What is Makion
Makion is an on-premise AI coding agent for SAP / ABAP. A developer describes a task in plain language, and an AI agent carries it out inside the organization's own SAP system through the official ADT (ABAP Development Tools) interfaces — following the team's coding standards, and recording every step in an audit trail.
Everything runs on infrastructure the customer controls: the SAP connection, all credentials, and the AI model login never leave the customer's own server and machines.
Makion is not affiliated with SAP SE. SAP and ABAP are trademarks of SAP SE and are used here only descriptively.
What you can do with it#
- Build and change ABAP — implement a requirement end to end, write unit tests, run ATC and fix findings, create DDIC objects (tables, structures, data elements, domains), and build CDS, RAP and Fiori artifacts.
- Investigate safely — ask questions about a system, review code against your standards, or analyze a custom-code estate for an S/4HANA migration, all in read-only roles that physically cannot change SAP.
- Run unattended — hand the agent a task or a specification and let it work on its own, proposing every change into a queue that a human approves and applies. See Autonomous mode.
- Handle support and consulting work — triage incidents (dumps, IDocs, failed jobs) and produce advisory assessments, all read-only, through the Requests queue.
How it is different from SAP's own AI tooling#
SAP's own AI approach (Joule and the official ADT tooling) is cloud-first, tied to SAP's own model, and billed per token through SAP AI Units. Makion takes the opposite approach on purpose:
| SAP's AI tooling | Makion | |
|---|---|---|
| Cost model | Pay per token (SAP AI Units) | Your existing subscription — a flat monthly fee, no per-token cost |
| How you sign in | API keys / metered credits | Connect your Claude / Gemini / Codex / Kimi / Grok subscription, or use an API key |
| Where it runs | Cloud-gated | On-prem — your SAP, your server, your machine |
| Model | SAP's single model | Multi-engine — chosen per project |
| DDIC objects | not offered | Creates tables, structures, data elements, domains via ADT |
| Autonomy | not offered | Unattended runs with a human approve-and-apply gate |
The headline: connect through a subscription, not an API. You sign in once with a subscription you already have and Makion runs on it — no metering, no surprise token bills. See AI engines & login.
The core promise: nothing changes in SAP without a human#
Makion is built so the AI can investigate your SAP system freely but can only change it under direct human control. Two mechanisms enforce this at the code level, not just by instruction:
- Read-only roles physically cannot write. When you pick a read-only role, the agent is handed only the read set of SAP tools — the write tools are never passed to it, so it cannot lock, set source, create, or activate anything.
- Object deletion is permanently disabled. No role can delete an SAP object; the request is blocked before it ever reaches SAP.
On top of that, Autonomous mode adds the strongest gate: the autonomous agent runs entirely read-only and can only propose changes into a ship queue. A human approves each proposal, and a separate, human-triggered Apply button performs the actual write to SAP.
In interactive Chat, a write role does change SAP during the conversation you are directing — that is the point of a write role. The propose → approve → apply button flow is specific to Autonomous mode. If you want a hard human-apply gate for every write, use Autonomous mode. The full picture is in the Security model.
Who it is for#
- SAP / ABAP developers who want to describe work in plain language and have it implemented, reviewed, or investigated in their own system.
- Teams that need several developers on one Makion instance, each isolated to their own projects and SAP connections.
- Organizations whose two hardest objections to AI-in-SAP — third-party access to SAP, and data residency — are both answered by the on-prem, customer-owned design.
Where to go next#
- Install on Windows — download, install, and get past the first-run security prompt.
- Sign in & projects — the two ways to sign in, and how projects work.
- Your first task — connect to SAP and send your first message.
- How roles work — how a role scopes what the agent can and cannot do.