Operations Overview¶
Use this page after ARC-1 has passed its first safe read. It routes service owners to the correct operational runbook without mixing platform deployment, target diagnostics, performance controls, and incident response in one long page.
Choose the operational task¶
| Task | Start with |
|---|---|
| Operate an SAP BTP Cloud Foundry deployment | BTP Administration |
| Diagnose a multi-target destination, exclusion, identity, or route | Multi-Target Administration |
| Upgrade, roll back, or pin a version | Updating |
| Investigate a failed tool call or correlate request IDs | Log Analysis |
| Protect SAP from runaway clients or size concurrency | Rate Limiting |
| Choose or troubleshoot request-driven caching | Caching |
| Verify API key, OIDC, XSUAA, roles, or Principal Propagation | Authentication Test Process |
| Review production controls before exposure | Production Security |
Shared operating model¶
Regardless of deployment platform:
- identify the exact ARC-1 version, route, target, user, and request ID;
- confirm the instance safety ceiling and the caller's scope before investigating SAP;
- distinguish ARC-1 authentication from SAP identity and SAP authorization;
- make the smallest reversible configuration change;
- retest one safe read and the intended negative boundary; and
- reconcile emergency runtime changes into the durable deployment configuration.
ARC-1 health means only that the process is running. It does not prove Destination Service, Principal Propagation, SAP authorization, a usable target registry, data/SQL policy, or MCP client token freshness.
Platform-specific ownership¶
SAP BTP Cloud Foundry¶
Use BTP Administration for configuration ownership, restart/restage/redeploy decisions, XSUAA role collections, DCR signing secrets, scaling, upgrades, rollback, and customer handover. For initial setup or topology selection, return to SAP BTP: Start Here.
Docker or another shared host¶
Use the Docker guide for image, volume, networking, and container lifecycle details. Then apply the same updating, logging, rate-limiting, caching, and security controls. Ensure TLS and Layer A authentication are provided before exposing HTTP transport to a network.
Local development¶
Local stdio and test environments are not production services. Use Local Development for developer workflows and Authentication Test Process only when validating an HTTP authentication path.
Incident evidence to preserve¶
Collect only secret-safe evidence:
- ARC-1 version and configuration source, without credentials or tokens;
- timestamp, request/correlation ID, public target ID, action, status, and duration;
- relevant ARC-1 audit/application log records;
- Cloud Foundry instance and service-binding health where applicable;
- Cloud Connector and SAP error references owned by the respective administrators; and
- the last known-good version and rollback procedure.
Never paste unredacted cf env, destination exports containing credentials, bearer tokens,
Principal Propagation assertions, cookie files, or SAP passwords into an issue or support chat.