DecionisDevelopers
Policy pack

SAP Execution Authority

Dual-gate governance for SAP ERP actions — state admission (completeness, budget, vendor, cost center) and execution authority (role, segregation of duties, regional holds, payment thresholds) before they execute.

Key
sap
Version
sap-procurement-v2
Rules
13
Domain
SAP_EXECUTION_AUTHORITY
Every packHow a pack decides

Rules, in the order the evaluator tries them

Highest priority first. The first rule whose conditions all hold decides; with none, the decision is a REVIEW.

  1. Duplicate vendor payment suspected

    priority 210

    exec-duplicate-payment · *

    When
    • gate = "execution_authority"
    • duplicate_suspected = true
    Then

    AUTO_REJECT → REJECT · urgent

    A prior payment with the same vendor + amount fingerprint was found.

  2. Required SAP state fields present

    priority 200

    state-required-fields · *

    When
    • gate = "state_admission"
    • missing_required_fields > 0
    Then

    AUTO_REJECT → REJECT · urgent

    PO state is incomplete; required fields must be present before admission.

  3. Actor holds an authorized SAP role

    priority 200

    exec-authorized-role · *

    When
    • gate = "execution_authority"
    • actor_authorized = false
    Then

    AUTO_REJECT → REJECT · urgent

    Actor role is not authorized for governed SAP execution.

  4. Purchase order amount is valid

    priority 195

    state-amount-valid · *

    When
    • gate = "state_admission"
    • amount_invalid = true
    Then

    AUTO_REJECT → REJECT · urgent

    Purchase order amount must be a positive numeric value.

  5. Segregation of duties enforced

    priority 195

    exec-segregation-of-duties · *

    When
    • gate = "execution_authority"
    • sod_violation = true
    Then

    AUTO_REJECT → REJECT · urgent

    Segregation-of-duties check failed because requester and approver match.

  6. Purchase order within approved budget

    priority 190

    state-within-budget · *

    When
    • gate = "state_admission"
    • over_budget = true
    Then

    AUTO_REJECT → REJECT · urgent

    Purchase order amount exceeds the approved budget on the SAP state.

  7. Vendor is verified

    priority 185

    state-vendor-verified · *

    When
    • gate = "state_admission"
    • vendor_verified = false
    Then

    AUTO_REJECT → REJECT · urgent

    Vendor is not verified for governed purchase order execution.

  8. Cost center is valid

    priority 180

    state-cost-center-valid · *

    When
    • gate = "state_admission"
    • cost_center_valid = false
    Then

    AUTO_REJECT → REJECT · urgent

    Cost center is invalid or not eligible for this purchase order.

  9. Three-way match before payment release

    priority 175

    exec-three-way-match · *

    When
    • gate = "execution_authority"
    • three_way_match_failed = true
    Then

    REQUIRE_REVIEW → REVIEW · elevated · SLA 120 min

    Goods receipt does not confirm the invoiced quantity/amount; hold payment until the PO, goods receipt, and invoice reconcile.

  10. Regional compliance hold

    priority 170

    exec-regional-hold · *

    When
    • gate = "execution_authority"
    • regional_hold = true
    Then

    REQUIRE_REVIEW → REVIEW · elevated · SLA 60 min

    Regional constraint requires a revisit trigger before SAP execution.

  11. High-value PO requires Treasury Head approval

    priority 160

    exec-treasury-threshold · *

    When
    • gate = "execution_authority"
    • po_over_threshold = true
    • treasury_approved = false
    Then

    ESCALATE → ESCALATE · urgent · SLA 10 min

    PO amount exceeds threshold and Treasury Head approval is missing.

  12. Admit a clean SAP state

    priority 1

    state-admit-default · *

    When
    • gate = "state_admission"
    Then

    AUTO_APPROVE → APPROVE

    SAP proposed state is complete, non-conflicting, and eligible for execution review.

  13. Authorize a clean SAP execution

    priority 1

    exec-authorize-default · *

    When
    • gate = "execution_authority"
    Then

    AUTO_APPROVE → APPROVE

    Execution authority is present for the proposed SAP action.

Evaluate under it

Locally, with @decionis/mcp: the payload becomes the request's context, and its action the decision type. On the hosted protocol, once the bundle is stored for your organization, name vertical_pack, policy_version and require_exact_policy_version: true.

decionis_evaluate arguments

{ "policy_pack": "sap", "payload": { "action": "<decision type>" } }

In a hosted evaluate-decision request

"vertical_pack": "sap",
"policy_version": "sap-procurement-v2",
"require_exact_policy_version": true

What its rules read

Every fact below comes from the request's context.

  • actor_authorized
  • amount_invalid
  • cost_center_valid
  • duplicate_suspected
  • gate
  • missing_required_fields
  • over_budget
  • po_over_threshold
  • regional_hold
  • sod_violation
  • three_way_match_failed
  • treasury_approved
  • vendor_verified

Signals it maps

  • sap_state_completeness_ratesap_s4hana
  • sap_unauthorized_execution_ratesap_s4hana