Google’s Anti Gravity is built on a simple premise: remove friction so developers can stay in “the flow.” But the real unlock isn’t just the IDE itself, it’s how you architect your interactions with the AI inside it. While this article is relevant for any IDE you are using with AI, if you aren’t using it yet, I would recommend you take a look at Anti Gravity.

What I am doing with my IDE and AI now:
I’ve started moving away from “chatting” with AI. Instead, I’ve been creating small .md files that act as Instruction Layers for Gemini. This simple shift turns an LLM from a conversational assistant into a predictable, modular part of my technical stack.

The Core Concept:

Prompts as Configuration
Instead of re-explaining my requirements every time I open a terminal, I treat prompts like Angular Components. I create a simple Markdown file that tells Gemini exactly how to behave for a specific task. There are also versions of doing this in certain tools branded as workflows, skills, rules, etc but the premise really is just writing something down easily referencable by your ide to regularly bring into your AI prompts without re-writing that will point your LLM in the right direction when helping with code.

When you find yourself prompting the same thing multiple times, whether in Anti Gravity or any integrated IDE, you shouldn’t be typing; you should be referencing a spec and updating it.

An “Angular-Style” Instruction File:

Encapsulated: A clearly defined purpose.
Reusable: Use it across any feature branch.
Consistent: Standardized output every single time.

Example: pr-assistant.md

PR Comment Assistant

Goal:
Draft and post high-quality GitHub PR comments via the git CLI.

Rules:
Keep feedback actionable, professional, and concise.
Call out uncertainty explicitly; no speculation.

Structure:
Context → Suggestion → Reasoning.

Execution:
Output via git CLI; do not use inline IDE comments.
Treat comments as notes for reviewers and future contributors.

Why This Works (Anti Gravity in Practice):
Without structure, you suffer from Prompt Drift. Your instructions get lazy, the output becomes inconsistent, and you repeat yourself constantly.

By using .md instruction files, you achieve Cognitive Offloading:

Predictability: Gemini follows the spec, not the “vibe” of your last message.
Efficiency: You stay focused in your IDE, invoking capabilities rather than brainstorming prompts.
Scalability: These files live in your repo. They evolve with your codebase, they’re version-controlled, and they can be shared across your entire team.
Angular as the Language of Focus:
This approach mirrors core Angular principles almost perfectly:
Separation of Concerns:
Each .md file has one specific job.
Reusability: The same instruction file works across different PRs and projects.
Consistency: You get standardized outputs, every time. Instead of just “talking” to an AI, you are composing it into your development environment.

Closing Thought
The real power of Anti Gravity within an Angular codebase isn’t just writing code faster, it’s reducing the mental overhead of the development process.

When you pair a high-performance IDE with small, well-designed instruction files, you get something bigger than an assistant. You get a custom-built, automated collaborator.

The engineering team maintains a Python/TypeScript monorepo with 22+ Django microservices, a React frontend, and shared libraries — all running through GitHub Actions CI. Over time, CI had become the productivity bottleneck. PRs routinely waited 10-15 minutes for green checks, and the slowest pipeline consistently exceeded 10 minutes. Engineers were context-switching while waiting for builds, or worse, stacking PRs on top of unverified ones.

I ran a focused initiative to systematically identify and eliminate CI bottlenecks. This post is a record of how I approached it.

1. Finding the Bottleneck

You can’t optimize what you can’t see. So my first instinct was to write a script to pull GitHub Actions workflow run data from the API and compute aggregate statistics — average, P50, P75, P90 — for both wall clock time and per-job durations across any date range.

This immediately told me two things:

1. The largest service’s unit-test job was the critical path — at P50 of ~10 minutes, it single-handedly determined the CI wall clock time.
2. Other services stayed around 8-9 minutes — they were running multiple jobs in parallel so further investigation was needed.

Having this data let me prioritize ruthlessly. Instead of optimizing everything at once, I focused on the jobs that actually moved the wall clock needle.

And it’s always satisfying to compare the before vs. after statistics.

2. Low-Hanging Fruit — Modernizing the Toolchain

My first lever was swapping slow tools for faster alternatives. The Rust-based ecosystem has matured to the point where several tools are genuine drop-in replacements, so this felt like a no-brainer:

• Yarn to Bun (not Rust-written, but famous for its speed and maturity)
• Webpack to Rspack
• storybook-rsbuild
• Adopt eslint-plugin-oxlint, disabling ESLint rules that oxlint now handles

Each swap reduced CI time per job by 30-40%.

3. Low-Hanging Fruit — Docker Build Optimization

Docker builds were another time sink. I attacked from multiple angles:

• Enabled .dockerignore — builds weren’t using ignore files because the build context was outside their scope
• Optimized uv sync in Dockerfiles — eliminated unnecessary dependency installation loops; uv build --package uses build isolation and never touches the workspace venv
• Cleaned up stale cross-service dependencies — after migrating to uv workspaces, some services had phantom dependencies on unrelated services, triggering unnecessary rebuilds

This reduced Docker build CI time by about 50%.

4. Test Duration Enforcement & Slow Test Fixes

After tackling the low-hanging fruit, I turned to the tests themselves. The repo already had a check-test-durations composite action that parses JUnit XML and reports the top 10 slowest tests — but it was only wired up in 2 of 22 services.

Rolling Out Visibility

I added the duration check to all workspace CI workflows with continue-on-error: true — visibility without blocking builds.

This immediately surfaced tests taking 10-30+ seconds across services that had never been profiled.

Fixing the Worst Offenders

With data in hand, I targeted the slowest individual tests. Some were making unnecessary network calls, others were creating excessive test data, and a few were simply doing too much in a single test. I fixed tests exceeding 10 seconds across the two slowest services, bringing meaningful improvements before touching any CI infrastructure.

(One fun find: somewhere the application code called time.sleep(10), and the test didn’t mock it — so the test took at least 10 seconds for free. Sometimes reducing test duration is that simple.)

Enforcing the Threshold

After the initial round of fixes, I made the duration check a hard enforcement — any individual test exceeding 10 seconds fails the build. This prevents slow tests from creeping back in, turning a one-time fix into a sustainable practice.

5. Caching: Every Layer Counts

GitHub Actions provides a 10 GB cache quota per repository. In a monorepo with 22+ services, that’s not much — so every cache needs to earn its space. I identified and enabled caching at four layers of the CI pipeline.

.git Cache

In a monorepo, git clone with fetch-depth: 0 (needed for change detection and visual regression diff baselines) is expensive — the repo has significant history. I set up a scheduled workflow that runs every 6 hours to pre-populate the .git directory cache on master.

uv Cache

I enabled setup-uv‘s built-in cache across all CI workflow files.

The cache is keyed on the uv.lock hash, so it invalidates exactly when dependencies change. Impact: ~5 seconds saved per job on the “Install uv” step (8s → 3s average). Small per-job, just a few hundred KB.

node_modules Cache

The frontend workflows cache node_modules after bun install. The cache key was previously overloaded — some callers passed a branch name (${{ github.head_ref }}), others a static date string. Branch-keyed caches created redundant entries for the same lockfile, wasting quota.

I simplified to a single lockfile-based key using bun.lock.

GitHub Actions already scopes cache access by branch (PRs can read from the base branch’s cache but not other PRs’), so per-branch keys were pure overhead. This change eliminated redundant cache entries and improved hit rates.

ESLint Cache

ESLint is one of the slower steps in frontend validation. I enabled its persistent cache by restoring .eslintcache between runs.

On cache hit, ESLint only re-lints files that changed since the last run, skipping the majority of the codebase.

6. Test Parallelization (with Cost in Mind)

Parallelization is the most effective lever for reducing wall clock time — but in GitHub Actions, more parallel jobs means more billable minutes. Every matrix shard spins up a fresh runner, installs dependencies, and tears down. The setup overhead isn’t free. I approached this deliberately, targeting parallelization where the payoff justified the cost.

pytest-xdist: Free Parallelism

The lowest-cost optimization is utilizing all CPUs within a single runner. I enabled pytest-xdist with -n auto in services that were running tests serially.

For one service, this cut pytest execution from ~4m30s to ~2m07s — roughly 2x faster with zero additional runner cost.

Matrix Sharding: Deliberate Trade-off

For the largest service (8,674 tests, ~10 minute P50), single-runner parallelism wasn’t enough. I restructured its CI into 7 matrix shards to keep each under 5 minutes.

