SAP puts its agent containment work into OpenShell
SAP's four contributions to the OpenShell agent runtime are containment and operability engineering, and the runtime is free only through October.
Topic coverage
Architecture
Source-linked reporting and practical patterns organized around a shared enterprise applications question.
Latest reading
Salesforce names six trust layers and two need proof
Salesforce's newsroom post lists six trusted capabilities behind its agent platform. Trusted agency and trusted actions are the two an architect has to test.
Salesforce names a headless meter and leaves the price blank
Salesforce's August 31 rate card carries a Headless Platform Interaction usage type priced TBA, and the two narrower rows it replaced are gone.
Buyers expect headless Salesforce access to cost more, not less
Buyer research on 20 interviews found most already reach Salesforce outside its UI, and three quarters of those modelling it expect to pay more.
ServiceNow's Lux UI framework runs on LIT and Tailwind CSS
Lux goes GA in Q4 2026, it is built on LIT, Base UI and Tailwind CSS, and ServiceNow says Workspaces and Angular Service Portals have no deprecation plan.
Tottenham cut 35 systems to one, and identity was the hard part
Tottenham Hotspur consolidated about 35 fan-facing systems onto Salesforce. The harder work is the one Rob Pickering names in passing: identity across touch points.
Colombina moved 16 countries to S/4HANA in one cutover
SAP says Colombina migrated all 16 countries it operates in to S/4HANA Cloud Private Edition at once, skipping the phased waves most programmes plan for.
Salesforce's outage started with an internal login service
Salesforce says requests stalled on an internal login service. Authentication is the dependency most continuity plans never wrote down.
Testing Oracle's case against hollowed-out apps
Oracle argues AI accelerates packaged applications rather than replacing them. We test which parts of the app layer actually hold.
Copilot Studio's Redis numbers and the 72% cost caveat
Microsoft published real traffic and server load figures behind Copilot Studio agent flows. The load drop matters more than the 72% cost headline.
Siemens' Agentforce rollout is a governance test, not a win
Siemens is routing 2,500 monthly leads across 132 countries through two Agentforce agents, and the real test is quality control at that scale.
AIforce claims to replace the UI. The admin's work just relocates.
Salesforce framed AIforce at Dreamforce 2026 as AI replacing the CRM interface. For the admin who built what's underneath it, the question is where that logic goes next.
Oracle's 240 unauthenticated bugs are a network design signal
Oracle's September update fixed 240-plus flaws needing no login at all. That says less about Oracle's code than what stays reachable from the open internet.
Dynamics 365 Activate needs a risk register before it runs
Microsoft's Activate preview automates Salesforce-to-Dynamics 365 discovery. The ownership, mastery, integration, and rollback questions come first.
What SAP support numbers tell an architecture team after go-live
SAP's September 10 services update counts Joule users and success plans. After go-live, the number an architecture team needs is in its own support queue.
Dynamics 365 Activate and what each customization was for
Microsoft's Activate preview surfaces Salesforce customizations before the first workshop. The first review has to ask which need each one met.
What Workday's Gartner HCM recognition can't tell you
Eleven straight years as a Gartner Leader says Workday will keep investing in HCM. It says nothing about your pay rules, your ledger, or your integrations.
Match each Dynamics 365 planning decision to a roadmap channel
Microsoft's AI at Work roadmap, Message Center, and Learn each answer a different planning question. Here is which channel each decision belongs to.
What Workday's state and local go-lives say about timelines
Workday names a city live in five months and a state that took thirty. The gap is pay rules and fund accounting, and you can count both before you plan.
One Microsoft roadmap still needs a release owner in your tenant
Microsoft's always-on AI at Work roadmap removes the wave date that used to force a review. Someone in your tenant now has to own that date.
AI at Work roadmap and Message Center answer different questions
Microsoft's August 25 post keeps public roadmap items and tenant change notices in separate channels. Someone on your team has to join them.
Getting your team ready for the AI at Work roadmap switch
Microsoft retires Release Planner on November 15, 2026. What admins and architects should export, rebookmark, and reschedule before that date.
Analysis and architecture
Cloud flow or plugin for Dataverse business logic
A plugin can stop a bad save and a cloud flow cannot. That difference, plus who maintains it, settles most calls.
