# SAP BW/4HANA private AI layer blueprint generator

> Source: https://netray.co/tools/sap-bw4hana-private-ai-layer-blueprint-generator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Fill in your version, database, hosting and use cases to get an architecture plan for adding a private, on-prem AI assistant to SAP BW/4HANA, with components, security controls and a three-phase rollout.

## Category

sap

## Erp

SAP BW/4HANA

## Audience

- CIO
- IT architect
- SAP Basis lead
- Security officer

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### System version

**Key:** version

**Type:** select

**Options:**

- SAP BW 7.5 on HANA
- SAP BW 7.5 on another database
- SAP BW/4HANA 1.0
- SAP BW/4HANA 2.0

**Default:** SAP BW/4HANA 2.0

#### Database engine

**Key:** database

**Type:** select

**Options:**

- SAP HANA
- Oracle
- Microsoft SQL Server
- IBM DB2

**Default:** SAP HANA

#### Hosting

**Key:** hosting

**Type:** select

**Options:**

- On-prem server
- Private cloud
- Air-gapped

**Default:** On-prem server

#### Named users

**Key:** users

**Type:** text

**Default:** 120

#### Sites or plants

**Key:** sites

**Type:** text

**Default:** Group reporting, 4 plants

#### Main use cases

**Key:** usecases

**Type:** textarea

**Default:** Natural-language lookup of trusted queries, scrap and OTD by plant, cost centre variance explanations, KPI definition search

#### Data that must never leave the site

**Key:** neverleave

**Type:** textarea

**Default:** Individual salary data, consolidated results before release, customer-level margins

#### GPU available

**Key:** gpu

**Type:** select

**Options:**

- No GPU yet
- One 24 to 48 GB GPU
- Two to four data-centre GPUs
- Eight or more GPUs

**Default:** Two to four data-centre GPUs

#### Target go-live

**Key:** golive

**Type:** date

**Default:** 2027-03-31

**Blocks:**

#### Private AI Layer Architecture Plan: SAP BW/4HANA

**Body:** Prepared for: {{company}}
System: {{version}} on {{database}}
Hosting: {{hosting}}
Named users: {{users}}
Sites: {{sites}}
Target go-live: {{golive}}

#### Context and scope

**Body:** {{company}} runs {{version}} and wants an AI assistant that works on its own data without moving that data to an external service. The assistant is read-only first, answers with cited records, and writes back only through supported interfaces after human approval.

Main use cases:
{{usecases}}

Data that must never leave the site:
{{neverleave}}

#### Components

**Table:**

**Columns:**

- Component
- Design
- Notes

**Rows:**

**0:** Data access path

**1:** Existing BW queries on CompositeProviders and aDSOs, exposed through OData (Easy Query where available), MDX/XMLA, or generated external HANA views

**2:** Queries carry business logic and analysis authorizations; avoid SQL on base tables

**0:** Reporting copy

**1:** None for governed queries; optional ODP-based extraction of approved providers for a separate analytics store

**2:** Only if live query load is a concern

**0:** Retrieval index

**1:** Metadata catalogue: query names, characteristics, key figures, units, variables, InfoObject texts, hierarchies and report documentation

**2:** Include data-as-of from process chain status

**0:** Model serving

**1:** Open-weight model on vLLM, {{gpu}}

**2:** Arithmetic is done in BW or code, not by the model

**0:** Tool server

**1:** Typed tools per governed query with variables, row caps and mandatory filters

**2:** Return tables plus narrative

**0:** Identity and permissions

**1:** SSO to BW user so the OLAP engine applies analysis authorizations (RSECADMIN); mirrored values only for replicated stores