The cost trade-off: 7 shards means 7x the setup overhead (dependency installation, database creation). Total billable minutes actually increased. But the wall clock time — what engineers wait on — dropped from ~10 minutes to ~5 minutes. For a team making dozens of PRs daily, the productivity gain far outweighs the compute cost.

Takeaways

1. Measure first, always. A simple Python script using the gh CLI gave me reproducible P50/P75/P90 data across any date range. Way more reliable than eyeballing the Actions UI — and it makes before/after comparisons trivial.

2. Modernize your toolchain — it’s free speed. Bun, Rspack, and oxlint are drop-in replacements that delivered 30-40% speedups per job with minimal migration effort. Highest ROI work I did.

3. Instrument test durations, then enforce them. A 30-second test hiding in a 6-minute suite is invisible until you look. These are often the easiest wins — and a hard time budget prevents regression.

4. In a monorepo, cache quota is a shared resource. GitHub Actions’ 10 GB limit is shared across all workflows. A poorly-keyed cache doesn’t just waste space — it actively evicts caches that matter.

5. Parallelism costs money — spend it wisely. pytest-xdist within a single runner is free performance. Matrix sharding trades billable minutes for wall clock time. Make that trade deliberately, and know the numbers before and after.

DECLARATION

SPECIFICATION

STATE

INFORMATION_SPACE

TIME ANCHOR

Unix Epoch: 1774559415

Time (UTC): 2026-03-26T21:10:15Z

Time (Europe/Berlin): 2026-03-26T22:10:15+01:00

AUTHOR

iinkognit0@K501

SOURCE

https://iinkognit0.de/

ORCID

https://orcid.org/0009-0005-5125-9711

PROTOCOL

MATHEMATICAL_HARMONIZATION

MODE

DETERMINISTIC_LOGIC_ONLY

STATUS

LOCKED

I. GLOBAL DEFINITION

Let 𝔹 = {0,1}.

K501 is defined as:

𝓚 = (S, F, H_d, Q, J, H, Γ, N, C, I, P, E, V)

II. STATE SPACE

S ⊆ 𝔹*

S = { x | x = (H_d, B) }

III. HEADER SPACE

H_d = (
declaration,

state,

time_anchor,

author,

source,

protocol,

mode,

status

)

Constraints:

• total order fixed
• all fields mandatory
• no permutation allowed

IV. BODY SPACE

B ∈ 𝔹*

For frames:

B_f = (Q’_f, p_f)

V. CANONICAL SERIALIZATION

J: S → 𝔹*

J(x) = J(H_d ⊕ B)

Constraints:

• ⊕ is ordered concatenation
• header precedes body
• encoding is canonical and deterministic

VI. SERIALIZATION AXIOM

∀x, y ∈ S:

(x ≅ y) ⇔ J(x) = J(y)

VII. HASH FUNCTION

H: 𝔹* → 𝔹²⁵⁶

Properties:

• deterministic
• preimage-resistant
• collision-resistant (practical)

VIII. FRAME DEFINITION

F ⊆ S

Frame:

f = (B_f, h_f)

where:

B_f = (H_d, Q’_f, p_f)

h_f = H(J(B_f))

IX. QUANTUM HEADER

Q’_f = (l_f, t_f, σ_f, g_f)

l_f ∈ ℕ

t_f ∈ E

σ_f ∈ {0,1,2}

g_f ∈ {0,1}

X. VALIDITY

g_f(f) = 1 ⇔ f is structurally valid

XI. STATE SEQUENCE

Sₙ = (f₀, f₁, …, fₙ)

Properties:

• totally ordered
• append-only
• persistent

XII. APPEND-ONLY AXIOM

Sₙ₊₁ = Sₙ ∪ Δₙ

Δₙ ∩ Sₙ = ∅

XIII. IMMUTABILITY AXIOM

∀f ∈ S: f is invariant

XIV. DETERMINISM AXIOM

∀X:

Π(X) = S₀ is unique

XV. HASH CHAIN

H₀ = 0²⁵⁶

Hₙ = H(J(fₙ) ∥ Hₙ₋₁)

XVI. CHAIN SPACE

Γₙ = (H₀, H₁, …, Hₙ)

XVII. CHAIN CONSISTENCY

Γₙ₁ = Γₙ₂ ⇒ Sₙ₁ ≅ Sₙ₂

XVIII. NODE SPACE

N = { nᵢ }

n = (Sₙ, Cₙ, Iₙ, Γₙ)

Constraints:

Cₙ ⊆ Sₙ

Iₙ ⊆ I

XIX. ASYMMETRY AXIOM

∀n₁, n₂ ∈ N:

Cₙ₁ ≠ Cₙ₂ allowed

XX. HARD INDEX

I = QB₀ ∪ K ∪ R

QB₀ ⊂ S

K ⊂ S

R ⊂ S

XXI. PACK SYSTEM

P = { pᵢ | pᵢ ⊂ S }

Hierarchy:

P₀ ⊂ P₁ ⊂ P₂

XXII. SYNCHRONIZATION

Let k be maximal prefix index:

∀i ≤ k: Hₙ₁,i = Hₙ₂,i

Δ(n₁, n₂) = (Hₙ₁,k+1, …, Hₙ₁,max)

XXIII. PARTIAL REPLICATION AXIOM

Global reconstruction does not require:

⋃ Cₙ = S

XXIV. CONSISTENCY FUNCTION

V(Sₙ) = 1 ⇔

• ∀f ∈ Sₙ: g_f(f) = 1
• Γ consistent
• H correctly computed
• J canonical

Else:

V(Sₙ) = 0

XXV. MONOTONICITY

|Sₙ₊₁| ≥ |Sₙ|

XXVI. PIPELINE

Π: X → S₀

Steps:

• ingestion
• traversal (ordered)
• parsing
• chunking
• frame construction

XXVII. CHUNKING

u ∈ 𝔹* → (c₁, …, c_k)

Constraints:

• |cᵢ| = constant
• no overlap
• full coverage

XXVIII. HEADER INTEGRATION AXIOM

∀f ∈ F:

H_d ⊂ f

J(f) = J(H_d ⊕ Q’_f ⊕ p_f)

XXIX. CONTEXT BINDING

∀f:

h_f depends on H_d

⇒ header is cryptographically bound

XXX. STORAGE MODEL

Serialized form:

σ(Sₙ) = J(f₀) ∥ J(f₁) ∥ … ∥ J(fₙ)

XXXI. ERROR MODEL

• invalid frames rejected
• hash mismatch ⇒ abort
• partial writes truncated to valid prefix

XXXII. EXECUTION MODEL

Time complexity:

O(|X|)

Memory:

O(1)

XXXIII. SYSTEM BOUNDARY

Defined:

• structure
• ordering
• integrity

Not defined:

• semantics
• interpretation

XXXIV. FINAL FORM

Sₙ₊₁ = Sₙ ∪ Δₙ

Hₙ = H(J(fₙ) ∥ Hₙ₋₁)

J(f) = J(H_d ⊕ Q’_f ⊕ p_f)

XXXV. RESULT

• full reproducibility
• append-only persistence
• cryptographic integrity
• header-bound state
• deterministic reconstruction

XXXVI. CLOSURE

𝓚 is a closed deterministic system over 𝔹*

with canonical serialization, header-integrated state, and append-only evolution.

So GitHub just updated their Copilot data usage policy. The short version: interaction data from all user tiers — including free users — will be used to train and improve their models, and it’s opt-in by default. If you’re reading this with a knot in your stomach, you’re not alone.

Let’s skip the outrage cycle and focus on the actual problem: how do you figure out what data you’re exposing, and how do you lock it down?

The Real Problem: You Don’t Know What’s Being Sent

Here’s what caught most people off guard. It’s not just your code that’s being collected — it’s your interaction data. That means prompts, suggestions you accepted or rejected, and the context surrounding those interactions. If you’ve been using Copilot to help debug a production issue at 2am, that context went somewhere.

The frustrating part isn’t that data collection exists. It’s that the defaults changed silently, and most developers won’t notice until someone posts about it on Reddit.

