When agents become the user: what ServiceNow's week means for enterprise SaaS architecture, pricing and control

What happened

On 28 October, OpenAI and ServiceNow expanded the partnership they signed in January⁴. OpenAI's models and agents are coming into ServiceNow products, and ServiceNow workflows become reachable from ChatGPT and Codex, with ServiceNow enforcing permissions on what an agent may do¹. No financial terms were disclosed.

The next day, ServiceNow reported subscription revenue up 21% and raised its 2026 target for AI annual contract value to $1.7 billion². Its shares still fell about 19%, which Yahoo Finance links to investor fear that AI agents will eat into software sold per seat³.

The share price is not my concern here. The pattern is: the systems of record your business runs on are being opened up so that agents, not just people, can read and change them. That changes architecture, contracts and controls at the same time.

Three ways agents reach your systems

Every enterprise SaaS tool you own will soon be used in one or more of these ways. Each needs different controls.

The vendor wants route 1, assistant providers want route 2, and your platform team probably wants route 3. You will get all three. The mistake is letting each route bring its own identity model, logs and approval rules.

What changes in the architecture

Agents need identities, not borrowed sessions. An agent acting through a person's login makes audit trails meaningless and permissions too broad. Give each agent its own identity, scoped to the actions it needs, with the person it acts for recorded alongside. ServiceNow's point that it enforces permissions on agent actions is the right direction¹; make sure the same is true for every other system.

Expose actions, not screens. Agents that click through user interfaces are fragile and hard to govern. Well-defined actions, such as "create incident" or "update record", with typed inputs, are easier to permission, test and price. This is what MCP servers and vendor action layers provide.

Load tools on demand. With dozens of systems exposed, tool definitions alone can fill a model's context. The MCP client guidance recommends discovering tools on demand rather than loading all of them up front⁵.

Keep bulk work out of the model. When an agent processes thousands of records, routing every result through the model is slow and expensive. Having the model write a short script that runs in a sandbox and returns a summary is cheaper and easier to audit⁵. It also means the sandbox, not the model, holds credentials, which is where you want them.

Trace every agent action. Use the OpenTelemetry generative AI conventions so model calls, tool calls and their costs land in the same traces as the rest of your system⁶. Without this, you cannot answer "what did the agent do?" for an auditor, or "what did it cost?" for finance. Our agent observability and agent sandboxing notes go deeper.

What changes in the contract

If agents do work that used to need a licensed person, seat counts stop describing what you buy. I expect most renewals over the next two years to mix three things: a platform fee, seats for the people who still use the product, and a metered allowance for agent activity. That shift is predicted by many analysts, but I have not seen reliable public data on how far it has gone, so treat any single forecast with care.

What you can control is your evidence. Before a renewal, know:

• how many actions agents took in the product, by type, and which person or team they acted for;
• which of those actions would otherwise have needed a licensed user;
• what the same actions would cost if run through your own agents and the vendor's API instead.

That last point is your negotiating position. If you can switch routes, you can negotiate. If every agent runs inside the vendor's product with the vendor's pricing, you cannot.

A 90-day plan

Risks to watch

• Permission creep. Agents granted broad access "for the pilot" keep it. Review agent scopes the way you review admin accounts.
• Prompt injection through records. An agent that reads tickets or emails can be steered by text inside them. See prompt-injection defence for agents.
• Regulated actions. In the EU, UK and elsewhere, automated decisions about people carry legal duties. Keep a human approval step where the law expects one; the Europe and UK pages cover the local rules.
• Vendor lock-in through agents. Agents built in one vendor's studio are hard to move. Keep business logic in your own orchestration where it matters.

CTO take

ServiceNow's week is a preview for every large SaaS vendor. Agents are becoming users of your systems of record, from the vendor's side, from assistants such as ChatGPT, and from your own platform. The organisations that do well will treat agents as a new kind of workforce: identified, permissioned, observed and costed. Do that first, and the pricing debate becomes a negotiation you can win rather than a bill you receive.

For the model-cost side of the same shift, see the economics of computer-use agents and today's tech news brief.

How I can help

I help teams design agent platforms with proper identity, tracing and cost controls, and review SaaS and AI contracts before renewal. I am based in India, the United States and the UAE, working globally. See AI architecture or analyse your challenge and bring the result to a call.