Decide this the way the money already decides it: a workflow is being eaten when a vendor charges per resolved outcome instead of per seat, and when the agent runs in production against audited demand rather than a launch demo. By that test, “agents eating SaaS” is real today at the pricing and integration layer and still mostly forward-looking at the level of wholesale workflow replacement. Sierra reported crossing $150 million in annualized run-rate revenue on outcome pricing by early February 2026 [3]. Salesforce reported Agentforce annual recurring revenue past half a billion dollars in the quarter ended October 31, 2025 [10]. In the same window, MIT NANDA found about 95 percent of enterprise generative-AI pilots returned no measurable profit-and-loss impact [8].

This guide is for B2B founders, operators, and product and revenue leaders who have to act on that gap rather than narrate it. It does six things. It pins down what the displacement thesis actually claims and where the evidence sits. It gives you a scoring rubric to rate any workflow in your own stack for agent-displacement risk. It ranks the workflows going first by the depth of their evidence. It explains how agent delivery reprices software and what that does to seat revenue and gross margin. It maps where the thesis breaks on reliability, liability, security, and incumbent distribution. It closes with concrete moves for the next few quarters, whether you sell B2B software or buy it.

Key takeaways

↑ CONTENTS
  1. “Agents eating SaaS” is happening now at the pricing-model and integration layer and is still mostly predicted at the level of full workflow replacement, so judge displacement by per-outcome contracts and audited revenue, not by demos (see The displacement thesis and its mechanism).
  2. A workflow is exposed when it is high-volume, reversible, thin on proprietary data, scorable by a clear metric, and short-horizon, and defensible when it is regulated, irreversible, data-rich, multi-party, and long-horizon (see What makes a B2B workflow exposed or defensible).
  3. Software development is the most-displaced workflow today by both spend and daily usage, while sales development is the clearest correction, with AI SDR tool churn running 50 to 70 percent a year (see The workflows going first, ranked by evidence).
  4. Agent delivery decouples revenue from headcount: outcome prices run near a dollar per resolution, AI-app gross margins sit at 25 to 60 percent against the classic 70 to 90 percent SaaS band, and hybrid seat-plus-usage is the realistic 2026 destination (see The economics: seats, usage, and margin).
  5. The thesis breaks on reliability at the production bar, unsolved prompt-injection risk, deployer liability, and incumbent data-and-distribution moats, which is why incumbents are absorbing agents more than they are being replaced (see Where the thesis breaks).
  6. Vendors should ship the agentic capability, reprice the one clean-outcome workflow, and become agent-accessible; buyers should run paid 45-to-60-day pilots with kill thresholds and measure renewal on outcomes (see What to do now: vendors and buyers).

Table of contents

↑ CONTENTS
  1. The displacement thesis and its mechanism
  2. What makes a B2B workflow exposed or defensible
  3. The workflows going first, ranked by evidence
  4. The economics: seats, usage, and margin
  5. Where the thesis breaks
  6. What to do now: vendors and buyers
  7. Sources

The displacement thesis and its mechanism

↑ CONTENTS

The thesis has a precise claim under the slogan, and the slogan obscures it. Seat-based SaaS sells a per-user interface a human operates. An autonomous agent sells the completed outcome that work used to produce. This section states the mechanism, separates what is shipping now from what is predicted, and holds the bull and bear evidence side by side so you can judge displacement on contracts rather than on launch decks.

EVIDENCE

The displacement thesis turns on a category distinction. Seat-based SaaS sells a per-user interface a human operates; an autonomous agent sells the completed outcome. As of March 2026, Andreessen Horowitz (a16z) frames this as software moving from a system of record to a system of action, where value shifts to the orchestration layer that routes model output through a specific workflow, and argues that better models make that application layer more capable, not thinner [1].

The pricing mechanism is concrete and already shipping in customer service. The same March 2026 essay cites Decagon pricing per conversation handled rather than per agent seat, moving toward price per resolution achieved, and notes that an incumbent like Zendesk cannot easily match that without cannibalizing its own seat-based revenue [1]. This counterpositioning is the move that lets agent-native entrants attack per-seat SaaS.

Outcome pricing is not only a thesis. As of late November 2025, Sierra, the agent company co-founded by Bret Taylor, charged customers for completed work rather than flat subscription fees, the structural inverse of per-seat SaaS [2]. The revenue arrived fast, though every figure here is vendor-self-reported annual recurring revenue (ARR) run-rate, not audited financials: Sierra reported $100 million ARR as of November 21, 2025, reached in roughly 21 months, then said it hit $150 million ARR by early February 2026 [3]. As of May 4, 2026, Sierra was raising a $950 million round led by Tiger Global and GV at a post-money valuation above $15 billion, and claimed more than 40 percent of the Fortune 50 as customers with agents handling billions of interactions, figures that are company-claimed and not independently audited [3].

The incumbent side is measurable and self-reported by the incumbent. In its Q3 FY26 earnings release dated December 3, 2025, Salesforce reported Agentforce ARR surpassed half a billion dollars (up 330 percent year over year), Agentforce plus Data 360 ARR reached nearly $1.4 billion (up 114 percent year over year), over 9,500 paid Agentforce deals (up 50 percent quarter over quarter), and Agentforce accounts in production up 70 percent quarter over quarter [10]. These are company-stated figures inside an earnings release.

Real enterprise deployments are doing operational work, not just demos, but they are gated on data quality and run alongside humans. As of November 2025, Salesforce documented named Agentforce rollouts including Heathrow’s customer service agent Hallie, which answers checkpoint-wait and gate questions, with customers stating the agent is only as good as the structured data behind it [9].

The plumbing that lets an agent act across the SaaS apps a human used to operate is consolidating on one standard. The Model Context Protocol (MCP, Anthropic’s open protocol for how a model discovers and calls a tool) was running in production at companies large and small as of its March 9, 2026 roadmap, which notes the project has moved well past wiring up local tools to powering agent workflows [4]. The adoption has third-party-checkable signals, though the strongest single number is vendor-cited: per Anthropic’s December 9, 2025 ecosystem update (relayed and checked against public registry and GitHub APIs as of May 24, 2026), MCP had more than 10,000 active public servers and 97 million-plus monthly SDK downloads across Python and TypeScript, with cross-vendor client support spanning ChatGPT, Cursor, Gemini, Microsoft Copilot, and VS Code, while a separate Stacklok State of MCP in Software 2026 survey put 41 percent of all-software respondents in some form of MCP production [5].