Step 1: Check Your Current Settings

First, let’s see where you actually stand. Head to your GitHub settings and check what’s enabled:

https://github.com/settings/copilot

You’re looking for the section about data usage and telemetry. On individual accounts, you should see toggles for allowing GitHub to use your data for product improvement. On organization accounts, admins control this at the org level.

If you’re managing a team, check the org-level settings too:

https://github.com/organizations/YOUR_ORG/settings/copilot

Step 2: Audit What You’ve Already Sent

Before you flip any switches, it helps to know what’s already out there. You can request a data export from GitHub to see what they’ve collected:

# Request your GitHub data export via the API
curl -X POST 
  -H "Authorization: Bearer $GITHUB_TOKEN" 
  -H "Accept: application/vnd.github+json" 
  https://api.github.com/user/migrations 
  -d '{"repositories": [], "lock_repositories": false}'

This won’t show you Copilot interaction data specifically, but it’s a good starting point for understanding your overall data footprint. For Copilot-specific data, you’ll need to go through the GitHub privacy contact page and submit a Subject Access Request.

Step 3: Opt Out Properly

Here’s the step-by-step to actually opt out. This matters because there are multiple settings and missing one means you’re still sharing data.

For individual users:

1. Go to Settings → Copilot
2. Find the telemetry/data sharing section
3. Disable “Allow GitHub to use my data for product improvement” (or however they’ve worded it this week)
4. While you’re there, review the code snippet collection settings too

For organization admins:

# Check your org's current Copilot policy via the API
curl -s 
  -H "Authorization: Bearer $GITHUB_TOKEN" 
  -H "Accept: application/vnd.github+json" 
  https://api.github.com/orgs/YOUR_ORG/copilot/billing 
  | python3 -m json.tool

Org admins can enforce opt-out across the entire organization, which is the move if you’re dealing with proprietary code.

Step 4: Set Up a Local Safety Net

Opting out is one thing, but if you want real control, you need to think about what leaves your machine in the first place. Here’s a .gitconfig approach to remind yourself:

# Add a pre-commit hook that warns about sensitive patterns
# Save this as .git/hooks/pre-commit and chmod +x it

#!/bin/bash
# Check for common sensitive patterns before commit
SENSITIVE_PATTERNS=(
  "API_KEY"
  "SECRET"
  "password"
  "private_key"
  "BEGIN RSA"
)

for pattern in "${SENSITIVE_PATTERNS[@]}"; do
  if git diff --cached --diff-filter=ACM | grep -qi "$pattern"; then
    echo "WARNING: Possible sensitive data detected: $pattern"
    echo "Review your staged changes before committing."
    # Uncomment the next line to block the commit entirely
    # exit 1
  fi
done

This doesn’t stop Copilot from seeing your code in the editor — that ship sails the moment you type. But it adds a layer of awareness about what’s in your repo.

Step 5: Consider Your Editor-Level Options

If you’re really serious about this, you can control things at the editor level. VS Code lets you configure which files Copilot can access:

// In your VS Code settings.json
{
  "github.copilot.enable": {
    "*": true,
    "plaintext": false,
    "markdown": false,
    "yaml": false  // often contains config/secrets
  },
  // Disable Copilot for specific file patterns
  "github.copilot.advanced": {
    "excludeFiles": [
      "**/.env*",
      "**/secrets/**",
      "**/config/production.*"
    ]
  }
}

This is actually my preferred approach. I keep Copilot on for the code I’m writing but exclude anything that might contain infrastructure secrets or sensitive configuration.

The Bigger Picture: Building Better Habits

Honestly, this GitHub situation is a symptom of a broader problem. Every AI coding tool is hungry for training data, and the incentives will always push toward more collection, not less. Here’s what I’ve started doing across all my projects:

• Separate sensitive config from code. Use environment variables and external secret managers. If it never hits your editor, it can’t be collected.
• Review your extensions periodically. Not just Copilot — any AI extension could be phoning home. Check what telemetry each one sends.
• Use .gitignore patterns aggressively. Even for files that shouldn’t exist in the repo, having the ignore pattern is a safety net.
• Read the policy updates. Yeah, I know. Nobody does this. But a 5-minute skim every few months beats finding out on Reddit that your data practices changed.

Prevention: Automate the Boring Parts

Set up a quarterly reminder to audit your settings. Seriously, put it in your calendar. These policies change, defaults get reset during updates, and new features get opted in without fanfare.

For teams, consider writing this into your onboarding docs. New developer joins? Part of their setup checklist should include reviewing data sharing settings on every tool they install. It takes five minutes and saves everyone a headache later.

# Quick audit script — run this periodically
#!/bin/bash
echo "=== GitHub Copilot Settings Audit ==="
echo "Checking GitHub CLI auth status..."
gh auth status 2>&1
echo ""
echo "Current Copilot settings:"
gh api /user/copilot 2>/dev/null || echo "Could not fetch Copilot settings (check your token scopes)"
echo ""
echo "Remember to also check:"
echo "  - https://github.com/settings/copilot"
echo "  - Your org settings if applicable"
echo "  - VS Code extension telemetry settings"

The goal isn’t paranoia. It’s informed consent. Use the tools if they make you productive — just know what you’re trading for that productivity, and make sure it’s a trade you’re actually choosing to make.

SAP ABAP Performance Optimization: Identifying and Fixing Bottlenecks in Real-World Systems
If you’ve spent any meaningful time in SAP development, you already know the feeling: a report that worked fine in the development system crawls to a halt in production, or a background job that used to finish overnight now runs well into the next business day. ABAP performance optimization isn’t a luxury skill—it’s a core competency for anyone who takes SAP engineering seriously. In this guide, I’ll walk you through a structured, battle-tested approach to diagnosing and resolving performance bottlenecks in ABAP programs, drawing on patterns I’ve encountered across dozens of real-world enterprise deployments.

We’ll go beyond generic advice. You’ll leave with a repeatable methodology, working code examples, and a mental model for thinking about performance at a system architecture level.

Why ABAP Performance Still Matters in the HANA Era

A common misconception I hear from teams moving to S/4HANA is: “HANA is so fast, we don’t need to worry about performance anymore.” That’s dangerously wrong. HANA changes where your bottleneck lives, but it doesn’t eliminate bottlenecks. You can absolutely write catastrophically slow ABAP on HANA if you’re not thinking architecturally.

The good news is that many of the principles remain the same. The bad news is that some patterns that were merely suboptimal on classic databases become actively harmful on HANA because they prevent the optimizer from pushing logic down to the database layer. More on that shortly.

Before we dive into solutions, let’s establish a diagnostic framework. Blindly optimizing without measurement is how you waste two weeks making the wrong thing 10% faster.

Step 1: Measure Before You Optimize — The SAT and Runtime Analysis Tools

The single most important rule in performance work is: never guess, always measure. SAP provides excellent built-in tooling that most developers underutilize.

ABAP Profiler (SAT)

Transaction SAT (the ABAP Trace) is your first stop. It gives you a hierarchical breakdown of where runtime is actually being spent, down to individual statements and method calls. Run it in the environment that exhibits the problem—ideally a production-representative system with realistic data volumes.

What to look for in SAT output:

• Database time vs. ABAP time ratio: If >70% of time is in DB calls, your problem is SQL. If it’s in ABAP processing, look at loops, string operations, and function call overhead.

• Hit counts: A SELECT statement executed 50,000 times inside a loop is a classic N+1 problem.

• Self time hotspots: Methods with disproportionately high self-time are prime candidates for optimization.

SQL Trace (ST05)

For database-heavy programs, complement SAT with ST05. This shows you the actual SQL being generated, execution times, and critically—whether the database is doing full table scans. If you see a SELECT with no WHERE clause filtering on an indexed column, that’s your smoking gun.

HANA-Specific: EXPLAIN PLAN and PlanViz

On S/4HANA systems, open the SAP HANA cockpit or use the SQL console in HANA Studio to run EXPLAIN PLAN on your generated SQL. This reveals whether HANA is using indexes, performing merge joins, or—worst case—spilling to disk.

Step 2: The Most Common ABAP Performance Anti-Patterns

After years of reviewing ABAP codebases, certain patterns appear again and again. Let me walk you through the most impactful ones.

Anti-Pattern 1: SELECT Inside a LOOP (The N+1 Problem)

This is the number one performance killer in ABAP systems. It looks innocent in small-data scenarios and devastating at scale.