**2:** Test with restricted analysts

**0:** Audit

**1:** Log of question, query, variables, row count and result hash

**2:** Keep for finance audit needs

#### Security controls mapped to your inputs

**Table:**

**Columns:**

- Control
- How it is met

**Rows:**

**0:** Data stays on site

**1:** Hosting: {{hosting}}. No dependency on external analytics or AI services.

**0:** Governed numbers

**1:** Only approved queries are tools, so numbers match the reports controlling already trusts.

**0:** Row-level access

**1:** Analysis authorizations applied per user for {{users}} named users; fail closed on unknown users.

**0:** Protected data

**1:** Excluded from tools and catalogue: {{neverleave}}

**0:** Read-only

**1:** No write-back; planning functions stay with planning users and their own front ends.

#### Three-phase rollout

**Table:**

**Columns:**

- Phase
- Scope
- Exit criteria

**Rows:**

**0:** 1. Read-only

**1:** Catalogue and natural-language lookup of existing queries and definitions

**2:** Answer accuracy on a fixed question set agreed with business owners; zero authorization leaks in testing

**0:** 2. Drafts

**1:** Governed query execution with narrative answers and data-as-of timestamps

**2:** Drafts accepted without edit at an agreed rate; audit log reviewed

**0:** 3. Approved actions

**1:** Scheduled summaries that analysts review before distribution

**2:** Approval workflow tested; rollback and idempotency verified

#### Open questions for IT

**Body:** 1. Which BW release and which exposure options (OData, MDX, HANA views) are enabled?
2. Which queries are trusted enough to become tools?
3. How are analysis authorizations structured and who maintains them?
4. Which queries are time dependent or use currency conversion that the narrative must mention?
5. How is data freshness exposed (process chains, load status)?
6. Which GPU option ({{gpu}}) fits the peak concurrency for {{users}} users? Use the sizing calculator to check.

#### Approvals

**Signatures:**

- Prepared by
- IT architecture
- Security officer
- Business owner

**Notes:** This is a planning starting point, not a design guarantee. Verify interface availability, object names and licence terms against your exact release and contract before building.

## Content

**Intro:** This generator turns a few facts about your SAP BW/4HANA landscape into a structured architecture plan for a private AI layer: data access path, reporting copy, retrieval index, model serving, tool server, identity and audit. Export it to PDF or Word and take it to your architecture and security review.

**Sections:**

#### How to use the generator

**Body:** Fill the ten fields on the left: company, version, database, hosting model, named users, sites, use cases, data that must never leave the site, GPU availability and target go-live. The plan updates as you type. Be specific in the use cases and protected-data boxes, because those drive the tool list and the exclusions the plan describes. Export the result and mark the open questions that your team cannot answer yet; those become the first workshop agenda.

**Bullets:**

- Pick the real version, since interfaces differ by release
- List protected data explicitly, one item per line
- Choose Air-gapped if no outbound internet is allowed
- Keep named users realistic, not the licence maximum

#### What the plan is built on

**Body:** Every plan follows the same private-AI pattern: read-only access first, a reporting copy or governed interface for heavy questions, a retrieval index over documents with ownership metadata, an open-weight model served locally with vLLM or Ollama, a tool server exposing named read actions, an identity layer that mirrors the system's own permissions, and an append-only audit log. The table rows are specific to SAP BW/4HANA: they name its real data access mechanisms rather than generic placeholders.

#### How to read and challenge the result

**Body:** Treat the components table as a hypothesis. Ask your SAP BW/4HANA administrators whether each named interface is enabled and licensed, whether the permission model can really be mirrored, and who owns each refresh job. Then walk the rollout table: each phase has exit criteria, and the next phase should not start until the criteria are met. The open-questions block is deliberately uncomfortable; unanswered items are where projects stall.

**Bullets:**

- Confirm licence terms for every data access path
- Test permissions with a restricted user, not an administrator
- Decide the audit retention period before go-live
- Plan for the next system upgrade from day one

#### Common mistakes

**Body:** The most common mistake is giving the model direct database access because it is quick in a demo. It skips the application's own authorization and business logic, and it is hard to defend in a security review. The second is skipping the document index metadata, so a retrieval hit shows content the user cannot open in the source system. The third is starting with write-back. Start read-only, measure accuracy, then add drafts, then approved actions.

**Cta:** If you want a second pair of eyes on the plan, Netray builds private AI layers on SAP BW/4HANA and similar on-prem systems and can review your draft with your IT team.

**Faq:**

#### Does the generated plan require any cloud service?

**Answer:** No. The plan assumes the model, index, tool server and audit log run on your own servers or in your private cloud, and the air-gapped option removes outbound internet entirely. You can still choose to use a cloud service for specific non-sensitive tasks, but the plan does not depend on one.

#### Is the plan accurate for my exact version?

**Answer:** It is a well-grounded starting point, not a guarantee. Interface availability, support package levels and licence terms vary. Verify each data access path with your administrators and the vendor documentation for your release before committing to a design.

#### Can I use this for a security review?

**Answer:** Yes, as input. The security controls table maps controls to your inputs, which gives reviewers a concrete starting point. They will add their own requirements, such as logging standards, key management and network segmentation.

#### What does the GPU choice change?

**Answer:** It changes which model sizes and how many concurrent users you can serve. Use the sizing and value calculator to estimate peak concurrency and GPUs from your own question volumes, then update the plan with the result.

## Search terms

SAP BW/4HANA AI architecture, private AI SAP BW/4HANA, SAP BW/4HANA on-prem LLM, SAP BW/4HANA AI integration plan, on-prem AI architecture template, private AI layer blueprint, air-gapped AI ERP architecture

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json