About Organization
Ahmad A.Abed
Ahmad A. Abed Holding (AAABED Group) is a leading B2B supplier in the Kingdom of Saudi Arabia, specializing in FMCG and bakery ingredients. The company serves a high-value customer base, with its top 20% of accounts representing over SAR 2.19 billion in net value. AAABED Group operates complex sales and distribution workflows supported by SAP ERP, and continues to invest in digital transformation to drive smarter, data-driven decision-making across its operations.
Deliver the right solutions on the leading cloud platform
Cloud Consultancy
Unmatched due to SUDO’s wide knowledge and experience with the top three public cloud providers: AWS, Microsoft Azure and Google Cloud, we provide cloud solutions that work uniquely in line with your business model. With our experienced professionals based in Dubai, UAE you’ll be able to gain deep insights into critical trends and opportunities in cloud technologies, access real-time data analytics, and modernize your entire infrastructure.
The Challenge
Excessive Agency Risk
Granting the LLM direct database access could allow prompt injection attacks to maliciously draft orders, exfiltrate sensitive customer profiles, or corrupt live SAP data, making direct ERP access completely unacceptable.
Data Integrity
Material keys in raw SAP billing tables frequently mismatched the master catalog. If the LLM operated on this raw data, it would hallucinate product identities and surface inaccurate reorder recommendations to the sales team.
Fail-Closed Requirement
In the event of an AWS API throttle or catalog lookup failure, the agent could not be allowed to surface unvalidated SKUs under any circumstances, requiring a strictly fail-closed system posture.
Why Choose SUDO
SUDO is a trusted AWS Premier Tier Services Partner with deep expertise in agentic AI, enterprise security, and ERP integration on AWS. SUDO brings strong experience in designing zero-trust AI architectures that protect mission-critical systems while delivering intelligent automation at scale.
The Solution
SUDO engineered a decoupled, zero-trust agentic architecture on AWS, aligned with the AWS AI Security Framework, ensuring full ERP protection, AI integrity, and human oversight at every step.
- Amazon Bedrock agents read commercial history exclusively from an Amazon RDS MySQL read replica, with zero contact with live SAP
- Application state and drafted orders written to separate tables on the same RDS instance, ensuring no autonomous SAP commits
- Agent workers operate on Amazon ECS Fargate, orchestrated by AWS Step Functions managing job fan-outs asynchronously via Amazon SQS
- AWS IAM enforces least-privilege access with agent roles strictly allowlisted to read-only tools only
- Write actions cryptographically denied until a human user authenticated via Amazon Cognito explicitly approves the draft in Step Functions
- AWS Glue precomputes eligible Top 20% customer segments on the replica before the agent is invoked, preventing unauthorized data-scoping decisions
- Agent relies on hardcoded deterministic tools to calculate due-scores, with Claude used solely to generate English justifications
- Amazon Bedrock Guardrails deployed to block unsafe topics and prompt injections
- Mandatory fail-closed catalog validation ensures only verified SKUs are returned in all cases
Results & Benefits
The agentic reorder workload delivered measurable outcomes across security, data integrity, and
operational confidence for AAABED Group.
Zero-Risk ERP Integration: Achieved 0% autonomous ERP commits by completely air gapping the agent’s write path from the live SAP environment.
Eliminated AI Hallucinations: Normalized material match rates from 0% to 99.2% via ETL processing on the replica prior to LLM ingestion, securing AI input integrity end to end.
Guaranteed Fail-Closed Security: Blocked 100% of unvalidated product recommendations through mandatory deterministic catalog checks and Amazon Bedrock Guardrails.
Comprehensive Auditability: Full visibility into the AI lifecycle secured by logging every tool call, decision, and human approval step via AWS CloudTrail, Amazon CloudWatch, and AWS X-Ray.
Reusable Zero-Trust Blueprint: The read-only data plane, deterministic tooling, and Step Functions HITL gate architecture serves as a repeatable pattern for securing agentic workflows across any enterprise ERP environment.