Every frontier lab and major vendor now ships agent-building infrastructure, the supply-side evidence the thesis is being built toward. OpenAI launched AgentKit on October 6, 2025, a toolkit to build, deploy, and optimize agents, including a visual Agent Builder for versioning multi-agent workflows and a Connector Registry for managing how data and tools connect [6]. Coding is the workflow where autonomous agents are furthest along and where capital is concentrating: Cognition, maker of the autonomous software-engineering agent Devin, signed a definitive agreement to acquire the agentic IDE Windsurf on July 14, 2025, and reporting later put Cognition in talks at a $25 billion valuation by April 2026, more than double its September 2025 mark [7].

The honest counter-evidence is that deployment success is the exception as of mid-2025. MIT’s NANDA initiative report The GenAI Divide: State of AI in Business 2025 (August 18, 2025, based on 150 leader interviews, a 350-employee survey, and 300 public deployments) found about 5 percent of AI pilot programs achieve rapid revenue acceleration while the vast majority stall with little to no measurable P&L impact, on a success definition critics note is narrow [8]. Even the leading proponent concedes the displacement is partly forward-looking. As of his February 2026 interview, Sierra’s Bret Taylor (also OpenAI chairman and former Salesforce co-CEO) frames the best case for agentic AI as lower costs and higher revenue for clients but says the ramp-up phase before those returns materialize can be pricey [11].

DO THIS

  1. Define the four terms before you debate them. An autonomous agent plans and executes a multi-step task to an outcome with limited human approval; a copilot suggests inside a tool a human still drives; RPA scripts fixed deterministic steps with no reasoning; seat-based SaaS sells a per-user interface priced by login. The thesis is about agents replacing the outcome that the seat-based UI used to help a human produce [1].
  2. Judge displacement by pricing model, not by feature lists. The test is whether the vendor charges per resolution or per completed task rather than per seat, because the per-conversation and per-resolution model used by Decagon and Sierra is the move incumbents on seat revenue cannot match without cannibalizing themselves [1][2].
  3. Treat every agent revenue number as self-reported until an audited filing exists. The Sierra ARR figures, its claimed share of the largest US enterprises, and Salesforce’s Agentforce ARR and paid-deal counts are all vendor-stated, and an ARR run-rate is not annual revenue. Use them as direction and momentum, not as audited proof of replacement [3][10][2].
  4. Hold the bull and bear evidence side by side: agent vendors report breakneck ARR and Salesforce reports Agentforce production accounts climbing sharply quarter over quarter, while MIT NANDA found the vast majority of generative-AI pilots delivered no measurable P&L impact [10][8].
  5. Use MCP adoption as the leading indicator that the plumbing for displacement is real: a large and growing base of active public servers, heavy monthly SDK download volume, cross-vendor client support, and a sizable share of surveyed software organizations running MCP in some form of production. When the integration layer standardizes, agents acting across your SaaS apps stop being a demo [5][4].
  6. Read every frontier lab and major vendor shipping agent infrastructure (OpenAI AgentKit, Salesforce Agentforce, Cognition Devin) as supply-side evidence that the thesis is being built toward, not as proof the outcome has arrived. Launches and acquisitions show intent and capital; they do not show reproduced, at-scale workflow replacement [6][7][10].

OUR TAKE — OPINION, NOT SOURCED

“Agents eating SaaS” is happening at the pricing-model and plumbing layer right now, but workflow replacement is still mostly predicted and uneven. The honest framing for mid-2026 is a present-tense shift in how software is bought and integrated, paired with a future-tense bet on how much of the work agents will actually own. Anchor any claim that a workflow is gone to a per-resolution contract plus an audited revenue line, not to a launch demo.

The deployments that work share a precondition the hype skips: clean structured data and a human-in-the-loop ramp, as the named Agentforce rollouts and Bret Taylor’s own admission that the ramp-up phase can be pricey both show. Assume the first 6 to 12 months of any agent deployment is data and process work, not replacement, when you forecast which workflows go first.

What makes a B2B workflow exposed or defensible

↑ CONTENTS

You do not need a forecast to score your own stack; you need criteria. The evidence points to a small set of properties that decide whether an agent can take a workflow end to end: horizon length, repeat-consistency, policy-bound success, multi-party coordination, proprietary data, and a checkable success metric. This section turns those into a rubric you can run against any workflow you own, then states how we break ties.

EVIDENCE

Reliability is the first gate, ahead of capability. On Sierra’s tau-bench (as of the March 2025 write-up), GPT-4-class function-calling agents completed fewer than 50 percent of customer-service tasks and held consistency at only about 25 percent when asked to repeat the same task eight times [14]. tau-bench scores by comparing the final database state to an annotated goal state and introduces the pass^k metric, which measures whether an agent solves the same task on every one of k tries rather than once, so reproducibility-on-repeat is the property that decides whether a workflow is safe to automate [14]. It also fails an agent that completes the task but violates a written policy, for example booking the right flight while breaking a stated change-fee rule, which makes policy-, compliance-, and approval-governed workflows a higher bar than ones judged only on whether the action got done [14].

Multi-party coordination is harder than text-in, text-out. In the tau-squared-bench dual-control experiments (paper submitted June 2025), agent performance dropped significantly when the environment shifted from agent-only control to dual control where the human user must also act, direct evidence that workflows requiring the agent to coordinate and guide a human are more defensible [15].

Horizon length is the strongest single predictor. The Illusion of Diminishing Returns paper (arXiv, March 2026) shows error compounding is not merely additive: the per-step error rate itself rises as a task runs because the model self-conditions on its own earlier mistakes [13]. In the same study, GPT-5 with thinking executed over 2,100 sequential steps while Claude-4 Sonnet reached 432, and without chain-of-thought frontier models failed beyond a turn complexity of six, so the safe horizon length of a workflow is the strongest predictor of whether an agent can run it end to end [13].

