketing)
349
350---
351
352## Cost Management
353
354### Best Practices
355
3561. Check *Costs and Usage* monthly
3572. Provide minimal required entitlements
3583. Use labels for cost allocation
3594. Set up automated alerts (Usage Data Management + Alert Notification)
360
361### Contract Strategies
362
363- Consolidate subscriptions in one global account
364- Use hybrid accounts for mixed workloads
365- Note: Consumption credits non-transferable between global accounts
366
367---
368
369## Bundled Resources
370
371This skill provides comprehensive reference documentation:
372
373### Account & Governance
374- **`references/account-models.md`** (11K lines)
375 - Detailed account structure patterns
376 - Naming conventions and examples
377 - Cost allocation strategies
378
379- **`references/governance-and-teams.md`** (13K lines)
380 - Platform Engineering team structure
381 - Onboarding processes
382 - Documentation templates
383
384### Security & Connectivity
385- **`references/security-and-authentication.md`** (13K lines)
386 - Complete auth methods comparison
387 - Destination configuration
388 - Kyma RBAC manifests
389 - Identity lifecycle management
390
391### Deployment & Operations
392- **`references/deployment-and-delivery.md`** (10K lines)
393 - MTA descriptor templates
394 - CI/CD pipeline configs
395 - Transport management setup
396
397- **`references/operations-and-monitoring.md`** (11K lines)
398 - Go-live procedures
399 - Monitoring setup guides
400 - Troubleshooting checklists
401
402### High Availability
403- **`references/failover-and-resilience.md`** (12K lines)
404 - Multi-region architecture
405 - Load balancer configurations
406 - Failover automation scripts
407
408### Templates & Examples
409- **`references/templates-and-examples.md`** (18K lines)
410 - Complete code templates
411 - Kubernetes RBAC manifests
412 - MTA descriptors
413 - Helm charts
414 - CI/CD configs
415
416### AI Development
417- **`references/ai-development-best-practices.md`** (6K lines)
418 - Generative AI patterns
419 - RAG implementation
420 - 20+ use cases catalog
421
422### Progress Tracking
423 - Implementation status
424 - Coverage details
425 - Validation checklists
426
427---
428
429## Administration Tools
430
431| Tool | Use Case |
432|------|----------|
433| **SAP BTP Cockpit** | GUI for all admin tasks |
434| **btp CLI** | Terminal/automation scripting |
435| **REST APIs** | Programmatic administration |
436| **Terraform Provider** | Infrastructure as Code |
437| **SAP Automation Pilot** | Low-code/no-code automation |
438
439---
440
441## Shared Responsibility Model
442
443**SAP Manages**:
444- Platform software updates/patches
445- Infrastructure and OS monitoring
446- BTP service monitoring
447- Capacity management and incidents
448- Global account provisioning
449- HANA database operations
450- Kyma `kyma-system` namespace
451
452**You Manage**:
453- Global account strategy and subaccount config
454- Application development, deployment, security
455- Role assignments and integrations
456- Application monitoring and health checks
457- Open source vulnerability scanning
458- Triggering HANA revision updates
459
460---
461
462**Last Updated**: 2026-06-16
463**Review Progress**: See SAP_SKILLS_REVIEW_PROGRESS.md
464**Next Review**: Source refresh pending; do not advance `last_verified` without primary-source evidence.
secondsky