top of page

The AI Control Plane Is Still the Prize. The Moat Around It Is Thinner.

Writer: Alan L. Paris
Alan L. Paris
11 minutes ago
12 min read

Baseline agent controls are diffusing fast enough that having them no longer distinguishes anyone. Separately, AI adoption is introducing usage-sensitive cost into a subscription business. Neither shift decides who wins. Together they move the scarce layer somewhere a vendor cannot sell it.

Executive Summary

In July I argued that the control plane is where the AI governance category is concentrating, and that whoever sits between instruction and action holds the evidence, the revocation path, and the relationship with the buyer’s risk and compliance teams. That argument holds. Three developments since then narrow it.


Baseline agent controls are spreading quickly. In August, a company founded in 2024 reached general availability with a credible published control set in its first release. Having those controls is no longer a differentiator, though depth within them still may be.


AI adoption is changing delivery economics. ServiceNow’s reported subscription gross margin fell to 80.5 percent in the second quarter from 83.0 percent a year earlier, and the company attributes its full-year guidance partly to hyperscaler use and accelerating AI adoption. What the disclosure does not do is isolate how much of that pressure is inference, hyperscaler deployment, acquired products, or ordinary infrastructure.


And governance across vendor boundaries divides authority rather than extending it. ServiceNow’s own documentation, updated in July, shows publication, operational governance, discovery, and marketplace policy split across two control domains.


Two propositions follow, and they are different claims. The position is cheaper to enter, because challengers can ship baseline governance quickly. It may also be harder to hold profitably, because delivery now carries usage-sensitive cost. The first is established. The second is directionally supported and not yet proven.


What neither changes is the layer underneath. A vendor can encode and enforce authority. It cannot originate the institution’s mandate or assume the institution’s accountability.


-----------------------------------------------------------


On August 20, a company founded in 2024 shipped a set of AI agent controls that would have counted as a differentiator eighteen months ago. The agent runs with the permissions of the person who invoked it. It is scoped to a single team workspace. Everything it produces is staged as a draft. The organization decides who may publish, and whether structured review is required first. All of it arrived in the company’s first generally available release.


On the same day, ServiceNow announced an expanded partnership with Tech Mahindra, built around a dedicated AI center of excellence, industry solutions, and embedded governance frameworks delivered to customers as a services motion.


Read those two announcements next to each other and the shape of the contest is visible. One company is shipping the control set as a product feature. The other is selling the depth, integration, and operating discipline around it. That is not a coincidence of the calendar. It is what a category looks like when the checklist stops being scarce.

The July argument was straightforward. Every serious AI governance platform is fighting for the same real estate: the instant before an agent acts. Identity, permissions, a policy check, a way to stop execution, a record of what happened afterward. That moment is the control plane, and the fight for it is where the category is concentrating.


The limit was equally straightforward. A tool can stop an agent from exceeding its permissions. It cannot decide what those permissions should have been, and it cannot tell you who answers when they turn out to be wrong.


I would revise one thing. July treated the control plane as durable real estate. It is contested real estate, which is a different claim. Contested real estate can be won and still be worth less than the ground it was taken from.


A note on where I sit. I worked at ServiceNow from 2021 to 2026, most recently as Field CTO and Enterprise Architect. I use the company as the worked example throughout, because it is the clearest instance of the pattern and because its numbers and its documentation are public. Read the disclosure as context for the specificity, not as a thesis about one stock.

Serval’s Catalyst reached general availability on August 20 with the control set described above. It is a coherent answer to the questions a security reviewer asks, shipped by a company founded in 2024.

These are credible baseline safeguards. What the announcement does not establish is least-privilege delegation, mandatory separation of duties, reviewer independence, immutable evidence, or emergency revocation. Those are the questions an auditor moves to once the checklist is satisfied, and they are precisely where an incumbent can still claim depth: enforcement coverage across systems, identity integration, policy semantics, evaluation, evidence retention, and cross-platform revocation.


So the accurate claim is not that the control plane has been commoditized. It is that the minimum control set has diffused, and diffusion is enough to end an argument. The incumbent’s answer to a buyer asking about agent governance used to be a list the challenger did not have. Now the answer must be depth, integration, and evidence quality. Those are better answers. They are also the answers a vendor gives once presence has stopped being the differentiator.