Data and structure decide defensibility. The a16z analysis Is Software Losing Its Head? (May 13, 2026) argues the defensible moat is not imported data but the data a product uniquely causes to exist, so a workflow whose value is mostly a UI over a commodity action is exposed while one that produces unique data is defensible [12]. The same piece frames an 80/20 split: AI cheaply rebuilds the first 80 percent of a system of record, but the remaining 20 percent of exceptions, approvals, compliance requirements, and edge cases is what separates a wedge from a true replacement, so the long-tail and regulated parts of a workflow are where defensibility concentrates [12]. a16z also argues agents do not erase operational logic and context as a moat and in fact raise its value, because an agent needs explicit rules, permissions, and process definitions to act safely [12]. Products that close the loop into real-world execution are more defensible because they sit inside the workflow rather than observing it, generate unique data, and cannot be removed without breaking the workflow [12]. And network effects gain importance when a system is embedded in a multi-party workflow [12].

Finally, scorability gates both automation and evaluation. Hamel Husain’s evals guidance recommends scoring an agentic workflow first as a black box against a precise per-task success rule, an exact answer or a correct side-effect, which means a workflow with a clear, checkable success metric is the kind a team can reliably evaluate and therefore safely hand to an agent [17].

The rubric below turns those properties into a score. Run each workflow against both columns, one point per signal, then read the gap.

Exposed signals (one point each)Defensible signals (one point each)
High volume and repetitiveHigh stakes or regulated
Text-in and structured-data-outIrreversible or liability-bearing actions
Low stakes and reversible outputDeep proprietary data or system-of-record status
Weak or no proprietary dataMulti-party human judgement
Value is mostly a UI over a commodity actionLong-tail edge cases
A clear, checkable success metricIntegration and distribution lock-in
A short task horizon of few dependent stepsA long multi-step horizon

DO THIS

  1. Count the dependent steps in the workflow before anything else, because horizon length is the strongest single predictor of whether an agent can run it end to end: frontier models with thinking executed long sequences of dependent steps in recent testing, but the same models without chain-of-thought failed past only a handful of steps, and per-step error compounds super-linearly as the model conditions on its own mistakes [13].
  2. Test the workflow on a repeat-it-eight-times bar, not a does-it-work-once bar. Even strong agents in tau-bench cleared fewer than half of customer-service tasks and held only about 25 percent consistency across eight repeats, so a workflow that tolerates an occasional wrong answer is exposed while one that demands the same correct result every single run stays defensible for now [14].
  3. Mark a workflow defensible when success requires obeying written policy, compliance rules, or approval gates, not just completing the action. tau-bench fails an agent that does the task but breaks a stated policy, which is the bar regulated and high-liability workflows live at [14].
  4. Add a point to the defensible side for every step that needs a human in the loop, because agent performance dropped significantly in tau-squared-bench when control shifted from agent-only to a shared environment where a human user also had to act, making multi-party guided workflows materially harder to automate than single-actor ones [15].
  5. Ask whether the workflow produces data the product uniquely causes to exist, or merely imports and displays data from elsewhere. Per a16z, the latter is a thin UI over a commodity action and is exposed, while a workflow that generates proprietary data, improves with use, and breaks if removed sits inside execution and stays defensible [12].
  6. Separate the easy bulk of a workflow from the defensible remainder before scoring it. Per a16z, AI cheaply rebuilds the routine majority of a system of record, so the exceptions, approvals, compliance paths, and edge cases in the hard remainder are where the real moat sits and should carry the most weight in the defense score [12].
  7. Treat hard-to-reconstruct operational logic as a defense signal rather than dead weight. Per a16z, agents do not kill institutional logic as a moat; they raise its value, because an agent needs explicit rules, permissions, and process definitions to act safely, and that encoded logic is the hardest thing for a competitor to rebuild [12].
  8. Require a clear, checkable success metric before calling a workflow exposed, because a workflow you cannot score precisely is a workflow you cannot safely hand to an agent. Hamel Husain’s eval method depends on a precise per-task success rule (exact answer or correct side-effect); a workflow whose success is fuzzy or contested resists both automation and evaluation [16].

OUR TAKE — OPINION, NOT SOURCED

A high exposure score against a low defense score is first to go. When the two scores tie, we break the tie toward exposed if the action is reversible and toward defensible if a single wrong run carries legal, financial, or safety liability, because the cost of the worst case, not the average case, is what gates a real deployment.

We would re-score every workflow at least quarterly. The safe horizon moved from roughly six steps without reasoning to thousands with it inside a single model generation, so today’s defensible long-horizon workflow can become exposed on the next model release. The rubric output is a snapshot, not a verdict.

The workflows going first, ranked by evidence

↑ CONTENTS

Rank by the depth and verifiability of the evidence, not by vendor noise. The strongest signals are measured daily usage, audited or independent adoption figures, and the gap between vendor-claimed and third-party-measured automation rates. This section ranks the exposed categories, names the field result behind each, and flags where a loud claim has already been corrected.

EVIDENCE

Coding leads on both spend and usage. As of December 2025, Menlo Ventures put departmental AI spend at $7.3 billion for 2025, with coding alone at $4.0 billion, or 55 percent of that spend, the single largest application category [18]. Software development is also the deepest-penetrated by usage: as of April 2026, 51 percent of professional developers report using AI coding tools daily and 84 percent use or plan to use them, per Panto AI’s compilation of developer survey data [29], and Menlo Ventures corroborates the depth at 50 percent of developers using AI coding tools daily, rising to 65 percent in top-quartile organizations as of December 2025 [18]. The displacement runway is still early even here: only 16 percent of enterprise AI deployments qualify as true agents in the Menlo survey, with most still fixed-sequence workflows [18].

