The Board Room

Five Incumbents, One Week, One Message: Your AI Agents Pay to Enter

ServiceNow's Action Fabric announcement landed the same week as moves from SAP, Workday, HubSpot, and Datadog, each installing usage-based charges for AI agent access to enterprise data. JPMorgan called it what it is: "a tax on customers using outside AI agents." This is not coordination in the legal sense. It is five incumbents reading the same demand curve and arriving at the same pricing instinct without a phone call.

The incumbents hold the data: customer records, HR systems, IT workflows, financial transactions. Agents are worthless without access to it. Metered access, rate limits, and outright bans all convert an existing data moat into recurring revenue for the AI era.

The Spectrum: From SAP's Ban to AWS's Open Rebellion

SAP is the most aggressive, outright banning unauthorized AI agents from touching its systems. ServiceNow sits in the middle with metered access through Action Fabric, which it describes as a "universal action layer where all systems are calling directly into our Action Fabric." That is not a revenue play. It is a bid to become the middleware of enterprise AI. AWS CEO Matt Garman went on the record warning that incumbents who "try to protect what they have could get into trouble," which is a declaration of competitive intent dressed as customer advocacy.

The Cost Structure Nobody Modeled

Enterprise agent deployment cost is now multi-layered: Anthropic or OpenAI for the model, the agent platform for orchestration, and each enterprise SaaS vendor for data access. That compounding will slow adoption in cost-sensitive enterprises. The more interesting detail is that Claude Cowork and ServiceNow's Agent Fabric integration tells you agent providers are willing to legitimize these tollgates, which lowers the probability of a customer-led revolt.

The Contradiction That Creates the Window

Infrastructure capex of $700B, roughly three times 2024 levels, will produce compute abundance and push inference costs down. The access layer sitting between that cheap compute and enterprise data is heading the opposite direction, toward extraction. Value is migrating from the model to the gate. The firms that own data access own the margin. Everyone else competes on a shrinking slice.

The Strategic Fork

A reasonable skeptic would say the tollgate model will collapse under customer pressure within a year. The skeptic might be right. Nothing in the last eighteen months of SaaS pricing behavior suggests it. In an agent world where data access is metered, three positions survive:

1. Incumbents holding data need a tollgate strategy that captures revenue without triggering displacement to open alternatives.
2. Agent builders need tollgate costs modeled into unit economics and a view on whether to vertically integrate into data.
3. Challengers get a once-in-a-decade narrative to position as the open alternative, and SAP's ban-first posture creates the largest displacement opportunity enterprise software has seen in a decade.

The Rule 10b-5 Ruling: If Your AI Has 'Ultimate Authority,' You're the Speaker

The Northern District of California held that an AI exercising "ultimate authority" over ad content makes the platform the "speaker" under securities fraud law. A reasonable skeptic would file this as a narrow advertising ruling and move on. The reasonable skeptic is half right. The holding is narrow. The logic is not. Anywhere a model makes the final call on content that could be construed as misleading — product descriptions, financial disclosures, healthcare recommendations — the operator is potentially the maker of the statement.

The useful question for any executive running an AI-powered product is: where in the product does the model have ultimate authority over what the customer sees? Those are your liability surfaces.

Pre-Release Vetting Makes It Bipartisan

The Trump administration is moving toward pre-release model review after Anthropic's Mythos was deemed too dangerous for public release. That settles one question. AI regulation is now bipartisan. When an avowedly deregulatory administration reaches for pre-release oversight, any plan pricing in two to three more years of permissive regulation should be repriced now. Pre-release review is also a compliance moat. Firms with documentation, audit trails, and government relationships clear faster. Firms without them wait, on a timeline nobody controls.

The Lock-in Nobody Sees Coming: Model-Harness Co-optimization

Frontier labs are now post-training models against specific tool harnesses, with tool names, schemas, and interaction patterns baked into the weights. The numbers are stark:

Developer tool selection and model selection are no longer independent decisions. They are a coupled system with compounding switching costs. Organizations running them as separate procurement tracks are accruing technical debt that does not show up on any current dashboard.

The Convergence

Legal liability for autonomous AI output plus technical lock-in through harness co-optimization equals a vendor dependency with both legal and engineering costs to exit. The board-deck version of the architecture decision this quarter is how much autonomy the AI gets and which model-harness pair is chosen. The complete version is that the same decision fixes both legal exposure and switching cost for the next two years. Those are not separable anymore.