This is the second time in fourteen months that a layer marketed as differentiation has proved purchasable. ServiceNow completed its acquisition of Moveworks on December 15, 2025 for approximately $2.85 billion and called it integration, while the product decisions read as replacement. The conversational AI layer, the part every vendor marketed as its own, was for sale. The baseline control set has followed on a shorter clock.

              -----------------------------------------------------------

No incumbent holds a category on a capability a challenger includes at launch. The differentiator moves to depth, and depth is harder to demonstrate in a procurement cycle.

              -----------------------------------------------------------

Subscription software has always carried real delivery cost: hosting, support, infrastructure, and services. What it carried was low incremental cost per additional user. Adding a seat consumed a rounding error of compute.


Agent work does not behave that way. Its cost scales with usage rather than with users, and some of that usage is bought from third parties. That introduces a usage-sensitive component into a business whose economics were historically dominated by subscription delivery.


The evidence that this is already happening is in the reported numbers. In the second quarter of 2026, ServiceNow’s non-GAAP subscription gross margin was 80.5 percent, down from 83.0 percent a year earlier. Full-year non-GAAP subscription gross margin guidance is 81 percent, roughly 250 basis points below 2025. On the July 22 call, CFO

Gina Mastantuono said: “On a constant currency basis, we expect subscription gross margin of 81%, reflecting more customers utilizing our hyperscaler partnerships as well as accelerating AI adoption.”


Read that as a buyer rather than an investor. The company is saying that customers using more AI makes the revenue less profitable to deliver, and it is saying so in its own guidance language. That is the most useful public statement available about what agentic AI does to a software business.


Now the limits, because they matter more than the headline.


The company does not isolate inference cost. Cost of subscription revenue moves for several reasons at once, including personnel, support for a growing subscription base, third-party cloud services, regulated-market delivery, and amortization of acquired intangibles. A 250 basis point change is not attributable to any one of them on the strength of a guidance sentence, and ServiceNow has not said it is.

The disclosure also does not reveal how much revenue is metered, how much model capacity the company buys versus hosts, or whether incremental costs are passed through in pricing. Model hosting, caching, deterministic workflow steps, negotiated capacity, and customer-supplied models all change the arithmetic, and none of them are visible from outside.


And gross margin compression is not margin collapse. Full-year non-GAAP operating margin guidance is 31.5 percent, up roughly 50 basis points year over year. Cost of revenue is rising and the company is absorbing it below the gross margin line through operating discipline. That is a management response, and so far it is working. Operating leverage can offset a cost of revenue problem for a while. It does not repeal one.


              -----------------------------------------------------------

The defensible claim: a usage-sensitive cost component has entered a subscription business, it is contributing to gross margin pressure now, and the disclosure does not yet let anyone outside the company size it or allocate it. For a buyer, the second half of that sentence is the operative part.

-----------------------------------------------------------

The strategic response to challengers is orchestration, and it is the right response.


The Tech Mahindra announcement is a clean illustration. ServiceNow describes its platform as a single pane of glass connecting intelligence to execution across the business, with the partner building industry solutions and embedding governance frameworks inside it. Partner work executes within ServiceNow’s workflows rather than beside them. If partner AI runs inside governed workflows, the interface contest matters less, because the platform participates regardless of whose reasoning engine sits on top.


That is a strong position, rationally taken. It also raises a question the announcements do not address.


Hosting another vendor’s AI inside your workflows means the workflow’s delivery cost depends on arrangements you may not fully control. Whether that compresses the platform’s margin depends entirely on contract structure. The partner may bear the compute expense. The customer may. The platform may, and price for it. Those are different outcomes, and none of them is public.


What can be said is that the strategy increases the share of revenue whose cost structure is set in agreements with third parties rather than in the platform’s own infrastructure. That is a change in the shape of the business. Whether it is a change in its profitability is unresolved, and the honest position is to name it as the open question rather than assume the unfavorable answer.


Orchestration and toll positions can be extremely profitable. Payment networks are the obvious counterexample to any claim that intermediation means thin margins. The relevant question is not whether toll businesses can earn software margins. It is whether this particular toll is collected on terms the platform sets, and that is exactly what the disclosure does not say.

On May 5, at Knowledge 2026, ServiceNow announced an expanded integration between AI Control Tower and Microsoft Agent 365. The architecture has since changed, and the current version is more interesting than the announcement.