Designing a Salesforce sharing model that still scales
Salesforce sharing only ever adds access, and the platform stores the result. How to set the baseline, the hierarchy and the rules so growth stays affordable.
NetSuite or Fusion, and the cost of choosing wrong
Moving between NetSuite and Fusion Cloud later means a second implementation rather than an upgrade, so choose on structural complexity instead of company size.
SAP integration patterns that stay maintainable
SAP integration moves business documents, not rows. Which patterns hold up over years, which quietly become somebody's problem, and what to check first.
Planning next to the ledger or in a model of its own
A plan only means something next to actuals, and a separate model only earns its keep if planners can change it. Dimension ownership decides which one works.
Dataverse security that survives ten times the size
Business units, depth, teams and sharing decide whether a Dataverse security model survives growth. How to design each one so it still makes sense later.
A delivered ServiceNow connector or a script you own forever
The choice between a configured integration and a script gets settled by who is free that week, and your entitlement decides more of it than anyone admits.
How far to extend Oracle Fusion before you build outside
Every extension inside Fusion is a standing commitment to retest four times a year. Exhaust configuration first, and keep logic with its own release cycle outside.
Grounding Joule starts with the authorisation model
An assistant grounded in SAP data is only safe if it inherits the authorisation check rather than retrieving broadly and filtering the results afterwards.
The Workday integrations still standing in year five
Effective dating separates the Workday integrations that still hold up in year five from the ones that went quietly wrong and told nobody.
Movers break the identity lifecycle across business apps
Provisioning is the easy part. Transfers add access and almost never remove it, and every application keeps entitlement in a model of its own.
Who gets to put things on your ServiceNow customer portal
A customer portal collects a page from every team that asks. Decide who owns the scope, where the logic lives and what anonymous visitors see.
SAP analytics close to the source or in your warehouse
SAP numbers are only correct because of the logic around them. Decide which questions need that logic and which cross systems SAP never sees.
When ServiceNow domain separation earns its cost
Domain separation partitions ServiceNow data for a handful of real reasons and constrains the platform for years. Scoped apps and access control usually fit better.
Why a group of companies usually needs one Workday tenant
A group of companies almost always belongs in one Workday tenant. Here is when a second one is genuinely right, and what the single tenant costs you.
Where one CMDB for CSM and ITSM stops being a saving
One CMDB for ServiceNow CSM and ITSM saves real work until permissions, reconciliation and asset ownership pull the two populations apart.
Which ledger counts when NetSuite and Fusion both run
Running NetSuite and Fusion Cloud side by side is survivable, but only if one ledger owns consolidation and the group close accepts the slower system's calendar.
When Dataverse reporting needs more than Power BI
Most reporting on Dynamics 365 and Dataverse data never needed a data platform. Copying it out earns the cost only when history, joins or scan volume demand it.
Power Pages identity decisions that are hard to undo
A Power Pages site authenticates against an identity provider and authorises against a Dataverse contact. Matching the two on email is the mistake that lasts.
Release Radar: BTP updates and the notice you are owed
SAP publishes BTP's update cadence but not a platform-wide retirement notice period. The number you can hold SAP to sits in the contract.
Why SAP BTP spending drifts after the first project
Consumption pricing moves cost control from the contract to the code, and BTP spending drifts because nobody told the engineers they were spending it.
The Service Cloud Case decisions you cannot undo later
Record types or separate objects, contacts who exist nowhere, entitlements you may not need. The Case model choices that fix what you can report on for years.
Keep people analytics in Workday until you need a join
Workday already enforces who may see whose record. Copying worker data out buys you joins and hands somebody the job of rebuilding that access model.
Where a Workday Extend app should stop
Extend earns its place when the app sits on Workday objects and inherits tenant security. Orchestrating outside systems is a different job.
Agentforce or Copilot Studio when you run both stacks
For an organisation running both stacks, the agent belongs where the data and the permission model that has to govern it already live.
Dataverse or SharePoint lists, and how to decide
SharePoint lists are the right store more often than architects admit. Delegation limits are where they quietly stop being right, and nothing errors when they do.