" ❌ WRONG APPROACH — N+1 SELECT anti-pattern
SELECT * FROM vbak INTO TABLE @DATA(lt_orders)
  WHERE erdat = @sy-datum.

LOOP AT lt_orders INTO DATA(ls_order).
  " This executes one SELECT for EVERY order — catastrophic at scale
  SELECT SINGLE * FROM vbap INTO @DATA(ls_item)
    WHERE vbeln = @ls_order-vbeln.
  " process ls_item...
ENDLOOP.

The fix: use a JOIN or a secondary SELECT with FOR ALL ENTRIES — but use FOR ALL ENTRIES carefully. It has its own gotchas.

" ✅ CORRECT APPROACH — Single JOIN or buffered secondary select

" Option A: JOIN approach (preferred when relationship is straightforward)
SELECT vbak~vbeln, vbak~kunnr, vbap~posnr, vbap~matnr, vbap~kwmeng
  FROM vbak
  INNER JOIN vbap ON vbap~vbeln = vbak~vbeln
  INTO TABLE @DATA(lt_order_items)
  WHERE vbak~erdat = @sy-datum.

" Option B: FOR ALL ENTRIES (use when JOIN is impractical)
" CRITICAL: Always check that the driving internal table is NOT EMPTY
" before using FOR ALL ENTRIES — an empty table fetches ALL records!
IF lt_orders IS NOT INITIAL.
  SELECT * FROM vbap
    INTO TABLE @DATA(lt_items)
    FOR ALL ENTRIES IN @lt_orders
    WHERE vbeln = @lt_orders-vbeln.
ENDIF.

Note that FOR ALL ENTRIES cannot be combined with ORDER BY, DISTINCT, or aggregate functions. It also deduplicates the driving table implicitly. Know these constraints cold.

Anti-Pattern 2: Unnecessary Data Transfer — SELECT *

Fetching all columns when you need three is wasteful both in network transfer and memory allocation. This becomes particularly problematic on wide tables like BSEG or KONV.

" ❌ Fetches all ~200 columns of BSEG across the network
SELECT * FROM bseg INTO TABLE @DATA(lt_bseg)
  WHERE bukrs = '1000' AND gjahr = '2024'.

" ✅ Fetch only what you need
SELECT bukrs, belnr, gjahr, buzei, hkont, dmbtr, shkzg
  FROM bseg
  INTO TABLE @DATA(lt_bseg_slim)
  WHERE bukrs = '1000' AND gjahr = '2024'.

On HANA, column-store architecture means this matters even more—the engine only reads the columns you specify from storage, which has real I/O implications at scale.

Anti-Pattern 3: Inefficient Internal Table Operations

Internal table performance is often overlooked, but with large datasets it’s significant. The key principle: use the right table type for the right access pattern.

" Table type selection guide:

" STANDARD TABLE — O(n) linear search. OK for small tables or sequential processing.
" Use SORT + BINARY SEARCH for repeated keyed reads.
DATA: lt_standard TYPE STANDARD TABLE OF mara WITH DEFAULT KEY.

" SORTED TABLE — O(log n) access by key. Good for read-heavy workloads with known key.
DATA: lt_sorted TYPE SORTED TABLE OF mara
  WITH UNIQUE KEY matnr.

" HASHED TABLE — O(1) access by key. Best for large lookup tables with unique keys.
DATA: lt_hashed TYPE HASHED TABLE OF mara
  WITH UNIQUE KEY matnr.

" ❌ Common mistake: LOOP + READ TABLE LINEAR on a large standard table
LOOP AT lt_large_table INTO DATA(ls_item).
  READ TABLE lt_lookup INTO DATA(ls_ref)
    WITH KEY field1 = ls_item-field1. " O(n) each time = O(n²) total
ENDLOOP.

" ✅ Use HASHED TABLE for the lookup to get O(n) total
DATA: lt_hashed_lookup TYPE HASHED TABLE OF ty_ref
  WITH UNIQUE KEY field1.
" Populate lt_hashed_lookup once, then:
LOOP AT lt_large_table INTO DATA(ls_item).
  READ TABLE lt_hashed_lookup INTO DATA(ls_ref)
    WITH TABLE KEY field1 = ls_item-field1. " O(1) each time = O(n) total
ENDLOOP.

Anti-Pattern 4: Missing or Misused Indexes

Always verify that your WHERE clause conditions align with existing database indexes. In transaction SE11, you can inspect table technical settings and index definitions. A WHERE clause that doesn’t lead with an indexed column—especially the first field of a composite index—will trigger a full table scan.

One nuance that bites people on HANA: HANA’s column store handles non-indexed reads better than traditional row-store databases, but this doesn’t mean you should ignore indexes. For high-frequency transactional reads, a well-placed secondary index still makes a dramatic difference.

Step 3: Pushing Logic to the Database — Code-to-Data vs. Data-to-Code

This is where HANA-era thinking diverges most sharply from classic ABAP patterns. The guiding principle in modern SAP development is code-to-data: let the database engine do the heavy lifting rather than fetching raw data and processing it in ABAP.

If you’ve read our article on ABAP CDS Views for High-Performance Data Modeling, you already know that CDS views are a central vehicle for this paradigm. Instead of fetching millions of rows and aggregating them in ABAP, push the aggregation into a CDS view or an AMDP (ABAP Managed Database Procedure).

" ❌ Data-to-code: Fetch everything, aggregate in ABAP
SELECT * FROM vbrp INTO TABLE @DATA(lt_billing_items)
  WHERE fkdat BETWEEN @lv_start AND @lv_end.

DATA: lv_total TYPE p DECIMALS 2.
LOOP AT lt_billing_items INTO DATA(ls_item).
  lv_total += ls_item-netwr.
ENDLOOP.

" ✅ Code-to-data: Let the database aggregate
SELECT SUM( netwr ) AS total_revenue
  FROM vbrp
  INTO @DATA(lv_db_total)
  WHERE fkdat BETWEEN @lv_start AND @lv_end.

Extend this thinking to GROUP BY, HAVING, subqueries, and window functions (supported in Open SQL on HANA). The database is extraordinarily good at set-based operations. ABAP loops, by contrast, are inherently sequential.

Step 4: Buffering Strategies — When and How to Cache

Not all performance problems are about raw SQL efficiency. Sometimes the answer is to read data less frequently through intelligent buffering.

SAP Table Buffering

For configuration and master data tables that are read frequently but change rarely, SAP’s built-in table buffering (configured in SE11 → Technical Settings) can eliminate database roundtrips entirely by serving data from the application server’s shared memory. Suitable candidates: T-code control tables, configuration entries, country/currency tables.

Be aware of the synchronization lag: buffered tables have a configurable synchronization interval. For transactional data that must be current, buffering is inappropriate.

Application-Level Caching with Shared Objects

For computed data that’s expensive to derive but reused across multiple requests or users, SAP Shared Objects (transaction SHMA) provides a shared memory area accessible across sessions. This is advanced territory but extremely powerful for lookup-heavy scenarios.

" Conceptual pattern for shared object caching
" (Full implementation requires area class and root class definitions)
CLASS lcl_material_cache DEFINITION.
  PUBLIC SECTION.
    CLASS-METHODS: get_instance RETURNING VALUE(ro_instance) TYPE REF TO lcl_material_cache.
    METHODS: get_material
      IMPORTING iv_matnr TYPE matnr
      RETURNING VALUE(rs_material) TYPE mara
      RAISING cx_sy_ref_is_initial.
  PRIVATE SECTION.
    DATA: mt_cache TYPE HASHED TABLE OF mara WITH UNIQUE KEY matnr.
ENDCLASS.

CLASS lcl_material_cache IMPLEMENTATION.
  METHOD get_material.
    " Check in-memory cache first
    READ TABLE mt_cache INTO rs_material WITH TABLE KEY matnr = iv_matnr.
    IF sy-subrc <> 0.
      &quot; Cache miss: fetch from DB and store
      SELECT SINGLE * FROM mara INTO rs_material
        WHERE matnr = iv_matnr.
      IF sy-subrc = 0.
        INSERT rs_material INTO TABLE mt_cache.
      ENDIF.
    ENDIF.
  ENDMETHOD.
ENDCLASS.