ServiceNow documentation updated on July 12 describes a pull-based model: “AI Control Tower no longer pushes agents to Microsoft. Instead, an AI steward marks an agent as publishable, which exposes it through a ServiceNow API. External systems such as Microsoft Agent 365 (A365) can then call this API at their own schedule (example: a periodic daily job) to discover and retrieve those agents.”


The boundary does not end ServiceNow’s governance. It divides authority. ServiceNow governs the agent as an internal asset and controls whether it is exposed for external discovery. Microsoft controls when it retrieves that exposure and which publishing and marketplace policies apply inside its own ecosystem. The evidence chain crosses two control domains, even though both vendors can accurately describe the integration as governed.


One detail in that documentation deserves more attention than it has received. “The agent continues to operate and is still managed by AI Control Tower regardless of its publish-ability status.”


Read carefully, that is a statement about what the publish control is and is not. Marking an agent unpublishable withdraws it from external discovery. It does not stop the agent. The lever that looks like revocation is a visibility lever, and an institution that mistakes one for the other has misread its own kill switch.


This is the platform-to-platform version of a distinction I wrote about in August in the context of outcome-priced sourcing. A right is not a control. A right is something you assert through a process another party participates in, on that party’s schedule. A control is something you operate. In a pull-based architecture, the retrieval schedule belongs to the other side, which means the timing of your withdrawal does too.


The platform selling you a control plane is itself a participant in someone else’s version of this problem. Worth knowing before you assume your evidence chain is continuous.

Set the layers out and the pattern is legible.

Every layer above the bottom row has been bought, sold, or shipped as a launch feature inside eighteen months. The bottom row moves differently, and the reason is worth stating precisely, because the slogan version of it is wrong.


Authority can absolutely be purchased in part. Institutions buy policy frameworks, delegated-authority systems, compliance services, and managed governance, and they are right to. What a vendor cannot do is originate the institution’s mandate or assume the institution’s ultimate accountability. Someone inside the institution decides who may authorize an automation, under which policy, with what testing, and who answers when it fails. That decision can be informed, templated, and enforced by software. It cannot be delegated out of the institution.


In regulated industries the gap is wider than the table suggests. Faster ticket

resolution is a local improvement. What institutions are accountable for is continuity across intent, authorization, execution, exceptions, and final records. Neither seat pricing nor consumption pricing prices that continuity directly, which is why no change in pricing model resolves it, and why the pricing debate has absorbed attention the operating model debate should have had.


The uncomfortable finding from July stands. Enterprises are declining to make operating model decisions while continuing to buy tools. You can be fully tooled and still ungoverned.


If baseline controls are now table stakes, what is the incumbent premium buying? There may be a good answer: enforcement coverage across systems, identity integration, evidence retention, incident response. Name it explicitly. It has become a negotiable line rather than an assumed one.


Does your evidence survive a change of platform? If the audit trail lives inside the control plane, the control plane is not a mechanism you selected. It is a dependency you acquired.


Which of your controls are operational and which are visibility? The Agent 365 architecture is the general case, not a quirk. Ask specifically whether withdrawing an agent stops it, hides it, or merely stops others from finding it.


Where does your governance stop, and whose policies apply past that point, on whose schedule? Get this in writing before the integration reaches production.


When pricing shifts from seats to consumption, which budget absorbs the variance, and who owns the forecast? A seat-anchored forecast and a usage-anchored one are built on different drivers and can diverge substantially. That divergence lands in someone’s budget, and it is usually discovered rather than planned.

The economic argument weakens if ServiceNow sustains or expands subscription gross margin while AI becomes a materially larger share of revenue. It weakens further if the company discloses pricing or supplier arrangements showing that incremental model and cloud costs are passed through without meaningful margin dilution.


The diffusion argument weakens if the depth questions turn out to be the whole game: if enforcement coverage, identity integration, and cross-platform revocation prove hard enough that baseline controls never threaten incumbent positions at all. Watch enterprise wins above the mid-market rather than product announcements.


On that point, the available evidence is thin and should be described as such. Pepper Money, an Australian lender with roughly 800 employees, replaced ServiceNow with Atomicwork across its service desk in Australia, New Zealand, and the Philippines, going live in late 2024. That account comes from an Atomicwork customer case study, which is a vendor-published source. It is one mid-market instance, not a trend, and anyone citing it should say so.


