MakionDocs ← makion.dev
Makion Docs / How it works

FAQ

Short answers to the questions that come up most when evaluating or setting up Makion. Each links to the page with the full detail.

Can the AI change my production system?#

No. Every SAP connection is tagged with a tier — DEV, QAS, or PROD — and QAS and PROD are read-only. An agent connected to a QAS or PROD system is handed only read tools, whatever role is selected, so it can never change those systems. Making a system writable requires a deliberate, typed confirmation. See the Security model.

Can it delete objects?#

No. Object deletion is permanently disabled for every role — read-only and write alike — and the request is blocked before it ever reaches SAP. There is no setting that turns it back on. See How roles work.

Where do my SAP credentials and data go?#

They stay on infrastructure you control. Makion is on-prem: the backend is hosted by your organization, the SAP connector runs on your own machine, and there is no third-party SaaS operated by Makion in the path. Your SAP password is encrypted on your machine with Windows DPAPI (user-scoped), never stored in plaintext, and never sent anywhere but your own connector.

Do I need to pay per token?#

Not if you sign in with a subscription. Makion's headline is connect through a subscription, not an API — you sign in once with a plan you already have and it runs on it, with no per-token metering. You can also use an API key, which is pay-as-you-go. See AI engines & login.

Which AI models are supported?#

Makion is multi-engine, and the engine is chosen per project — for example Claude, Gemini, Codex, Kimi, and Grok. Some engines sign in with a subscription, others with an API key. See AI engines & login.

Do I need to install the SAP connector separately?#

No. The connector is built into the desktop app. You add and connect to your SAP system in the Systems tab; there is nothing extra to install for it.

Why does Windows warn on first install?#

A fresh app from a small publisher can trigger a SmartScreen warning on first run. This is expected for a newly published desktop app and not a sign of a problem. The Install on Windows page walks through getting past the first-run prompt.

How do developers get access?#

The first person to sign in becomes the superadmin for the whole instance. Everyone after that starts with no access until the superadmin grants them a role and adds them to a project. If you see "No access yet", that is expected — ask your administrator. See Sign in & projects and Users & access.

What's the difference between Chat write roles and Autonomous mode?#

In interactive Chat a write role changes SAP during the conversation you are directing — you chose the role and you steer it. Autonomous mode is different: the agent runs unattended and entirely read-only, and can only propose changes into a ship queue that a human approves and then separately applies. Use Autonomous mode when you want a hard, button-level human gate on every write.

Does it work with on-prem ECC, not just S/4HANA?#

Yes. Makion works with on-prem SAP systems through the official ADT interfaces, including ECC, not only S/4HANA. It also has roles aimed specifically at ECC→S/4HANA migration work — see How roles work.

Can I drive Makion from my phone?#

Yes. A built-in Telegram bot mirrors most of the desktop app: pick a project and role, send tasks, review and apply the autonomous ship queue, and handle Support / Consult requests. Opening the SAP connection itself stays a desktop action.

↑↓ navigate⏎ openesc close