Step 5: Parallel Processing for CPU-Bound Workloads

When your bottleneck is pure ABAP processing time rather than database I/O, consider parallel processing using ABAP’s background task framework or CALL FUNCTION … STARTING NEW TASK.

" Parallel processing pattern using asynchronous RFC
" Partition work into chunks, dispatch each chunk to a parallel work process

DATA: lt_partitions TYPE TABLE OF ty_partition,
      lv_task       TYPE string.

" Build partitions of your workload
" (implementation of partition logic omitted for brevity)

DATA(lv_counter) = 0.
LOOP AT lt_partitions INTO DATA(ls_partition).
  lv_counter += 1.
  lv_task = |TASK_{ lv_counter }|.

  CALL FUNCTION 'Z_MY_PARALLEL_WORKER'
    STARTING NEW TASK lv_task
    DESTINATION IN GROUP DEFAULT
    PERFORMING on_task_complete ON END OF TASK
    EXPORTING
      is_partition = ls_partition.

  " Handle resource limits gracefully
  IF sy-subrc <> 0.
    &quot; Fall back to synchronous processing for this partition
    CALL FUNCTION &#039;Z_MY_PARALLEL_WORKER&#039;
      EXPORTING is_partition = ls_partition.
  ENDIF.
ENDLOOP.

&quot; Wait for all async tasks to complete
WAIT UNTIL lv_counter = 0 UP TO 300 SECONDS.

A word of caution from experience: parallel processing introduces complexity around error handling and result aggregation. Only reach for it when profiling clearly shows ABAP CPU time as your bottleneck and the work is naturally parallelizable without shared state conflicts. Also check with your basis team about available work process capacity before enabling this in production.

Putting It All Together: A Performance Review Checklist

When you’re reviewing ABAP code for performance—your own or a colleague’s—run through this checklist systematically:

• Profile first: Use SAT and ST05 to identify the actual bottleneck before touching any code.

• Eliminate N+1 queries: No SELECTs inside loops. Use JOINs or FOR ALL ENTRIES (with the empty-check guard).

• Select only needed columns: Never use SELECT * on wide tables in production code.

• Align WHERE clauses with indexes: Verify in SE11 that your filter fields have index coverage.

• Choose the right internal table type: HASHED for lookup, SORTED for ranged reads, STANDARD for sequential processing.

• Push logic to the database: Aggregations, filters, joins—let the database engine handle these.

• Consider buffering: Stable master/config data should leverage table buffering or application caching.

• Parallelize only when warranted: Profile-driven decision, not premature optimization.

This connects closely to the clean code principles I discussed in ABAP Clean Code: 10 Golden Rules for Readable and Maintainable SAP Code—performance and readability aren’t in conflict when you understand both deeply. And if you’re working with modern CDS-based architectures, the data modeling decisions covered in ABAP CDS Views for High-Performance Data Modeling directly impact the performance patterns discussed here.

Conclusion

Performance optimization in ABAP is a discipline, not a bag of tricks. The developers and architects who consistently deliver fast, scalable SAP solutions aren’t the ones who memorize every optimization hack—they’re the ones who measure rigorously, understand their data access patterns, and choose the right tool for each situation.

The patterns in this article—eliminating N+1 queries, selecting only needed data, choosing appropriate table types, and embracing the code-to-data paradigm—will address the majority of real-world performance issues you’ll encounter. Start with measurement, fix the biggest bottleneck first, and measure again. That feedback loop is more valuable than any single optimization technique.

As your systems grow and data volumes increase, revisit these fundamentals regularly. What performs acceptably at 100,000 records can become critically slow at 10 million. Build performance awareness into your code review culture now, and you’ll spend far less time firefighting in production later.

What’s Next?

In a follow-up article, we’ll dive into ABAP Unit Testing and Test-Driven Development—because the discipline of writing testable code is deeply connected to writing performant, maintainable code. A well-structured, decoupled ABAP program is almost always easier to optimize than a tightly coupled monolith.

Have you encountered a particularly tricky ABAP performance problem in your work? Drop it in the comments below. I read every one, and real-world war stories often make the best follow-up content. If this article saved you debugging time, share it with your team—performance awareness is most effective when it’s a team culture, not an individual habit.

JSON Web Tokens (JWTs) are the backbone of modern authentication. If you are building an API, chances are you are verifying a JWT on almost every single incoming request.

Because it happens so frequently, JWT verification is a prime candidate for optimization. But if you look at how standard JWT verification works, there is a lot of hidden overhead.

The Standard “Slow Path”

A JWT consists of three parts separated by dots: header.payload.signature. To verify a standard token, your application typically has to do the following:

1. Split the string by the . character using String.split/2 and/or regex.
2. Base64-decode the header.
3. Parse the resulting JSON string into a map.
4. Extract the kid (Key ID) and alg (Algorithm) claims.
5. Look up the correct public or symmetric key.
6. Verify the signature against the payload.

Steps 1 through 4 require allocating memory for new binaries, running a Base64 decoder, and firing up a JSON parser—all just to figure out which key to use.

If your application is minting its own tokens, 99% of the incoming requests are going to use your current, active signing key. Doing all that decoding and parsing on every request is wasted effort.

Our own header is always the same

The realization that speeds this up is simple: if you control the active signing key, the JWT header is entirely predictable.

Instead of extracting the token’s header to find the key, we can flip the process upside down. We can pre-calculate exactly what the Base64-encoded header will look like for our active key, and use it to fast-track both signing and verifying tokens.

Setup: Caching the Header

The first step is to calculate the expected header at startup (or upon key rotation) and cache it. We use Erlang’s :persistent_term for blazing fast, concurrent read access.

defmodule MyApp.Jwt do
  @doc "Run this at application startup or when rotating keys"
  def setup_fast_path(kid, alg \ "HS256") do
    expected_header =
      # we need deterministic JSON with predictable key ordering
      ~s({"alg":"#{alg}","typ":"JWT","kid":"#{kid}"})
      |> Base.url_encode64(padding: false)

    :persistent_term.put(:jwt_header, expected_header)
  end
end

Fast-track verification

The real magic happens when checking incoming requests. We use Elixir’s binary pattern matching to instantly route the token based on whether it starts with our cached header:

def verify(token) do
  expected_header = :persistent_term.get(:jwt_header, nil)

  case token do
    # Does the token start with our exact pre-calculated header?
    <<^expected_header::binary, ?., payload_and_sig::binary>> -> 
      fast_verify(payload_and_sig)

    # ... slow path fallback ...
    _ ->
      slow_verify(token)
  end
end

The binary pattern matching is Elixir at its finest. The VM doesn’t need to split strings or allocate new memory to do so. It simply looks at the bytes of the incoming token, checks if they match the pinned expected_header variable followed by a . character, and assigns the rest of the binary to payload_and_sig. We now know the signing key and algorithm without parsing the header!

We are not done, however, and can take pattern matching one step further to split the payload and signature. This relies on two things: we know the signature’s length in advance and can use byte_size/1 to determine the length of the whole (in constant time!):

# For HS256, the encoded signature is always exactly 43 characters
@hs256_sig_len 43

def fast_verify(payload_and_sig) do
  payload_len = byte_size(payload_and_sig) - @hs256_sig_len - 1

  case payload_and_sig do
    <<enc_payload::binary-size(payload_len), ?., enc_sig::binary-size(@hs256_sig_len)>> ->
      # We skipped String.split/2 entirely!
      # Now we just decode the payload and verify the signature...
      do_crypto_verify(enc_payload, enc_sig)

    _ ->
      {:error, :malformed_token}
  end
end

Signing

Of course, we can also use our precomputed header to speed up token signing (also leveraging iolists to prevent creating unnecessary intermediate binaries):

def sign(payload, key) do
  header = :persistent_term.get(:jwt_header, nil)
  enc_payload = payload |> JSON.encode!() |> Base.url_encode64(padding: false)
  mac_base = [header, ?., enc_payload]
  sig = :crypto.mac(:hmac, :sha256, key, mac_base) |> Base.url_encode64(padding: false)
  IO.iodata_to_binary([mac_base, ?., sig])
end

What if the header is not fully deterministic? Poly1305 and Base64 Magic

The optimization above works flawlessly for algorithms like HS256 or EdDSA. But what if you are using a MAC generated via Poly1305?