Two further things are worth watching. Whether ServiceNow begins separating AI revenue economics from platform revenue economics in its reporting, which would settle the allocation question this article leaves open. And whether the partner program shifts from implementation services toward marketplace take rates, which would tell you how the orchestration position is actually monetized.

None of this says the incumbents lose. Orchestration is a strong position, the platforms competing for it are competing rationally, and a governed workflow layer is a fine thing to own.


It says the entry price has fallen and the cost structure has changed, and that both developments push value toward a layer no vendor can supply. The machinery of enforcement can be bought, increasingly from anyone. The mandate it enforces gets written down inside the institution, owned by someone with a name, and kept above any single provider.

 -----------------------------------------------------------

The technology gets commoditized on a schedule. The operating model is the moat.

 -----------------------------------------------------------

All figures are as reported by the cited primary sources. ServiceNow margin figures are non-GAAP unless stated otherwise; the company also reported GAAP subscription gross margin of 73.5 percent and GAAP operating margin of 4 percent for the second quarter of 2026. Vendor-published material is identified as such.

Serval, “Catalyst general availability,” August 20, 2026. Vendor-published. https://www.serval.com/serval-news/catalyst-general-availability

Sequoia Capital, Serval company profile (founding year). https://sequoiacap.com/companies/serval

ServiceNow, “ServiceNow Reports Second Quarter 2026 Financial Results,” July 22, 2026. Primary. https://investor.servicenow.com/news/news-details/2026/ServiceNow-Reports-Second-Quarter-2026-Financial-Results/default.aspx

ServiceNow Q2 2026 earnings call transcript, July 22, 2026, source of the Mastantuono quotation. https://www.benzinga.com/news/26/07/60627210/full-transcript-servicenow-q2-2026-earnings-call

ServiceNow, “ServiceNow completes acquisition of Moveworks,” December 15, 2025. Primary. https://investor.servicenow.com/news/news-details/2025/ServiceNow-completes-acquisition-of-Moveworks/default.aspx

ServiceNow, “Tech Mahindra and ServiceNow Expand Partnership to Deliver Production-Ready Enterprise AI at Scale,” August 20, 2026. Primary. https://newsroom.servicenow.com/press-releases/details/2026/Tech-Mahindra-and-ServiceNow-Expand-Partnership-to-Deliver-Production-Ready-Enterprise-AI-at-Scale/default.aspx

ServiceNow, “ServiceNow expands AI agent governance through deeper integration with Microsoft,” May 5, 2026. Primary. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-expands-AI-agent-governance-through-deeper-integration-with-Microsoft/default.aspx

ServiceNow product documentation, “External registries,” updated July 12, 2026. Source of the pull-based architecture and publish-ability quotations. Primary. https://www.servicenow.com/docs/r/intelligent-experiences/external-registries.html

ServiceNow product documentation (Zurich), “Publish ServiceNow agents to Microsoft Agent 365.” Primary. https://www.servicenow.com/docs/r/zurich/intelligent-experiences/ai-control-tower/publish-servicenow-agents-to-microsoft-agent-365.html

Atomicwork, Pepper Money customer case study. Vendor-published. https://www.atomicwork.com/customers/pepper-money

Prior articles in this series referenced in the text: “The Control Plane Is the Prize” (July 3, 2026), “Moveworks Didn’t Join ServiceNow’s AI Stack” (July 6, 2026), and “When the Agent Belongs to the Vendor, Who Answers for the Outcome?” (August 8, 2026).


Alan L. Paris is an Adjunct Professor and Advisory Board Member for the Strategic Artificial Intelligence (AI) Program at the University of San Francisco School of Management. He previously served as Field CTO and Global GRC Architect at ServiceNow, leading AI strategy, agentic implementation, and platform architecture for marquee financial services accounts.

He is the author of It’s Not About AI: A Complete Guide to ServiceNow Agentic AI Implementation, a practitioner-focused guide to designing and deploying agentic AI within complex organizations.

Paris has addressed the U.S. Department of State and the Federal Reserve, chaired or presented at more than fifty-five industry conferences across North America, Europe, and Asia, and published more than eighty articles on artificial intelligence, anti-money laundering, enterprise risk management, and financial markets technology. He has been interviewed by media including CNN, the Wall Street Journal, and the Financial Times.


Comments

bottom of page