Tier-1 customer support shows the widest gap between vendor demo and reproducible field result. As of May 2026, Decagon publishes 80 percent average deflection while Zendesk’s enterprise median across all CX programs is 41.2 percent, a roughly 39-point self-reported-versus-independent gap [27]. Intercom’s Fin reports a 67 percent average resolution rate across more than 7,000 customers as of early 2026 (a first-party figure, though aggregated across real deployments rather than a single marketing headline), with independent head-to-head testing cited at Fin 73 percent versus Decagon 49 percent, showing real but lower-than-marketed automation [20]. The ceiling is real: in May 2025 Klarna reversed its 2024 plan to replace 700 customer service agents with an OpenAI-built assistant, with CEO Sebastian Siemiatkowski conceding the all-AI model produced lower quality and resuming human hiring [21].

IT helpdesk shows the highest measured autonomous resolution of any category, but it is a single-vendor self-report on its own internal environment: in February 2026 ServiceNow stated its Autonomous Workforce handles over 90 percent of targeted Level 1 ticket volume internally [22].

Sales development was the loudest displacement claim and is now the clearest correction. As of March 2026, UserGems data cited by the GTM AI newsletter puts AI SDR tool churn at 50 to 70 percent annually, roughly double human SDR turnover, with companies ripping tools out before first renewal [23]. The correction is mechanism-driven: as of April 2026, domain-reputation collapse from over-sending caps a large share of attempted deployments inside the first 90 days, and average B2B cold email reply rates fell from 6.8 percent in 2023 to 4 to 5 percent in 2025 [26]. Independent forecasting flags the failure rate broadly: Gartner predicts over 40 percent of agentic AI projects will be abandoned by the end of 2027, a figure the AI SDR reality-check writeups lean on as of April 2026 [25].

Recruiting and resume screening is broadly displaced at the screening layer. As of February 2026, 69 percent of HR professionals use AI in recruiting (SHRM), screening resumes is the second most common application at 44 percent, and 75 percent of large US enterprises automate applicant screening [28]. RevOps and CRM data hygiene is gated by a data-quality prerequisite: 77 percent of Agentforce deployments are reported to fail because the platform requires clean CRM data it does not itself cleanse, and 35 to 55 percent of CRM records carry a material data-quality issue [27].

Two cross-cutting signals frame the ranking. The economic mechanism behind it is the collapse of per-seat pricing: as of May 2026, analyst Jamin Ball frames agents as decoupling software value from human headcount, and Salesforce repriced Agentforce away from per-conversation toward consumption and flex-credit billing after enterprise pushback [24]. And the independent adoption anchor: as of May 2026, Ramp’s AI Index shows business AI adoption above 50 percent, led by the information and software sector at roughly 63 percent, confirming the most-exposed buyers are software-heavy firms [19].

The chart below plots one headline figure per workflow category behind the ranking. Each bar is a different metric (coding daily-usage share, customer-support resolution rate, internal Level-1 helpdesk resolution, recruiting screening adoption, and annual AI SDR tool churn), so read them as exposure signals across categories, not as one comparable rate.

Workflow exposure signals by categorybar chart of 1 series. Sourced from Coding daily use: Menlo Ventures 2025-12. Customer support resolution: Intercom Fin first-party average across 7,000+ customers, 2026-01 (Decagon markets 80 percent deflection). IT helpdesk Level-1 resolution: ServiceNow internal self-report 2026-02. Recruiting screening use: SHRM via Recruit AI Suite 2026-02. AI SDR annual tool churn: UserGems via GTM AI 2026-03. Mixed metrics, not one comparable rate..0 %20 %40 %60 %80 %100 %CodingCustomer supportIT helpdeskRecruitingAI SDR
Workflow exposure signals by categorySOURCE: Coding daily use: Menlo Ventures 2025-12. Customer support resolution: Intercom Fin first-party average across 7,000+ customers, 2026-01 (Decagon markets 80 percent deflection). IT helpdesk Level-1 resolution: ServiceNow internal self-report 2026-02. Recruiting screening use: SHRM via Recruit AI Suite 2026-02. AI SDR annual tool churn: UserGems via GTM AI 2026-03. Mixed metrics, not one comparable rate.
SHOW DATA
CategoryReported rate (%)
Coding50
Customer support67
IT helpdesk90
Recruiting69
AI SDR60

DO THIS

  1. Treat software development as the most-displaced workflow today: it carries both the deepest adoption, with roughly half of professional developers using AI tools daily, and the single largest enterprise application spend by a wide margin. Rank it first when you forecast which workflows agents reach soonest [18][29].
  2. When a support vendor quotes a deflection or resolution number, demand the independent cross-program figure before sizing seat cuts. Decagon’s 80 percent self-reported deflection sits against a 41.2 percent Zendesk enterprise median, and Intercom Fin’s measured 67 percent average across more than 7,000 customers is the more defensible planning anchor [20][27].
  3. Cap support and helpdesk displacement at the first tier of repeatable volume, not the whole queue. Klarna reversed its agent-replacement plan on quality grounds, and ServiceNow’s high resolution figure is an internal self-report on entry-level tickets only. Size seat cuts to the bounded, reproducible slice rather than the headline [21][22].
  4. Discount the sales development category despite its early hype: AI SDR tool churn runs 50 to 70 percent annually, deliverability collapse caps a large share of deployments inside 90 days, and B2B cold reply rates have fallen to 4 to 5 percent. Buy AI SDR tooling on attributed pipeline, not on send volume [23][26].
  5. Gate any RevOps or CRM agent project on a data-hygiene phase first. With 35 to 55 percent of CRM records carrying a material quality issue and a reported 77 percent Agentforce failure rate tied to dirty data, the agent amplifies bad data rather than displacing the work until the data layer is fixed [27].
  6. Read the per-seat-to-outcome pricing shift as the leading indicator of which categories are being eaten: where a vendor repriced from seats toward actions or consumption, as Salesforce did with Agentforce, the agent has already begun decoupling value from headcount in that workflow [24].
  7. Use the small true-agent share of enterprise deployments as a reality check on every ranking: most deployments are still fixed-sequence workflows, so even the most exposed categories are early. Plan for compression of work and pricing pressure over the coming quarters rather than wholesale headcount removal today [18].

