What CSPeach calls in your SAP system, as which user, under which access levels, and what it stores. Facts for your security officer and your counsel. We quote and we state. We do not read SAP’s policy for you.
1 · The interface
CSPeach’s SAP work runs through the ADT REST interface of your ABAP system. It is the same protocol Eclipse and SAP’s ABAP development tools for VS Code use. CSPeach reads an OData service only when the developer asks it to test one, or links one in the CAP lane. The calls go from the developer’s laptop to the system. They do not pass through our service. Nothing is installed in the SAP system. Nothing runs in it.
2 · The user
CSPeach logs on as the developer’s own SAP user. Every authorization check behaves as in SAP GUI. There is no technical user and no service account. Your change documents name the real developer.
3 · The levels
CSPeach uses the four levels on SAP’s own slide. Your administrator sets one per system, in the configuration file your desktop team deploys.
| SAP’s level | Setting | What CSPeach does |
|---|---|---|
| Fully closed | access = "closed" | CSPeach does not connect to the system. It says: “This system is closed to CSPeach. Your administrator set access = closed for <system>.” |
| Read-only | access = "read-only" | CSPeach reads and proposes. Every write is refused before an approval card is shown: “This system is read-only for CSPeach (access = read-only, set by your administrator). Nothing was changed.” |
| Restricted editing | access = "restricted"packages = [...] | CSPeach writes only to objects in the listed packages. A write to any other package is refused before the card. When CSPeach cannot read an object’s package, the write is refused too. An empty list refuses every write. |
| Fully open | access = "open" | Writes as today: one approval by the developer, a snapshot first, checks after. |
| Not set | no access key | The same as fully open. The start line says Access: open (no level set). |
The level shows when an interactive session starts, for example
Access: restricted to ZCC_*, ZFI_SALES (set by your administrator).
/status shows it again. Every audit row records it.
The configuration file is on the developer’s laptop and is that user’s file.
A change to it shows in the start line and in every audit row.
The level in CSPeach’s configuration and the level in SAP’s ABAP development tools for VS Code are set separately. An administrator sets both the same.
4 · Storage
No SAP source, object or data is stored on our servers. Prompts, including the code they contain, pass through our service to the model. Our service does not store prompt or response text. We keep usage records: token counts, model and time. What the model provider keeps, and for how long, is on our security page. Snapshots and the audit log stay on the developer’s laptop.
5 · Where
CSPeach is used on development systems. A system marked role = "prd"
is advisory-only: CSPeach proposes and never writes to it. When the role and the
access level differ, the stricter one wins. So a prd system set to
open is still advisory-only.
6 · For your counsel
“(semi-) autonomous or generative AI systems that plan, select, or execute sequences of API calls” SAP API Policy v4/2026, section 2.2.2. Read the full clause in the policy itself.
What the software does:
prd system is advisory-only.sql_tables = "dictionary", the SQL tool reads only the allowlist plus the tables your administrator adds with sql_allow.Your counsel decides what this means for your contract. We state what the software does.
Reviewed by an independent SAP licensing advisor: pending
7 · To forward
Copy it as it stands.
CSPeach is a coding agent that runs on the developer’s laptop. It works through the ABAP system’s ADT interface, as the developer’s own SAP user. A six-week lane produces a clean-core report reconciled with the system’s own ATC results, each decision recorded with the name of the person who made it, and proof per object. CSPeach stores nothing of the SAP work on its servers. It works on development systems, under the access level the administrator sets.
8 · Settings
Per system in ~/.cspeach/config.toml, unless marked. A key that is not set leaves CSPeach as it is today.
closed, read-only, restricted or open. The four levels above.restricted, the packages CSPeach may change. Names, or patterns with * and ?."dictionary": the SQL tool reads only a fixed set of 20 dictionary and repository names (DD03L, DD07T, DDDDLSRC, TADIR, TDEVC, TDEVCT, TRDIR, TFDIR, ENLFDIR, E070, E071, E07T, CVERS, T000, ARS_W_API_STATE, ARS_W_API_SCCSSR, SLIN_DESC, SMODILOG, /SDF/MON_RECS, SUSG_*) plus sql_allow. Business tables are not on it. Not set: as today, with user tables blocked.dictionary mode. User tables (USR*, USGRP*) stay blocked even when listed.false: cspeach --upgrade refuses and says your desktop team manages upgrades on this machine."prd": advisory-only, as in section 5.cspeach audit export --since YYYY-MM-DD --until YYYY-MM-DD --out file writes the audit rows as JSON Lines for your SIEM. Dates are compared in UTC. Rows are written from CSPeach 1.1.64 on.self_upgrade = false
[sap.S4D]
role = "dev"
access = "restricted"
packages = ["ZCC_*", "ZFI_SALES"]
sql_tables = "dictionary"
sql_allow = ["T683S", "ZTAB_*"]9 · Authorizations
The authorizations below are suggested: verify with SU53 on your own system.
Check with your SAP licence contract whether development-display authorizations change a user’s licence class.