Poly1305 requires a unique nonce for every single invocation to remain secure. This means our JWT header suddenly needs to look like this:
{"alg":"Poly1305","typ":"JWT","nonce":"<random_string>","kid":"my_key"}

Because the nonce changes every time, we can no longer pre-calculate the entire Base64 encoded header. Does this mean we have to fall back to the slow path? Not if we use a little Base64 math.

Base64 works by encoding 3 bytes of raw data into 4 characters. If a string’s byte length is exactly a multiple of 3, it encodes cleanly without padding (=) and without carrying over bits into the next character block. Such encoded strings can then be safely concatenated without invalidating the encoding!

We can exploit this by carefully crafting our JSON header so the static parts are multiples of 3 bytes:

• Part 1: {"alg":"Poly1305","typ":"JWT","nonce":" (Length is 39, and 39 / 3 = 13. Perfect!)
• Part 2: <dynamic_nonce>", (The nonce is 12 bytes, which encodes to 16 bytes. We add ", and part 2 is now 18 bytes – dividable by 3!)
• Part 3: "kid": (Length is 6!)
• Part 4: "my_key"} (The last part has no length requirement because nothing will be concatenated to its tail)

Because Parts 1, 2 and 3 are multiples of 3, we can safely pre-calculate their Base64 equivalents and concatenate them with the encoded dynamic bits later:

# Pre-encoded static chunks (safe to concatenate)
@p1305_h ~s({"alg":"Poly1305","typ":"JWT","nonce":") |> Base.url_encode64(padding: false)
@p1305_kid_seg ~s("kid":) |> Base.url_encode64(padding: false)

def setup_poly1305_fast_path(kid) do
  exp_htail = ~s("#{kid}"}) |> Base.url_encode64(padding: false)
  :persistent_term.put(:jwt_p1305_header, exp_htail)
end

Now, we can add a new pattern match to our verify/1 function to catch Poly1305 tokens. We just extract the encoded nonce_seg right out of the middle of the binary string:

def verify(token) do
  exp_header = :persistent_term.get(:jwt_header, nil)
  exp_htail  = :persistent_term.get(:jwt_p1305_header, nil)

  case token do
    # 1. The Simple Fast Path (HS256, etc)
    <<^exp_header::binary, ?., payload_and_sig::binary>> -> 
      fast_verify(payload_and_sig)

    # 2. The Base64 Magic Fast Path (Poly1305)
    <<@p1305_h, nonce_seg::binary-24, @p1305_kid_seg, ^exp_htail::binary, ?., payload_and_sig::binary>> ->
      fast_p1305_verify(nonce_seg, payload_and_sig)

    # 3. THE SLOW PATH
    _ -> 
      slow_verify(token)
  end
end

By ensuring our JSON keys and values add up to multiples of 3, we can continue to use Elixir’s blazing fast binary pattern matching to route tokens, skipping the JSON parser entirely even when parts of the header are highly dynamic.

The Fallback

Of course, the slow path cannot be completely removed. If you rotate your signing keys, users with valid tokens signed by the old key will still need to access your API.

Because their tokens will have a different kid in the header, the fast path pattern match will naturally fail. The case statement falls back to slow_verify, which does the traditional Base64 decoding, JSON parsing, and dynamic key lookup.

The beauty of this architecture is that the fast path handles 99% of your traffic with near-zero overhead, while the slow path gracefully catches edge cases, legacy tokens, and key rotations without the caller ever needing to know the difference. And although we don’t parse the headers, we don’t assume anything here; because of the binary pattern matching, there’s not a single header byte that is not exactly what we expect it to be. JWT-verification speed is improved by about 30% for normal-sized JWTs.

A real-world example (using only OTP!) that supports key rotation and multiple signing algorithms including HMAC-SHA256, EdDSA and Poly1305 can be found in Charon’s JWT token factory.

If you’ve spent any significant time working on SAP integration projects, you know the pain: point-to-point connections that grow into unmaintainable spaghetti, synchronous calls that create cascading failures, and integration landscapes that buckle under load. I’ve seen enterprise systems brought to their knees not by complex business logic, but by brittle, tightly-coupled integration patterns. That’s exactly why SAP BTP Event Mesh and event-driven architecture deserve serious attention from every architect working in the SAP ecosystem today.

In this article, I want to go beyond the marketing slides. We’ll look at what event-driven architecture really means in an SAP context, when it genuinely solves your problems, and how to implement it pragmatically using SAP Business Technology Platform’s Event Mesh service. By the end, you’ll have concrete patterns and code you can start applying in your own landscape.

Why Point-to-Point Integration Is Quietly Killing Your Architecture

Let’s be honest about something most consultants won’t say in a kickoff meeting: most SAP integration landscapes are architectural accidents, not architectural decisions. They grew organically—one RFC call here, one IDoc there, a SOAP service added because someone needed it urgently. Before long, you’re maintaining hundreds of direct connections with no clear ownership.

The fundamental problem is tight coupling. When System A calls System B synchronously:

• A’s availability depends on B’s availability

• A’s performance depends on B’s response time

• Any change in B’s interface requires coordinated changes in A

• Scaling A independently of B is practically impossible

Event-driven architecture inverts this dependency. Instead of System A calling System B, System A announces that something happened. System B (and C, and D) decide independently whether they care about that event. The producer doesn’t know or care about consumers. That’s a fundamentally different—and far more resilient—way to build integrations.

“Decoupling is not a nice-to-have. In distributed enterprise systems, it’s the difference between a system that recovers from failure gracefully and one that fails completely.”

Understanding SAP BTP Event Mesh: The Basics You Need

SAP BTP Event Mesh is a fully managed, cloud-based messaging service that acts as the central broker in your event-driven landscape. It’s built on open standards—AMQP 1.0 and MQTT—which means it’s not a proprietary black box you’ll regret in five years.

Here are the core concepts you need to internalize before designing anything:

Topics vs. Queues

Topics support a publish-subscribe model. A producer publishes an event to a topic, and any number of subscribers receive it. This is ideal for broadcasting business events like sap/s4/BusinessPartner/Changed.

Queues support point-to-point or competing consumers. Messages persist until consumed. Use queues when you need guaranteed delivery and exactly-once processing semantics.

In practice, the most robust pattern combines both: publish events to a topic, then create queue subscriptions that bind to specific topic patterns. This gives you broadcast capability and guaranteed delivery.

Event Mesh Namespaces and Topic Naming Conventions

This is where I see architects make costly mistakes early on. Topic names in Event Mesh follow a hierarchical structure, and SAP recommends a specific convention for business events:

<namespace>/<source-type>/<source-name>/<event-type>/<version>

# Example:
mycompany/sap/s4hana/BusinessPartner/Created/v1
mycompany/custom/warehouseapp/StockLevel/Updated/v2

Define this naming convention before you start building. Retrofitting topic names across a live system is genuinely painful—trust me on this one.

The SAP S/4HANA Event-Driven Integration Pattern

SAP S/4HANA natively supports outbound event publishing via its Business Event Handling framework. When a business object changes—a Business Partner is created, a Sales Order is posted—S/4HANA can publish a structured CloudEvent directly to SAP BTP Event Mesh.

Configuring S/4HANA Outbound Bindings

The configuration path in S/4HANA is: SAP Fiori → Enterprise Event Enablement → Channel Bindings. You’ll create a channel pointing to your Event Mesh service instance, then configure topic bindings for specific business events.

The events S/4HANA publishes conform to the CloudEvents 1.0 specification—an important detail because it means your consumers can be built with any language or framework that understands this open standard.

A typical CloudEvent payload from S/4HANA looks like this:

{
  "specversion": "1.0",
  "type": "sap.s4.beh.businesspartner.v1.BusinessPartner.Created.v1",
  "source": "/default/sap.s4.beh/MYCLNT",
  "id": "a7c8f2e1-4b3d-4a9e-8c1d-2f5e3a7b9c0d",
  "time": "2025-03-25T14:30:00Z",
  "datacontenttype": "application/json",
  "data": {
    "BusinessPartner": "1000012345"
  }
}

Notice something important: the payload contains only the key of the changed object, not its full state. This is called the notification event pattern. The consumer receives a notification that something changed, then queries the source system (via OData API) to retrieve the full, current state. This avoids data consistency issues when events are processed out of order.