OUR TAKE — OPINION, NOT SOURCED

Our ordering of the workflows going first, by evidence depth: software development (deepest measured usage, largest spend), tier-1 customer support and IT helpdesk (high but bounded deflection), recruiting and resume screening (broad screening-layer automation), then sales development, RevOps data hygiene, BI, and onboarding trailing on weaker or gated evidence.

We would treat recruiting resume screening as more displaced than its press suggests and BI and customer onboarding as less displaced than vendor decks claim, because screening automation is already standard at three-quarters of large enterprises while BI and onboarding lack comparable measured deflection or seat-reduction data.

The economics: seats, usage, and margin

↑ CONTENTS

Agent delivery breaks the seat meter, and the break runs in two directions at once. Revenue decouples from headcount as vendors price per outcome, and gross margin compresses because every action re-runs a model at real variable cost. This section pins the live prices, the measured margin band, and the seat-compression mechanism, then states the realistic 2026 pricing destination for most incumbents.

EVIDENCE

Outcome prices are live and specific. Intercom prices its Fin AI agent at $0.99 per outcome (a resolution, procedure handoff, or disqualification) as of June 2026, charging at most once per conversation no matter how many actions Fin takes [30]. In March 2026 Intercom broadened Fin’s billing metric from per-resolution to per-outcome and reported a self-reported 67 percent average resolution rate across more than 7,000 teams, signaling outcome pricing applied to more complex workflows than the original full-automation resolution [31]. Zendesk launched outcome-based pricing in August 2024 starting at $1.50 per automated resolution, counted only after a ticket has been inactive for 72 hours or the customer confirms satisfaction, becoming the first major CX vendor to price purely on AI-delivered resolutions [33]. Sierra CEO Bret Taylor, in a March 2026 conversation, defined Sierra’s model as charging a pre-negotiated rate only when the agent resolves a case with no human intervention and charging nothing when it escalates, arguing the atomic unit of AI productivity is a process, not a person [11]. Sierra, founded February 2024, crossed $100 million in annualized run-rate revenue by November 2025, about seven quarters after launch, and raised $350 million at a $10 billion valuation in September 2025, with the $100 million figure reported as run-rate rather than audited annual revenue [2].

Incumbents are layering meters, not switching cleanly. Salesforce introduced Agentforce Flex Credits in May 2025 at $0.10 per action, with each action consuming 20 credits and credits sold in packs of 100,000 for $500, sitting alongside the original $2-per-conversation meter and a per-user Agentforce license, so Salesforce now runs three distinct Agentforce pricing models at once [32]. It reported in Q3 FY2026 (quarter ended October 31, 2025) that Agentforce ARR surpassed half a billion dollars, up 330 percent year over year, with over 9,500 paid deals and more than 3.2 trillion tokens processed; that ARR is an annualized run-rate, company-stated figure, not separately audited [10].

The margin hit is measured and large. Bessemer’s 2025 dataset, cited by analyst Tanay Jaipuria in September 2025, showed fast-ramping AI application Supernovas averaging about 25 percent gross margin early on (some negative) versus steadier Shooting Stars near 60 percent, well below the 70 to 80 percent that defined classic SaaS, because every query re-runs the model as a real variable cost [34]. Outside estimates in the same analysis put OpenAI’s blended gross margin around 50 percent and Anthropic’s around 60 percent (per The Information), and Anthropic disclosed losing tens of thousands of dollars per month on some users of its original $200 Claude Code plan, illustrating that naive flat pricing can run negative unit economics [34].

Falling token prices help but do not rescue margin on their own. Epoch AI, combining Artificial Analysis API price data with benchmark scores (published March 2025), found the price to reach a fixed capability level fell 9x to 900x per year depending on the milestone, with the price to match GPT-4’s performance on PhD-level science questions dropping about 40x per year, steadily lowering the floor cost of an agent action at a fixed quality bar [35].

The seat-compression mechanism is named and quantified. Bain & Company found in October 2025 that among more than 30 non-AI-native SaaS vendors adding generative AI, about 65 percent layered an AI usage or feature meter on top of seats (the path Adobe and Salesforce took) while about 35 percent simply raised per-seat prices and bundled AI in, and none had fully shifted to pure usage or outcome pricing [36]. Bain named the mechanism directly: when AI automates tasks that previously required staff, the customer needs fewer humans to operate the software and the per-human meter loses relevance, so seat counts and seat revenue can fall even as delivered value rises [36]. It also quantified the transition friction with a worked case: a customer asked to buy a $40,000 AI agent to eventually replace an $80,000 sales development rep must run both during evaluation, raising near-term cost by 50 percent before any headcount saving lands, which is why hybrid pricing has become the dominant interim model [36].

The table contrasts the four pricing models against the captured prices and billable-event rules.

Pricing modelBillable unitCaptured priceBillable-event rule
Per seatNamed user / loginPer-user Agentforce license [32]Charged per provisioned user regardless of work done
Per actionOne agent action$0.10 per action (20 Flex Credits) [32]Every discrete action consumes credits
Per resolutionOne resolved ticket$1.50 per resolution (Zendesk) [33]Counted after 72h inactivity or confirmed satisfaction [33]
Per outcomeOne delivered outcome$0.99 per outcome (Intercom Fin) [30]At most once per conversation; nothing on escalation [30]

