Five SaaS incumbents installed agent tollgates. Your COGS just got a third landlord.

Five enterprise SaaS vendors — ServiceNow, SAP, Workday, HubSpot, DataDog — moved within a single cycle to meter or block AI agent access to their data. ServiceNow's Action Fabric charges per action. DataDog caps its MCP server at 5,000 requests per day and 50,000 per month. SAP won't endorse external agents, which functionally bans them from a $200B platform. Workday and HubSpot are shipping usage-based pricing with details pending. JPMorgan's Mark Murphy named it correctly: a tax on customers using outside AI agents.

This isn't five product teams arriving at the same idea by accident. Unmetered agent traffic breaks capacity planning and per-seat pricing at the same time. A tollgate fixes both in one control plane, and the incumbents get to convert their existing data moat into recurring revenue for the AI era. The mechanism is obvious once you stop pretending it's about governance.

The consequence for anyone shipping agentic features is that the cost model that used to have one layer now has three: model inference on top, agent orchestration in the middle, platform data-access fees on the bottom. Every agent workflow that touches ServiceNow to fetch a ticket, DataDog to check a metric, and Workday to update a record is now a metered event three times over. The pricing page shows a small per-action number. The invoice does not match the pricing page.

Yes, but — the counter-reading is that customer tolerance snaps within a year, AWS's Matt Garman gets his way, and the tollgates collapse under pressure from open alternatives. Possible. Nothing in the last eighteen months of SaaS pricing behavior supports it, and Anthropic taking a preferred connector in Action Fabric tells you the agent vendors will legitimize the tolls rather than fight them. The tollgate holds until someone builds a credible open substitute for the underlying system of record, which is not a 2026 problem.

The number that broke the ROI story

KKR's Pete Stavros put the actual AI earnings uplift across the portfolio at 5%, not 50%. That is the first honest number from a tier-one GP with every incentive to round up. Uber's CTO admitted publicly they "blew through" the AI budget after turning on agentic tools. Sierra's Bret Taylor called the ramp "pricey before ROI." A16z's speedrun cohort is spending $300K per year on agents in lieu of engineers, and Cursor bills are exceeding engineer salaries at some seats.

Stack that against the input side: GPT-5.5 net cost inflation lands between 49% and 92% once completion-token effects settle out, Anthropic killed flat-rate subs, and now the platform layer adds its own meter. A company paying half again as much for inference, new per-action fees to three SaaS vendors, selling into a buyer measuring 5% uplift, is running negative gross margin on the AI feature that was supposed to defend ARR. The math doesn't work at the current pricing on any layer. Something gives.

The other thing that broke this week

While the finance side was reshaping, the security side crossed a line worth naming. The Mini Shai-Hulud worm propagated from npm to PyPI to PHP using stolen maintainer tokens, hitting SAP CAP framework packages (mbt v1.2.48, @cap-js/db-service v2.10.1, @cap-js/postgres v2.2.2, @cap-js/sqlite v2.2.2), PyTorch Lightning, and intercom-client. Confirmed scope: 8.3M compromised downloads, 1,800+ repos leaking credentials. This is the first production-grade cross-ecosystem supply-chain worm, and its propagation mechanism is your CI/CD secrets.

Same week, NVD announced it will only enrich CVEs for KEV entries, government-used software, and things it deems critical — citing AI-generated vulnerability report volume as the cause. Any scanner that reads CVSS scores from NVD as ground truth just lost coverage. Add EPSS and OSV to the pipeline this sprint, or the next Dependabot dashboard is lying to you by omission.

What to do this week

One action, not five. Instrument every external agent tool-call with source system, tier (standard API vs. metered action layer), and estimated dollars per call, and emit it as a structured metric into whatever observability stack you already run. Not a spreadsheet exercise for finance. A first-class metric in the orchestrator, alongside latency and success rate, refreshed continuously.

Do this before your next finance review. The teams that walk into the ServiceNow or Workday renewal with per-call economics and workload projections will negotiate from strength. The teams that discover the number when the first invoice lands will negotiate from a CFO's email, and the CFO will already have decided what the answer is.

And while you're rewiring the orchestrator: add --ignore-scripts to npm install in CI, require pre-built wheels for Python, and rotate every CI/CD secret that touched a pipeline between April 29 and May 4. The tollgate is a margin problem you have a quarter to solve. The worm is a credential problem you have hours.