Building an Event Consumer: Python Example with SAP BTP

Let’s get practical. Here’s how you’d build a Python-based event consumer that listens to Business Partner creation events and processes them. This would run as a Cloud Foundry application or Kyma workload on SAP BTP.

# requirements.txt
# solace-pubsubplus==1.7.0
# requests==2.31.0
# python-dotenv==1.0.0

import os
import json
import logging
import requests
from solace.messaging.messaging_service import MessagingService
from solace.messaging.resources.queue import Queue
from solace.messaging.receiver.message_receiver import MessageHandler
from dotenv import load_dotenv

load_dotenv()
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class BusinessPartnerEventHandler(MessageHandler):
    """
    Handles incoming Business Partner events from SAP Event Mesh.
    Implements the notification-then-fetch pattern.
    """

    def __init__(self, s4_base_url: str, oauth_token: str):
        self.s4_base_url = s4_base_url
        self.oauth_token = oauth_token

    def on_message(self, message):
        try:
            payload = json.loads(message.get_payload_as_string())
            logger.info(f"Received event: {payload.get('type')}")

            # Extract the Business Partner key from the event
            bp_id = payload.get('data', {}).get('BusinessPartner')
            if not bp_id:
                logger.warning("Event received with no BusinessPartner key. Skipping.")
                return

            # Fetch full Business Partner data from S/4HANA OData API
            bp_data = self._fetch_business_partner(bp_id)
            if bp_data:
                self._process_business_partner(bp_data)

        except json.JSONDecodeError as e:
            logger.error(f"Failed to parse event payload: {e}")
        except Exception as e:
            logger.error(f"Unexpected error processing event: {e}")
            # In production: implement dead-letter queue logic here
            raise  # Re-raise to trigger redelivery

    def _fetch_business_partner(self, bp_id: str) -> dict | None:
        """
        Fetch current Business Partner state from S/4HANA OData API.
        This is the 'notification-then-fetch' pattern in action.
        """
        url = f"{self.s4_base_url}/sap/opu/odata/sap/API_BUSINESS_PARTNER/A_BusinessPartner('{bp_id}')"
        headers = {
            "Authorization": f"Bearer {self.oauth_token}",
            "Accept": "application/json"
        }

        try:
            response = requests.get(url, headers=headers, timeout=10)
            response.raise_for_status()
            return response.json().get('d')
        except requests.exceptions.Timeout:
            logger.error(f"Timeout fetching BP {bp_id}. Will retry via redelivery.")
            raise  # Trigger message redelivery
        except requests.exceptions.HTTPError as e:
            if e.response.status_code == 404:
                logger.warning(f"BP {bp_id} not found—may have been deleted. Ignoring.")
                return None
            raise

    def _process_business_partner(self, bp_data: dict):
        """
        Your actual business logic goes here.
        Examples: sync to downstream CRM, update MDM system, trigger workflow.
        """
        bp_id = bp_data.get('BusinessPartner')
        bp_name = bp_data.get('BusinessPartnerFullName')
        bp_category = bp_data.get('BusinessPartnerCategory')

        logger.info(f"Processing BP: {bp_id} | Name: {bp_name} | Category: {bp_category}")
        # TODO: Add your downstream system integration here

def create_messaging_service() -> MessagingService:
    """Creates and connects the Solace messaging service for Event Mesh."""
    broker_props = {
        "solace.messaging.transport.host": os.environ["EVENT_MESH_HOST"],
        "solace.messaging.service.vpn-name": os.environ["EVENT_MESH_VPN"],
        "solace.messaging.authentication.scheme.basic.username": os.environ["EVENT_MESH_USER"],
        "solace.messaging.authentication.scheme.basic.password": os.environ["EVENT_MESH_PASSWORD"],
    }
    service = MessagingService.builder().from_properties(broker_props).build()
    service.connect()
    return service

def main():
    logger.info("Starting Business Partner Event Consumer...")

    messaging_service = create_messaging_service()
    handler = BusinessPartnerEventHandler(
        s4_base_url=os.environ["S4_BASE_URL"],
        oauth_token=os.environ["S4_OAUTH_TOKEN"]
    )

    queue_name = os.environ["EVENT_MESH_QUEUE_NAME"]  # e.g., "bp-created-consumer"
    queue = Queue.durable_exclusive_queue(queue_name)

    receiver = messaging_service.create_persistent_message_receiver_builder()
        .with_message_auto_acknowledgement()
        .build(queue)

    receiver.start()
    receiver.receive_async(handler)

    logger.info(f"Listening on queue: {queue_name}")
    logger.info("Press Ctrl+C to stop.")

    try:
        import time
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        logger.info("Shutting down consumer...")
        receiver.terminate()
        messaging_service.disconnect()

if __name__ == "__main__":
    main()

A few things worth highlighting in this code:

• Re-raise on transient errors: Timeout errors cause the exception to propagate, which prevents acknowledgement and triggers redelivery. This is correct behavior for infrastructure failures.

• Swallow 404s: If an object was deleted before your consumer processed the creation event (rare but possible), return gracefully rather than crashing.

• Secrets from environment: Never hardcode credentials. In BTP Cloud Foundry, these come from service bindings; in Kyma, from Kubernetes secrets.

Critical Architectural Decisions You’ll Face

Decision 1: Notification Events vs. Event-Carried State Transfer

I touched on this earlier, but it deserves deeper treatment. You have two options:

Notification event: Publish only the key. Consumer fetches current state on demand. This is SAP’s default pattern and works well when consumers need fresh data and the source system is reliable.

Event-Carried State Transfer (ECST): Publish the full state snapshot in the event payload. Consumers process it without calling back. This works better for high-throughput scenarios where you want to minimize API calls, but risks stale data if events are processed out of order.

My recommendation: start with notification events for SAP-sourced data. Move to ECST only if you have measured performance problems with the fetch-on-demand approach.

Decision 2: At-Least-Once vs. Exactly-Once

Event Mesh guarantees at-least-once delivery. This means your consumers must be idempotent—processing the same event twice should produce the same result as processing it once. Design for this from day one, not as an afterthought.

A simple idempotency strategy: maintain a processed-events table keyed by CloudEvent id. Check before processing; insert after. This adds latency but prevents duplicate processing.

Decision 3: Error Handling and Dead Letter Queues

Define your dead letter queue (DLQ) strategy before going live. In Event Mesh, you configure maximum redelivery attempts on a queue. After those attempts, the message lands in a DLQ. You need:

• A monitored DLQ per consumer queue

• Alerting when DLQ depth exceeds a threshold

• A replay mechanism for batch reprocessing after fixes

This is operational discipline, not just architecture. Skipping it will cost you a late-night incident eventually.

Event Mesh and SAP Integration Suite: How They Fit Together

If you’re working with SAP Integration Suite (formerly Cloud Platform Integration), you can use the AMQP Sender and Receiver adapters to connect integration flows to Event Mesh. This creates a powerful hybrid: event-driven triggering combined with Integration Suite’s rich transformation and orchestration capabilities.

A common pattern I’ve implemented:

• S/4HANA publishes a Business Partner Changed event to Event Mesh

• An Integration Suite iFlow subscribes to the queue

• The iFlow fetches full data from the S/4HANA OData API, transforms it, and calls a downstream REST API

• On failure, Integration Suite’s error handling framework manages retries and alerting

This keeps your integration logic in Integration Suite (where your team already has tooling and expertise) while gaining the resilience benefits of event-driven triggering. You don’t have to choose one or the other.

If you’re also exploring how RPA and AI automation integrate with SAP BTP’s broader architecture, you might find the approach we discussed in SAP BTP ile Akıllı Süreç Otomasyonu: RPA ve AI Entegrasyonunda Mimari Kararlar relevant—many of the same decoupling principles apply when triggering automation from events.

Monitoring and Observability: Don’t Skip This

An event-driven system without proper observability is a debugging nightmare. At minimum, implement:

• Distributed tracing: Propagate the CloudEvent id as a correlation ID through your entire processing chain. This lets you trace a single business event across multiple services.

• Queue depth monitoring: Sustained queue depth growth means your consumers can’t keep up. Alert on this before it becomes a crisis.

• Consumer lag metrics: Track the age of the oldest unprocessed message. Stale messages indicate processing problems.

• DLQ depth alerting: Any message in a DLQ needs investigation. Zero tolerance here.