DO THIS

  1. When you evaluate an agent vendor, normalize every quote to cost per completed unit of work. Intercom Fin bills $0.99 per outcome (charged at most once per conversation) and Zendesk bills $1.50 per automated resolution at entry volumes, so compare those against your fully loaded cost per human-handled ticket before assuming the agent is cheaper [30][33].
  2. Read the outcome definition, not just the headline price. Zendesk only counts a resolution after a ticket sits inactive for a fixed window or the customer confirms satisfaction, and Intercom never bills when a customer asks for a human or a procedure fails, so the billable-event rule is what actually determines your invoice [33][30].
  3. Expect to run the agent and the staff it replaces in parallel during evaluation. Bain’s worked example shows a customer buying an agent to eventually retire a more expensive human rep must carry both for an undefined period, raising near-term cost before any headcount saving lands, so budget for the overlap and negotiate delayed payments or performance guarantees to bridge it [36].
  4. If you sell software, do not bundle an AI agent into a flat seat price without instrumenting per-customer inference cost. Anthropic disclosed losing tens of thousands of dollars a month on some users of its original flat-rate Claude Code plan, the failure mode of pricing a variable-cost agent like fixed-cost SaaS [34].
  5. Model the gross-margin hit before you ship an AI feature. Bessemer’s data put fast-ramping AI application companies at a far thinner gross margin than the band that defined classic SaaS, with some running negative, because every query re-runs the model at real variable cost. Price the feature to more than cover inference rather than treating it as free upside [34].
  6. Do not assume falling token prices rescue your margin on their own. Epoch AI found the price to hold a fixed capability level falls steeply each year, but the cost only drops if you let a router send most traffic to cheaper models and burst to the frontier on hard cases. If your product demands the top model on every request, your COGS rides the model provider’s price card [35][34].
  7. Track net revenue retention, not just bookings, when agents enter a seat-priced account. Bain spells out the seat-compression mechanism: as an agent absorbs work a seat used to require, the per-human meter loses relevance, so a seat-priced account can shed seat revenue even while delivered value rises. Instrument the account on outcomes delivered so you see the shift early [36].
  8. Treat every vendor ARR and savings figure as self-reported run-rate until a filing says otherwise. Salesforce reported Agentforce ARR past half a billion dollars with a steep year-over-year jump, and Sierra reported crossing its first nine-figure ARR milestone; both are annualized run-rate, not audited annual revenue, and should be cited with that qualifier [10][2].

OUR TAKE — OPINION, NOT SOURCED

For most incumbent SaaS buyers and sellers, the realistic 2026 destination is hybrid, not pure outcome pricing. Bain found about 65 percent of non-AI-native vendors layered an AI meter on top of seats and none had gone fully outcome-based, so we would plan around a seat-plus-usage contract and use pure per-resolution pricing mainly for the narrow, measurable workflows, front-line support deflection, where the outcome is clean.

We read Salesforce running three Agentforce pricing models at once (per conversation, per-action Flex Credits, and per-user) as evidence that nobody has solved agent pricing yet, not as a settled strategy. Expect the meter you sign in 2026 to change at renewal, so favor contracts with repricing flexibility over multi-year lock-in on a single metric.

The durable defense against margin compression is workflow depth, not token arbitrage. Vendors who own the acceptance criteria, document processing and voice IVR among them, can default to cheaper models and add governance, audit, and integration value that grows contract size without growing inference cost, which is how AI app margins climb back toward SaaS territory over a cohort’s life.

Where the thesis breaks

↑ CONTENTS

The thesis has four load-bearing failure points, and they are why incumbents are absorbing agents rather than being replaced wholesale. Reliability collapses at the production bar. Liability lands on the deployer. Prompt injection has no reliable fix. And the data and distribution moats favor whoever already owns the account. This section gives the numbers behind each.

EVIDENCE

Reliability is measured at a bar far below production tolerance. On METR’s task-length metric (as of March 2025), generalist frontier agents complete tasks at 50 percent reliability only up to a length that doubles roughly every 7 months, and models succeed under 10 percent of the time on tasks that take a human more than about 4 hours [37]. Raising the bar from 50 to 80 percent reliability shrinks what an agent can do by roughly 6x: on METR’s time-horizons data (as of March 2026), GPT-5.4 holds a 50 percent task horizon of about 342 minutes but only about 54 minutes at 80 percent [37]. The collapse is consistent across the 2026 frontier: Gemini 3.1 Pro (February 2026) drops from a 384-minute 50 percent horizon to about 90 minutes at 80 percent, and Claude 3.7 Sonnet (February 2025) drops from about 60 minutes to about 12 minutes [37].

Consistency is worse than single-run success. On tau-bench (published June 2024), state-of-the-art function-calling agents like GPT-4o succeed on under 50 percent of tasks and are inconsistent, with pass^8 under 25 percent in the retail domain, meaning the agent solves the same task on all 8 tries fewer than one time in four [38]. Reliability also diverges from capability as tasks lengthen: in the reliability-science framework paper (arXiv, March 2026), software-engineering reliability (Graceful Degradation Score) falls from 0.90 on short tasks to 0.44 on the longest, and frontier models show the highest meltdown rates, up to 19 percent, because they pursue ambitious multi-step strategies that collapse into incoherent looping and hallucinated tool outputs [39].

Liability and security are unsolved. In Moffatt v. Air Canada (2024 BCCRT 149, February 2024) the tribunal held Air Canada liable for its chatbot’s misinformation and rejected the argument that the chatbot was a separate entity, a precedent that puts the deploying enterprise on the hook [43]. Simon Willison’s lethal trifecta (June 2025) holds that any agent combining access to private data, exposure to untrusted content, and the ability to communicate externally can be tricked into exfiltrating data, and that prompt injection cannot yet be prevented reliably [41].

Incumbents are absorbing agents into the installed base. In fiscal 2026 (ended January 31, 2026), Salesforce reported Agentforce ARR of $800 million on a $41.5 billion revenue base, with more than 60 percent of Agentforce and Data 360 Q4 bookings coming from existing customer expansion, meaning the agent is sold back into the base [40]. The incumbent data moat is concrete and large: Data 360 ingested 112 trillion records in FY26 (up 114 percent year over year) feeding its agents, and every one of the company’s Top 10 Q4 wins bundled the full Agentforce and Data 360 stack rather than a standalone agent [40]. ServiceNow is bundling AI by default: in Q1 2026 (released April 22, 2026) it reported $3,671 million in subscription revenue (up 22 percent year over year) with AI built into every commercial tier, and the count of customers spending over $1 million on its Now Assist suite grew more than 130 percent year over year [42].

