Two Roads Diverge on Agent Access
The enterprise software market has quietly split into two camps over a question that will shape the next decade of automation: who gets to control the AI agents acting on your business systems. SAP has drawn a hard line. Its updated API Policy, version four for 2026, explicitly prohibits external AI agents from independently scheduling or executing calls against SAP APIs. If you want an agent to touch SAP data, it must go through Joule, the company's own AI layer. Salesforce and ServiceNow have done the opposite, throwing their platforms open to any agent that speaks a common standard.
This is not a minor configuration difference. It is a philosophical and architectural divide that lands directly on the desks of CIOs building agentic strategies. One camp treats the AI agent as something the platform vendor must mediate and monetize. The other treats it as a client that should be able to connect from anywhere. We think the divide is the most consequential enterprise software story of the moment, precisely because it is not about features. It is about who holds the keys to automation across the systems that run the business.
SAP's Walled Garden
SAP's logic, articulated by Chief Customer Officer Thomas Saueressig, is uncompromising. For agentic use cases, he said, agent to agent via Joule is the only way. At its Sapphire conference, SAP presented an Autonomous Enterprise vision built around more than 50 Joule assistants coordinating over 200 specialized agents across finance, supply chain, HR, procurement, and customer experience. It is a coherent and ambitious picture, and it is entirely contained within SAP's own AI fabric. External agents are not partners in that vision; they are unwelcome callers at a locked door.
SAP frames the restriction as a matter of determinism and compliance. Routing agentic actions through Joule, the argument goes, gives regulated enterprises a controlled, auditable path rather than letting arbitrary external agents fire calls at core systems. There is a real point buried in that. Ungoverned agents acting on financial data are a genuine risk. But the policy also conveniently ensures that the most strategic emerging workload, autonomous action on enterprise data, must flow through SAP's proprietary layer, with the additional inference cost and lock in that implies.
Salesforce and ServiceNow Go Headless
The contrast with the other two giants could not be sharper. ServiceNow used its Knowledge conference to launch Action Fabric, opening twenty years of workflows and business rules to any AI agent through REST APIs and its generally available Model Context Protocol server. Salesforce announced Headless 360, exposing more than 60 MCP tools that can be driven from Claude Code, Cursor, or any MCP compatible runtime. The shared message is that no proprietary AI interface is required as a mandatory gateway. The platform becomes a set of governed capabilities that any agent can call.
We see this as the more defensible long term posture, because it aligns with where enterprise AI is actually heading. Customers are not standardizing on a single vendor's assistant. They are running Copilot, Claude, and homegrown agents side by side, and they want those agents to reach across systems. By embracing MCP as an open standard, Salesforce and ServiceNow position themselves as interoperable building blocks in a heterogeneous agent landscape. The risk they accept is commoditization, but the bet is that being open keeps them in the workflow rather than walling them out of it.
The Governance Argument, Examined
SAP's strongest card is governance, and it deserves a fair hearing. Enterprises in regulated industries cannot allow autonomous agents to execute financial transactions without strict controls, audit trails, and predictable behavior. SAP argues that a mandatory gateway is the cleanest way to guarantee those properties, and that organizations with strict compliance requirements benefit from the deterministic path Joule provides, even at the cost of additional inference layers. For a finance system of record, that is not a frivolous position.
The counterargument is that openness and governance are not opposites. MCP and similar standards include authentication, scoping, and policy enforcement; a headless platform can be tightly governed without forcing every agent through one vendor's brain. Salesforce and ServiceNow are betting that customers can have control and choice at once. The honest assessment is that both models can be made safe, and the real question is who bears the cost and the lock in. SAP's approach centralizes both inside SAP. The open approach distributes control to the customer, which is harder to operate but easier to escape.
Adoption Tells a Different Story
Strategy decks aside, the market data complicates SAP's position. According to an investment survey of SAP customers, only a small fraction use Joule in production, while a large majority of AI active SAP enterprises reach for Microsoft Copilot instead. That gap matters. If customers are already routing their AI work through Copilot, a policy that blocks external agents does not channel them into Joule so much as it creates friction in workflows they have already built around other tools. Restriction is only leverage if the alternative is compelling.
This is the central tension in SAP's bet. The company is wagering that the depth of its data and the determinism of Joule will pull agentic workloads back inside its walls. But if adoption stays low and customers resent the constraints, the policy risks reading as protectionism rather than protection. Vendors who try to force a strategic workload through a proprietary gateway, against the grain of customer behavior, often find that customers route around them or down weight them in the next architecture review.
What CIOs Should Decide Now
For technology leaders, this divide is not an abstract debate to monitor from a distance. It is a procurement and architecture decision with multi year consequences. If your agentic strategy depends on a heterogeneous mix of models and tools acting across your stack, the open posture of Salesforce and ServiceNow fits that reality more naturally. If your priority is a tightly governed, single vendor automation fabric for core financial processes, SAP's controlled path has genuine appeal. The wrong move is to drift into one camp by default rather than by decision.
We would advise CIOs to make agent interoperability an explicit evaluation criterion in every platform contract this year. Ask each vendor a direct question: can an external agent, governed by our policies, act on this system without routing through your proprietary AI layer. The answers will sort your vendors into the two camps quickly, and they will tell you which relationships preserve your freedom to choose AI tools and which ones quietly hand that choice to the vendor. In an agentic enterprise, that freedom is the asset worth protecting.