The S/4HANA or Fusion Cloud choice is rarely about features
Both will run a large organisation's processes competently, so the S/4HANA versus Fusion Cloud choice turns on your estate, your people and your cadence.
What actually decides Workday HCM or SAP SuccessFactors
A feature comparison gives you two lists that mostly match. The decision turns on fit, country payroll coverage and who holds the configuration skill.
Partial success is the integration failure nobody sees
Most integrations handle success and failure and nothing between them. The partial load, the business rejection and the empty run are the ones that hurt.
The account model you choose now outlives the CRM
Companies replace their CRM every seven to ten years, and the way they decided to represent a customer survives every one of those migrations.
Where business logic should live, and who can bypass it
The same validation in the form, the flow and the ERP is a tradeoff nobody wrote down. Pick the layer by who must never be able to break the rule.
Extend Account or build a custom Dataverse table
A decision framework for the Dataverse call every team faces, when a requirement belongs as columns on Account and when it needs its own table.
Identity architecture when you run two Salesforce orgs
When a company runs more than one Salesforce org, single sign on is the easy part. The gap audits find sits in deprovisioning across two login domains.
Where Oracle Fusion reporting stops and a warehouse starts
OTBI and BI Publisher belong on open work. Once a request needs closed periods or data Fusion never held, build the extract instead of the report.
Why the Salesforce single-org debate has no clean answer
A decision framework for splitting a Salesforce org, and an honest look at what the split really costs once you're running two systems instead of one.
SAP clean core, and when to rebuild, extend, or patch
A framework for deciding what SAP work gets rebuilt clean, what becomes a BTP side-by-side extension, and what temporary fix quietly becomes permanent.
The real difference between a connector and an integration
A connector gets a record from one system to another. An integration owns what happens when the record gets rejected, and most sync projects fail without that part.
The NetSuite or Fusion Cloud choice is about your org chart
Comparing NetSuite and Fusion Cloud feature by feature misses the real question, which is what your entity structure looks like in three years.
Designing the human review step for Copilot Studio agents
Name the decision a person keeps, show the reviewer the source and the proposed change, give the queue an owner, and write the answer back to the record.
Map the Power Platform and SAP flows before the roadmap
Before a Power Platform or SAP roadmap gets sequenced, list every flow it touches with a source of record, a consumer, and the person who fixes exceptions.
Give every Dataverse access exception an owner and an expiry
Access exceptions in Dataverse and ServiceNow outlive their reason. Give each one a named owner, an end date, and a record small enough to review.
SAP clean core is a budget decision before an architecture one
Keeping SAP S/4HANA modifications out of the core only works when someone funds the BTP extension platform, the rewrites, and the retirements.
Architecture Clinic: the queue cannot own the exception
A queue between Power Automate and Oracle Fusion guarantees delivery. Someone still has to decide what a duplicate, stale request, or rejected record means.
Why every modernization plan needs a retirement list
A modernization program that lists what it will build and never what it will switch off ends up paying for both. Put the retirements in the scope.
What a ServiceNow catalog entry owes the support desk
A catalog entry for a Power Platform flow should name who gets paged, what to check first, and who can switch it off. The design document stays where it is.
The lake can copy S/4HANA, but it cannot sign the quarter
Let Power BI read a copy of S/4HANA history, keep the signed number in the Universal Journal, and show extract time and tie-out status on pages that mix them.
Related guides
What Dataverse actually is, and when it is overkill
Dataverse gives you a relational model, row and column security, and rules that hold whoever wrote the record. A five person spreadsheet needs none of it.
What Agentforce actually is, and where it stops
Agentforce agents are handed a job rather than a script, bounded by topics and instructions, and they see exactly what the user they run as can see.
What Oracle Fusion Cloud actually is, and what it shares
Fusion Cloud is several application families sharing one platform, so saying you run Fusion tells nobody which ones you actually bought.
What SAP BTP actually is, and when you need it
SAP BTP is one name over four different things: extension runtimes, integration, data services and AI. Knowing which one you mean is most of the answer.
Small integration contracts for Salesforce and ServiceNow
Name the business event, send only fields the receiver acts on, version when meaning changes, and write down what happens to duplicates.