The base rate favors established vendors. The MIT NANDA State of AI in Business 2025 report (August 2025) found about 95 percent of organizations saw no measurable business return despite $30-40 billion in spending, attributing failure to brittle workflows that do not learn or adapt, not to model quality [8]. When enterprises do succeed, buying from a specialized vendor beats building in-house: the same report found vendor purchases and partnerships succeed about 67 percent of the time while internal builds succeed only one-third as often [8].

The chart below shows the reliability collapse that anchors this section: each model’s task horizon at 50 percent reliability versus the same model at 80 percent, from METR’s time-horizons data.

Agent task horizon collapses at the production reliability barbar chart of 2 series. Sourced from METR time-horizons data, per-model as-of dates: GPT-5.4 (2026-03), Gemini 3.1 Pro (2026-02), Claude 3.7 Sonnet (2025-02). Task length a model sustains at 50% vs 80% reliability..50% reliabili…80% reliabili…0100200300400GPT-5.4Gemini 3.1 ProClaude 3.7 Sonnet
Agent task horizon collapses at the production reliability barSOURCE: METR time-horizons data, per-model as-of dates: GPT-5.4 (2026-03), Gemini 3.1 Pro (2026-02), Claude 3.7 Sonnet (2025-02). Task length a model sustains at 50% vs 80% reliability.
SHOW DATA
Category50% reliability horizon (minutes)80% reliability horizon (minutes)
GPT-5.434254
Gemini 3.1 Pro38490
Claude 3.7 Sonnet6012

DO THIS

  1. Before betting that an agent replaces a workflow, require its pass rate at the production-grade reliability bar rather than the coin-flip bar that demos report. METR’s data shows the workable task length collapses by several multiples as you raise the reliability threshold, so judge readiness at the higher bar and treat any horizon measured at the lower bar as a ceiling you will rarely hit in production [37].
  2. Test consistency, not just success: rerun the same task many times and track the pass^k rate. On tau-bench, a state-of-the-art function-calling model cleared retail tasks on every repeated try only a minority of the time, and a one-off success transcript hides that variance [38].
  3. Expect reliability to fall as task length grows, and scope agents to short, bounded steps. The reliability-science framework found software-engineering graceful-degradation scores drop sharply across the duration range, with frontier models melting down on a meaningful share of the longest tasks [39].
  4. Treat the deploying enterprise as the liable party for any agent error. The British Columbia tribunal in Moffatt v. Air Canada held the company, not the chatbot vendor, responsible, so any agent touching customers in a regulated business context needs human review gates and audit logs before it ships [43].
  5. Do not connect an agent to private data, untrusted input, and an outbound channel at the same time without isolating one of the three. Willison’s lethal trifecta shows that combination is exploitable through prompt injection, which still has no reliable fix, so this is a hard gate for enterprise data access [41].
  6. When evaluating a standalone agent startup against an incumbent, price in the incumbent’s data moat and installed-base distribution. Salesforce fed agents 112 trillion records via Data 360 in FY26 and drew over 60 percent of Agentforce bookings from existing customers, an integration advantage a greenfield agent has to rebuild from zero [40].
  7. Assume incumbents will bundle, not lose. ServiceNow is building AI into every commercial tier by default and rapidly grew its base of seven-figure Now Assist customers year over year, so a new agent competes against a feature already inside the platform the customer runs [42].
  8. Anchor adoption expectations to the base rate, not the pitch deck: MIT NANDA found about 95 percent of enterprise GenAI pilots returned nothing (August 2025), and buying from a specialized vendor beat internal builds (67 percent success versus one-third as often), which structurally favors established vendors over both DIY and unproven entrants [8].

OUR TAKE — OPINION, NOT SOURCED

The thesis is real but partial and slow. Agents will eat discrete, short-horizon, low-liability workflows first, and incumbents with the data, the distribution, and the customer relationship will capture most of that value by bundling agents into products customers already run. The pure-startup displacement story is the exception, not the base case, for the next 12 to 24 months.

The fastest way the thesis accelerates is not better demos but a reliability jump at the 80-percent-plus bar on long-horizon tasks, paired with a settled liability and security story for agents on private data. Watch those two curves, not headline benchmark wins, to time when more workflows actually go.

What to do now: vendors and buyers

↑ CONTENTS

The evidence converges on a short list of moves for the next few quarters. Vendors defend by shipping the agentic capability, repricing the clean-outcome workflow, deepening data and process moats, and becoming agent-accessible. Buyers win by consolidating in the right categories, running tight paid pilots with kill thresholds, and measuring renewal on outcomes. This section lays out both playbooks against the evidence.

EVIDENCE

The pricing direction is set, with a precondition. As of the February 2026 Bessemer playbook, AI-native vendors were abandoning seat pricing for usage, output, and outcome models, on the logic that AI monetizes outcomes the way SaaS monetized access [44]. Bessemer names a concrete benchmark, Intercom’s Fin at $0.99 per resolved ticket, aligning sales, success, and product around a single outcome [44], and sets the precondition: charge per outcome only when the AI is reliable, the cost variance is absorbable, and the outcome is unambiguous and measurable [44]. It warns of a 2026 renewal cliff, since 2025 buyers paid with little price sensitivity and pilots converting to production must now justify pricing on delivered value, not promise [44], and quantifies the margin shift to price for: AI products run at 50 to 60 percent gross margins versus 80 to 90 percent for traditional SaaS [44].

Defensibility shifts to process power and proprietary data. a16z’s March 2026 essay argues software encodes an organization’s workflows, and as models improve the orchestration layer compounds in value rather than thinning out [45]. It names proprietary data as a durable moat AI strengthens, citing Bloomberg market data, Abridge clinical conversations, OpenEvidence’s medical library, and VLex’s legal database [45], frames per-conversation pricing as a counterpositioning move incumbents cannot easily copy [45], and identifies the vulnerable categories: thin front-end wrappers over commodity functionality and incumbent systems of record on archaic interfaces that raise prices yearly [45].