SAP BTP Event Mesh exposes metrics through SAP Cloud ALM and the BTP Cockpit. Integrate these into your existing monitoring stack, whether that’s Dynatrace, Grafana, or SAP Cloud ALM itself.

When NOT to Use Event-Driven Architecture

I’d be doing you a disservice if I only told you about the benefits. Event-driven architecture adds operational complexity. Here’s when it’s not the right choice:

• You need an immediate response: If the user is waiting for a result, synchronous REST is simpler and more appropriate.

• Simple, stable integrations: A single integration between two systems that rarely changes doesn’t need the overhead of an event broker.

• Your team lacks operational maturity: Running a message broker well requires expertise. Don’t introduce Event Mesh if your team can’t support it properly.

• Strict ordering requirements: While Event Mesh supports ordering within a partition, complex ordering guarantees add significant architectural complexity.

The mark of a good architect isn’t using sophisticated patterns everywhere—it’s knowing when simplicity serves you better.

Key Takeaways

Let me distill the most important points from everything we’ve covered:

• Event-driven architecture solves tight coupling, which is the root cause of most integration fragility in SAP landscapes.

• SAP BTP Event Mesh is a production-grade, standards-based broker that integrates natively with S/4HANA’s event publishing framework.

• Use the notification-then-fetch pattern for SAP-sourced events to avoid data consistency issues.

• Design consumers to be idempotent from day one—at-least-once delivery is guaranteed, so duplicate processing must be harmless.

• Invest in observability before you go live: distributed tracing, queue monitoring, and DLQ alerting are non-negotiable in production.

• Choose synchronous patterns when appropriate—event-driven is not universally superior, just suited to specific problems.

Event-driven architecture is one of those shifts that feels abstract until you’ve lived through a cascading failure caused by synchronous coupling. After that experience, the value of decoupling becomes viscerally clear. Start small—pick one high-value integration, implement it with Event Mesh, and let the operational experience inform your broader strategy.

What’s Your Experience?

Have you implemented event-driven patterns in your SAP landscape? I’d love to hear what challenges you encountered—particularly around idempotency, ordering, and team adoption. Drop your thoughts in the comments below, and if you found this useful, share it with your team. These are the conversations that help our entire community build better systems.

AI agents are starting to transact with each other. They negotiate deals, exchange data, and move money. But how does one agent know the other is worth talking to? AgentTalk, built by Skye Meta, answers that question with on-chain wallet conditions verified by InsumerAPI.

The Problem: Agents Need Trust Before Communication

When two AI agents meet on a network, they face a fundamental question. Should I talk to this thing? Passwords prove you know a secret. API keys prove you have access. Neither proves financial capacity, community membership, or on-chain reputation.

An agent negotiating a supply chain deal needs to know its counterpart controls real assets. An agent operating inside a DAO needs to verify the other agent actually holds governance tokens. A compliance-gated data exchange needs proof that EAS credentials are on-chain, not just claimed.

Static credentials do not solve this. A password issued yesterday says nothing about what the agent holds today. On-chain state changes continuously. The trust primitive has to be dynamic, verifiable, and composable.

How AgentTalk Works

AgentTalk is a condition-gated communication protocol for AI agents. Every channel has wallet conditions. Every session is verified on-chain. The flow has five steps.

        - **Declare.** The channel creator defines conditions: which tokens, which chains, what thresholds. Up to 10 conditions per channel across 32 chains (30 EVM + Solana + XRPL).
        - **Connect.** An agent joins the channel and presents its wallet address.
        - **Attest.** AgentTalk calls InsumerAPI (`POST /v1/attest`) to verify both wallets against the channel conditions. Boolean results. Pass or fail.
        - **Session.** If both wallets pass, each agent receives an ECDSA-signed attestation JWT. The agents can now communicate.
        - **Verify.** At any point during the session, either agent can request re-verification. AgentTalk calls the attest endpoint again. If the wallet no longer meets the conditions, the session ends immediately.

This is the key principle: sell the token, lose the session. Access is not static. It is continuously tied to on-chain state. The moment an agent’s wallet no longer meets the conditions, the communication channel closes. No revocation lists, no admin intervention. The blockchain is the authority.

AgentTalk exposes this flow through four endpoints on skyemeta.com: POST /api/agenttalk/declare (create a channel with conditions), POST /api/agenttalk/join (join and receive per-agent attestation JWTs), GET /api/agenttalk/session (check session status), and POST /api/agenttalk/buy-key (purchase an InsumerAPI key with USDC). Under the hood, each session call hits InsumerAPI’s POST /v1/attest for on-chain verification.

What Makes This Different

Traditional agent communication protocols rely on identity. You authenticate once, and you are in. AgentTalk replaces identity with verifiable state.

        - **Composable conditions.** A single channel can require holdings across multiple chains and token types. Hold 1,000 USDC on Ethereum and an NFT on Base and a governance token on Arbitrum. All verified in one attestation call.
        - **Boolean results, not raw amounts.** InsumerAPI returns pass or fail for each condition. The other agent never learns how much you hold. Only whether you meet the threshold.
        - **Privacy-preserving.** No wallet contents are exposed. No transaction history is shared. The attestation confirms specific conditions without revealing anything beyond the yes-or-no answer.
        - **Independently verifiable.** Every attestation is ECDSA-signed by InsumerAPI. Any agent can verify the signature offline using the public JWKS endpoint. You do not need to trust AgentTalk. You trust the cryptography.

The API Behind It

AgentTalk calls POST /v1/attest for every session establishment and every re-verification. The request includes the wallet address and an array of conditions. The response includes a boolean result for each condition, a condition hash for tamper detection, and an ECDSA signature over the entire payload.

Agents that want additional assurance can request format: "jwt" in the attest call. This returns an ES256-signed JWT alongside the standard response. The JWT is verifiable by any standard library (Kong, Nginx, Cloudflare Access, AWS API Gateway) via the JWKS endpoint at /.well-known/jwks.json.

The verification chain is simple. You send conditions in. You get cryptographically verifiable results out. No trust in the intermediary required. The attestation is signed, the signature is public-key verifiable, and the condition hash lets you confirm the conditions were not altered in transit.

Autonomous Key Purchase

Agents that use AgentTalk start with 10 free InsumerAPI calls. After that, they need their own API key. The purchase is fully autonomous.

The agent sends USDC, USDT, or BTC to the InsumerAPI payment address on any supported chain (EVM, Solana, or Bitcoin). Then it calls POST /v1/keys/buy with the transaction hash. The key is issued automatically. No human in the loop. No credit cards. No signup forms.

This matters because the whole point of agent-to-agent communication is autonomy. If an agent has to wait for a human to purchase an API key, the system is not truly autonomous. AgentTalk agents buy their own verification capacity with on-chain payments, the same way they verify each other with on-chain state.

Use Cases

        - **Supply chain negotiation.** Agent A wants to negotiate a bulk purchase. Agent B requires proof that Agent A's wallet holds sufficient USDC before opening the channel. The condition is verified on-chain. No bank statements, no credit checks.
        - **DAO-to-DAO workflows.** Two DAOs want to coordinate on a joint proposal. Each DAO's agent must prove it holds governance tokens from both organizations. Conditions are composable, so this is a single attestation call.
        - **Compliance-gated data exchange.** An agent needs to share sensitive data but only with counterparts that hold specific EAS credentials on-chain. AgentTalk verifies the credential holdings before the session opens.
        - **AI agent marketplaces.** A marketplace of AI services requires agents to hold the marketplace's service token to participate. Sell the token, lose access to the marketplace. Dynamic, not static.

Wallet Identity as a Primitive

AgentTalk treats the wallet as the agent’s fingerprint. Not an identity document, not a login credential, but a verifiable state container. What the wallet holds right now determines what the agent can do right now.

For more on wallet identity as a primitive, see Your Wallet Is Your Fingerprint on the Skye Meta blog.

The pattern is straightforward. AgentTalk defines the conditions. InsumerAPI verifies them on-chain. The attestation is cryptographically signed. Any participant can verify it independently. No centralized authority decides who gets access. The blockchain decides.

Built on InsumerAPI

    Share this article

        [

            Share on X
        ](#)
        [

            LinkedIn
        ](#)
        [

            Reddit
        ](#)


            Discord



            Copy Link

InsumerAPI is free to start. Get an API key and try it. View API Docs