The platform
A model reasons.
Code queries.
Most “AI for your data” products let a language model write the query. That is the one decision AnrilX does not take, because a plausible query against the wrong table returns a plausible number, and nothing downstream can tell that it is wrong.
The guarantee
Four things the AI is simply unable to do
Not rules it has been told to follow and might ignore: things it has no way to do in the first place. Each one closes off a way that AI systems have confidently produced wrong answers that looked right.
It cannot name the wrong entity
The model picks a label out of a candidate list the platform built from the catalogue. An entity outside that list is not something it can express, not something it is discouraged from doing.
It cannot write a filter
Filters are structured predicates, validated field by field against the live catalogue. A hand-written filter string has no representation anywhere in the query format.
It cannot write a date
A period arrives as a token (this_month, last_quarter, ytd) resolved against the server clock. So a saved view called “last 30 days” still means the last 30 days a year from now.
A wrong field name is repaired or refused
Every field is resolved against the catalogue with both a similarity floor and a margin over the runner-up. Ambiguity escalates instead of guessing, and the repair is shown.
Step by step
What happens after you ask, in five steps
- 01
It learns the shape of your SAP
On the first run it reads what your system exposes: which business objects exist, which fields they carry, how they relate. It learns the shape of your SAP, never the contents.
- 02
It turns your question into a precise request
This is the one place the AI is used. It decides what you meant: which business object, which measure, which grouping, which period. It fills in a form, it does not write code.
- 03
Ordinary code fetches the numbers
From there the AI is out of the loop entirely. Normal software takes that filled-in form and asks SAP for the data, the same way every single time.
- 04
Every request is checked before it goes
Your rules are applied before anything leaves. If the check cannot be completed for any reason, the request simply does not happen; it never defaults to allowing it.
- 05
The numbers are calculated, not written
Totals, differences and percentages are worked out by arithmetic. The AI writes the sentence around the figures; it never writes the figures.
A plan, compiled before anything ran
Build me a sales performance dashboard for this year.
Five steps, compiled before anything ran. The model produced this list; the platform produced the queries. That split is the whole of “a model reasons, code queries”, and the plan is shown while it runs rather than after.
- 1 Compile widget 1: total sales orders, year to date
- 2 Compile widget 2: total net revenue, year to date
- 3 Compile widget 3: net revenue by sales organisation, bar chart
- 4 Compile widget 4: order counts per sales organisation, table
- 5 Assemble the dashboard and store the compiled queries
Source: 4 compiled queries against zsd_sales_order / ZA_SalesOrder · 0 filters written by the model · 0 dates written by the model
The model chose from a candidate list the platform built from your catalogue. An entity outside that list is not something it can express.
Provenance
A number you can check
Every figure prints the entity set it was read from, the SAP field and aggregation behind it, the filter applied and the window covered. The label a question used (“revenue”, “discount”, “spend”) is never allowed to stand in for what was actually computed.
It is a small thing to build and it changes the conversation entirely: a figure with its source is something a controller can argue with, and a figure without one is something they have to take on faith.
Total net revenue
4,182,940SAR
Source: zsd_sales_order / ZA_SalesOrder net revenue = sum of TotalNetAmount Q3 2026
Filter: SalesOrganization eq '2100' · 238 documents read
Governed by SD-RPT-047. Consignment allowance applied. The unadjusted figure is marked not for circulation.
Deployment
On-premise, inside your landscape
AnrilX runs in your environment and talks to your SAP over OData v4. There is no shared multi-customer store, and your transactional data is not copied out to be indexed.
Connects to
SAP S/4HANA over OData v4, cloud or on-premise, using your existing service catalogue.
Runs as
A containerised stack you deploy: API, policy engine, database and web front end.
Authorises with
Your SAP authorisations. A person sees precisely what their own SAP account already permits.
Where it stops
Six things the architecture will not do
These follow from the design above rather than being caveats bolted onto it.
-
One compiled query cannot express everything. A question that needs a rule looked up, a fact established first, or arithmetic across several answers escalates to a slower path that reasons, at the cost of a full turn.
-
Whether the word in your question describes the SAP field that answered it is a judgement no threshold separates cleanly. The platform states what it computed rather than deciding, which is a weaker guarantee than the other four and the honest one.
-
It reads your SAP at question time and does not maintain a copy. That is deliberate, and it means answer speed is bounded by what your system can serve.
-
A period the model cannot resolve, an entity outside the candidate list, an ambiguous field name: each escalates rather than being guessed at. Some questions come back asking to be narrowed.
-
It is not a migration, a data warehouse or a replacement for your reporting estate. It removes the reason most new report requests get raised.
-
Modules are connected through your OData catalogue. Anything your landscape does not expose over OData is not reachable, however well the question is phrased.
Questions people ask us
What actually happens between my question and the figure?
The platform works out which part of your SAP could answer it, and offers the AI a shortlist. The AI picks from that shortlist and fills in what you meant: the business object, the measure, the period. From there ordinary code does the rest: it checks the request against your rules, asks SAP for the data, and prints the figures with the workings underneath. The AI never sees a way to reach your data directly.
How many model calls does a question cost?
One, to understand the question, and none to run it. Re-opening a saved dashboard or turning a page of a saved report uses none at all, because the work was done once when the question was first asked. Harder questions that need real reasoning cost more and take longer, which is why the platform tries the simple route first.
What stops it querying the wrong thing?
It can only choose from a shortlist the platform built, so there is no way for it to name something that is not on that list. The filters and dates are checked one by one before anything runs, and where a word in your question could mean two different fields, it asks you which rather than picking the likelier one.
Does it need a data warehouse or an extract?
No. It reads your SAP at the moment you ask. What it keeps is a map of how your system is laid out, not the business data inside it.
What happens when it cannot answer?
It says which of four things went wrong: the question is outside what a query can express, the data is not there, a business rule of yours governs the figure, or the system was unreachable. An outage is reported as an outage rather than as a rejected request, because rephrasing cannot fix one and can fix the other.
Read next
Governance
How it is governed
Fail-closed policy on every call, human approval on every write, and a complete record of both.
ReadCapability
Ask it in plain language
What the compiler lane looks like from the other side: a question in, figures with their source out.
ReadInsight
Why a model never writes the query
The failure this architecture exists to prevent, and what it costs to prevent it.
ReadBring the question your reports cannot answer
Thirty minutes against a live SAP system we provide: no access to yours, nothing to set up. If it cannot answer, you find that out in half an hour rather than three months into a pilot.