Delivery and pilot discipline decide renewal. Madrona’s April 2026 operator piece reports that the renewal of an enterprise AI deal is effectively decided in the first three months of production [46], that high-converting pilots run 45 to 60 days with pre-agreed success metrics and a pre-negotiated path to production [46], and that forward-deployed engineers and technical account managers are now a deliberate delivery layer, reversing the SaaS-era goal of minimizing services [46]. It gives a measured outcome: in one Gradial deployment, a telecom price-update workflow that took three weeks dropped to 30 minutes, which then pulled adjacent teams onto the product [46].

The build discipline is settled engineering guidance. Anthropic’s December 2024 guidance reports the most successful agent implementations used simple composable patterns, not complex frameworks, and advised starting from LLM APIs directly [47]; told builders to invest in the agent-computer interface as heavily as in human interfaces, with examples, edge cases, and error-proofing, because tool design drives reliability [47]; and required extensive sandbox testing plus guardrails before autonomous agents run, citing higher costs and compounding errors [47].

The buyer’s landscape has hard numbers. McKinsey’s November 2025 State of AI survey (n=1,993) reports 23 percent of organizations are scaling agentic AI in at least one business function and 39 percent are experimenting [48], that AI high performers are nearly 3x more likely to have fundamentally redesigned workflows [48], and that only about 6 percent of organizations qualify as high performers achieving more than 5 percent EBIT impact from AI [48]. Retool’s February 2026 Build vs. Buy report (vendor-published and self-interested) claims 35 percent of teams have already replaced functionality of at least one SaaS tool and 78 percent plan to build more custom tools in 2026 [49], and names the categories under the most replacement pressure: workflow automation and internal admin tools first, then CRM, BI, project management, and customer support [49]. CIO.com’s March 2026 reporting quantifies the consolidation opportunity, with large enterprises averaging over 600 SaaS applications and spending $280 million a year on SaaS [50], quotes Runlayer CEO Andy Berman that agent-accessible vendors survive while human-UI-only vendors are routed around [50], quotes Automation Anywhere’s Adi Kuruganti that seat-tied pricing is now a buyer warning sign when agents work autonomously [50], and frames the build-vs-buy rule: build only for distinctive workflows or proprietary data no vendor can replicate, and only with mature delivery, testing, and security controls [50].

DO THIS

  1. Vendors: ship an agentic capability inside your own product before a counterpositioned startup builds it for your category, and prioritize the workflow where a new entrant could price per outcome against your seat revenue [45].
  2. Vendors: reprice toward outcomes only where the outcome is unambiguous, measurable, and your AI is reliable enough to absorb cost variance. Intercom Fin’s per-resolved-ticket price, named in Bessemer’s playbook, is the model to copy when those conditions hold [44].
  3. Vendors: where you cannot yet defend a pure outcome price, run a hybrid base-plus-usage model and instrument compute cost from the first customer, because per Bessemer AI products run at materially thinner gross margins than traditional SaaS, since every query carries real compute cost [44].
  4. Vendors: deepen the moat AI cannot commoditize by becoming the system of action over proprietary data and embedded workflows, the way Bloomberg, Abridge, OpenEvidence, and VLex compound on data outsiders cannot get, per a16z [45].
  5. Vendors: make your product agent-accessible infrastructure with documented APIs and MCP integration rather than a human-only UI, because per CIO.com the human-UI-only tools are already being routed around by agents [50].
  6. Vendors: treat the agent-computer interface as a first-class design surface with examples, edge cases, and error-proofing, and invest in tool design as heavily as human UX, since Anthropic’s engineering guidance found reliability comes from this rather than from complex frameworks [47].
  7. Vendors: before any agent touches production, build an eval and guardrail layer and test extensively in sandboxes, because compounding errors and higher costs make an untested autonomous agent a liability, per Anthropic’s engineering guidance [47].
  8. Vendors: staff forward-deployed engineers and technical account managers as a deliberate delivery layer to configure workflows and integrate data, reversing the SaaS instinct to minimize services, per Madrona’s operator analysis [46].
  9. Vendors: instrument delivered value in the first 90 days of production and broadcast wins to adjacent teams, because the renewal of an enterprise AI deal is effectively decided in the first three months [46].
  10. Buyers: consolidate first in the categories under the most replacement pressure, workflow automation and internal admin tools, then CRM, BI, project management, and customer support, per Retool’s build-versus-buy report. Treat its figures as directional because the survey is vendor-published, and lean on the category ranking rather than the headline shares [49].
  11. Buyers: design every agent evaluation as a paid 45-to-60-day pilot on your own data with pre-agreed success metrics and a pre-negotiated path to production, not an open-ended sandbox, because longer pilots lose their sponsor and signal, per Madrona [46].
  12. Buyers: make seat-tied pricing a procurement red flag when the agent does the work autonomously, and require outcome- or usage-based rate cards instead, per CIO.com’s reporting [50].
  13. Buyers: measure renewal on enterprise outcomes such as EBIT impact and workflow redesign rather than seats or activity, since McKinsey found only a small minority of organizations clear a meaningful EBIT impact and that high performers are far more likely to have fundamentally redesigned workflows [48].
  14. Buyers: build in-house only for distinctive workflows or proprietary data no vendor can replicate, and only with mature delivery, testing, and security controls; otherwise buy and consolidate, per CIO.com’s reporting [50].

OUR TAKE — OPINION, NOT SOURCED

Buyers should weight reliability evidence, data handling, pricing model, and exit terms as the four load-bearing procurement criteria, asking for third-party or reproduced reliability evidence rather than a curated demo, and a documented exit and data-portability path before signing. And write a kill threshold into every pilot contract, a minimum automation rate by a fixed day and zero security or compliance incidents attributable to the agent, so a stalled pilot ends cleanly instead of becoming shelfware you keep paying for.

Vendors should resist repricing the whole book to pure outcomes in one move. Convert the one workflow with a clean, measurable outcome to outcome pricing, keep a hybrid base elsewhere, and expand outcome coverage only as your eval data proves the reliability needed to absorb the cost variance. The vendors that win the next two years will be the ones that treat agent delivery as a services-backed, instrumented engagement, not a license they ship and forget.