SAP SU24/SU25 Authorizations Enforced on BigQuery: Natural-Language Data Access with a SOX Audit Trail

// the problem

300+ business users generate 80–150 data tickets per month, funneled through only 11 IT analysts consuming 18–27% of total IT capacity. Every data request takes 2 to 5 days, paralyzing decision-making across Sales, Materials, and Finance. BigQuery access entirely bypasses SAP's SU24/SU25 authorization model — users can see data their SAP role explicitly forbids, creating direct SOX audit exposure. Manual RLS replication would cost $425,950 in Year 1 with $264K/year in ongoing maintenance and permanent role drift risk. The false choice: block BigQuery entirely and kill data democratization, or leave it open and accept regulatory and financial risk.

// what CLU does

The CLU Gate Agent sits as a middleware orchestration layer between business users and BigQuery. It reads SAP SU24/SU25 authorization rules in real time via a read-only API — zero modifications to SAP Core, no transports, no code changes. Business users query in natural language; the agent translates to SQL and injects restrictive WHERE clauses enforcing the user's exact SAP permissions before any query reaches BigQuery. Fail-closed by design: if SAP rules don't validate the query, the gate does not open — default deny, never default allow. Every query generates an immutable audit log entry with who, what, how, and when for SOX compliance. Deploys in 8 weeks with a modular rollout: SD → MM → FI → Cross-Module.

// the agents, in order

1. 1
   Gate Agent

   Receives natural language query from business user — parses data intent and target dataset, initiates real-time authorization check against SAP
2. 2
   SAP Auth Reader

   Fetches SU24/SU25 authorization rules for the requesting user via read-only SAP API — no SAP Core modifications, no transports, no code changes
3. 3
   SQL Translator

   Converts natural language query to SQL and injects restrictive WHERE clauses enforcing the user's exact SAP permissions before query reaches BigQuery
4. 4
   Security Gate

   Validates translated query against SAP rules — fails closed if permissions don't match. Default deny, never default allow. Zero trust by design
5. 5
   BigQuery Executor

   Runs filtered SQL query against BigQuery — returns only data the user is authorized to see per their active SAP role assignment
6. 6
   Audit Logger

   Writes immutable log entry (user ID, SQL generated, SU24/25 filter applied, timestamp) to SOX compliance dashboard in milliseconds

// systems it talks to

• SAP SU24/SU25 API
• BigQuery
• NL→SQL Engine
• SOX Audit Dashboard
• CLU Gate Agent
• MCP-Lite Orchestrator