Mini Shai-Hulud: The First Production-Grade Cross-Ecosystem Worm

This is not another dependency confusion attack. Mini Shai-Hulud is the first production-grade supply chain worm that propagates across multiple package ecosystems using stolen credentials. Starting with SAP's CAP framework packages (500K+ weekly downloads), it jumped to PyTorch Lightning on PyPI, then propagated into Intercom npm packages — ultimately compromising 8.3 million downloads and exposing credentials in 1,800+ repositories. Wiz attributes this to TeamPCP.

Your organization's security boundary now extends to every dependency in your transitive graph, across every package ecosystem your developers touch. The traditional model of 'scan and patch' is inadequate when a single compromised token can poison packages upstream of your entire development organization.

The Trust Infrastructure Is Being Targeted

Simultaneously, the security vendors themselves are under systematic attack:

• DigiCert: Social engineering through support portal led to theft of 60 code-signing certificates; Microsoft Defender began flagging legitimate DigiCert certs as malicious
• Trellix, Checkmarx, Cisco: All disclosed source code repository breaches in the same timeframe
• NVD: Effectively collapsed — AI-generated disclosures now exceed human analyst processing capacity; enrichment is being triaged rather than completed

When the defenders are compromised and the cataloging infrastructure has collapsed, the operating assumption about what a "patched" system means has changed.

The AI Amplification Loop

AI is simultaneously accelerating offensive discovery (BSidesSF CTF: AI team solved every challenge using coordinator-LLM architecture) and degrading defensive infrastructure (NVD triage overwhelmed by AI-generated reports). A 16× improvement in CTF completion signals approaching parity between AI and human offensive operators. That same architecture pointed at production systems is continuous automated exploitation.

The Operational Gap

The traditional model of "scan, assess CVSS, patch on schedule" is running on assumptions that no longer hold. CVE enrichment is delayed or absent. Security vendors' own certificates may be untrustworthy. And a single stolen CI/CD token can compromise packages across three ecosystems faster than any response team can react. The gap requires runtime security, continuous integrity verification, and real-time credential rotation — not periodic scanning.

The Pattern That Mints $100B Businesses

Amazon's formal launch of Supply Chain Services is the most instructive pattern recognition exercise on offer this quarter. The company that built AWS by externalizing internal compute is running the identical play in logistics, packaging fulfillment, ocean and air shipping, and truck transportation into a purchasable platform. Procter & Gamble and 3M are already customers. FedEx and UPS dropped more than ten percent the same day, which is the equity market's way of reading the press release without waiting for the sell-side note.

The template has not changed in twenty years: build the capability for internal use at scale, then sell the excess capacity once the unit economics are structurally better than anything competitors can field. Cloud in 2006 is a hundred billion dollars of revenue today. Logistics in 2026 is a 1.3 trillion dollar addressable market. Satellite connectivity via Leo is the 2027 version of the same sentence.

For an operator running a business with physical distribution, the question is not whether to use Amazon logistics. It is how to play the FedEx and UPS counter-offers this competition will trigger while preserving optionality.

Stripe Executes the Same Play in Payments

Stripe has quietly assembled the first vertically integrated stablecoin payments stack: Bridge provides issuance and a national bank charter, Privy operates 110 million programmable wallets, Valora is the consumer application targeting 250 million users, and Tempo L1 is a permissioned settlement layer carrying a five billion dollar valuation. All of it sits atop 1.9 trillion dollars in existing payment volume. The OCC's proposed rule happens to protect Bridge's model while threatening Coinbase's, which is the sort of coincidence regulators rarely concede is a coincidence.

Why This Matters Beyond Logistics and Payments

Both cases answer the same strategic question: which internal capabilities could be externalized as platform services. The qualifying criteria do not look mysterious once the examples are laid out next to each other:

1. It was built for internal use at scale.
2. The unit economics are now structurally better than what competitors can field.
3. External demand exists at multiples of internal consumption.
4. The package can be shipped without exposing competitive intelligence.

The Counter-Position: Platform Dependency Risk

For everyone on the consuming side, the lesson from AWS is older than the current cycle. The platform vendor is also a competitor with visibility into demand signals, and companies that treated fulfillment as a vendor relationship are now discovering that the vendor can read their demand curve as clearly as their own planners can. Every category Amazon enters as infrastructure eventually becomes a category where the margin lives with Amazon. The three-year question for any operator is whether the company is building a platform or renting one, and most firms will answer that question by default rather than by decision.