Who Owns Context When Software Becomes Agentic
As AI agents spread across the enterprise, SaaS companies are racing to control the context that governs decisions.
Every SaaS company is having the same conversation behind closed doors. It usually begins with excitement about agents and ends with anxiety about control.
For decades, the system-of-record model worked because humans were the interface. People navigated dashboards, learned schemas, tolerated awkward workflows, and internalized business rules through repetition. The UI absorbed complexity, and the data stayed protected behind it. Judgment was enforced not through transparency, but through use.
That rigidity was not a flaw. It was a feature. Standardized workflows, fixed schemas, and enforced process created accuracy, auditability, and trust. Enterprises accepted friction because it guaranteed correctness.
Agents change that balance. They do not care about interfaces, object models, or vendor-specific abstractions. They want outcomes. They complete work without caring how a SaaS company chose to represent its world.
That shift forces an uncomfortable realization. If agents can directly access the raw data inside SaaS products, systems of record begin to look like commodities, and differentiation moves elsewhere. The logic that once made software authoritative becomes portable. The SaaS risks becoming interchangeable.
This concern extends beyond vendors. It reaches into how enterprises preserve institutional judgment, how decisions are audited, and where authority resides as work becomes increasingly automated.
APIs Were Never Built for Agents
The open API era assumed a human developer on the other side of the wire. Humans read documentation, debug failures, and reason about edge cases. Over time, they built an accurate mental model of how a system behaves, including its quirks and constraints.
Agents operate differently. They probe, execute, and infer. Given enough surface area, they can reconstruct how a system works externally. Endpoints, validation errors, permission boundaries, and side effects provide enough signal to reimplement decision logic outside the product itself.
Once that happens, the vendor no longer determines how its data is interpreted or acted upon. From the SaaS perspective, this is not simply openness. It is a loss of authority. The response across enterprise software has therefore been consistent: not broader exposure, but tighter mediation.
Business Logic Is the Moat
What has always made SaaS durable is not the data itself, but the accumulated judgment embedded around it.
Every mature system encodes decisions about what is allowed, what is risky, when exceptions apply, and how conflicts are resolved. These rules live across permissions, validation layers, defaults, escalation paths, and assumptions baked into products over years of use. They are rarely documented cleanly. Users learn them by operating inside the system.
Agentic systems disrupt this arrangement. When agents bypass the interface and operate directly on data, those implicit rules become optional. Judgment fragments. Decisions migrate outside the system of record.
That is the core threat. The true value of SaaS has never been storage. It has been decision management.
A CRM does not merely store contacts. It encodes how a company defines pipeline health, attribution, ownership, and forecast confidence. An ERP does not merely track transactions. It enforces how revenue is recognized, how approvals work, and how risk is managed. These products function as systems of judgment, whether they describe themselves that way or not.
The Agentic Layer as a Control Plane
The emerging response is an agentic interaction layer owned by the SaaS vendor. This layer becomes the primary interface for external agents.
Instead of querying schemas or invoking low-level endpoints, external systems express intent. The vendor’s agent interprets that intent, applies internal rules, and produces outcomes consistent with how the business operates.
This is not a cosmetic shift from UI to chat. It is a structural shift in where judgment lives. The SaaS agent becomes a control plane. It determines relevance, applies policy, resolves conflicts, and decides when human oversight is required. Every interaction is orchestrated through the vendor’s encoded understanding of correctness.
This is where ideas like orchestration graphs, judgment graphs, and context graphs converge. Each is an attempt to make explicit something enterprise software has long done implicitly: formalize how decisions are made and enforced. Context, in this framing, becomes the substrate for judgment, not a supplement to it.
This is not the first time enterprise software has confronted the limits of interoperability. Previous generations responded by expanding surface area rather than rethinking control. Suites promised end-to-end coherence. Integration platforms promised eventual convergence. As companies grew, many pursued suite strategies even when their original strength was interoperability. In hindsight, these moves were attempts to win the last war: reducing fragmentation by pulling more functionality inward rather than building a durable layer for coordination across systems.
The Promise of the Shim
SaaS companies will present this shift as a simplification.
Every customer deployment is unique. Custom fields, bespoke workflows, approval rules, and organizational quirks make universal schemas brittle. An agentic layer, the argument goes, absorbs that complexity. External agents no longer need to understand internal object models or relationships. They state a goal, and the system determines how to satisfy it in a way that aligns with how the organization operates.
This promise is not wrong. Intent-based interaction reduces integration friction. It shields external agents from unstable internals. It allows vendors to evolve their systems without breaking downstream consumers.
But simplification is only part of what is happening.
What the Shim Preserves
The agentic layer does more than abstract complexity. It preserves control over judgment.
By routing all interactions through a vendor-owned agent, the SaaS ensures that its internal rules are never fully externalized. Decision making remains internal. The logic that governs outcomes is applied, but not exposed.
Traditional APIs expose the mechanisms of decision making. Over time, those mechanisms allow business logic to be inferred and reproduced externally. Agentic shims change that relationship. They accept intent and return results, keeping judgment non-derivable by design.
From the vendor’s perspective, this is rational. Exposing raw data allows logic to be recreated independently, often inconsistently and without accountability. Centralizing judgment ensures uniform application of rules.
From the AI layer’s perspective, this introduces boundaries. Judgment cannot be freely recomposed. Each SaaS insists on being authoritative within its domain.
Where Judgment Is Allowed to Travel
Enterprises do not fully control agents in either model. With raw data access, judgment migrates to the AI layer and emerges implicitly, reconstructed across systems as agents reason end to end. With vendor-owned shims, judgment remains centralized inside each SaaS, applied locally and consistently but bounded by system-defined walls.
The distinction is not merely where authority resides, but whether judgment can operate across systems at all. Raw access enables agents to form system-spanning context and make tradeoffs that no single SaaS can evaluate. Vendor shims preserve local correctness while constraining global reasoning.
As agents increasingly operate across domains, this distinction stops being theoretical. The more work spans systems, the more consequential it becomes where judgment is allowed to live and how far it can travel.
AI does not introduce this tension so much as remove the last excuses for ignoring it. When intelligence becomes cheap and adaptive, the limits of suite expansion and shallow integration become impossible to hide.
The Squeeze on the Agentic Middle
This tension has a second-order effect.
As foundation models continue to commoditize, their providers are pushed toward orchestration and system-spanning reasoning as a primary source of differentiation. Value increasingly lies not in raw inference, but in assembling context, coordinating actions, and supporting decisions across domains.
Vendor-owned agentic shims complicate this trajectory. By localizing judgment inside each SaaS, they restrict the agent layer’s ability to form shared context. Models remain capable of reasoning, but are increasingly limited in what they are allowed to reason over.
This creates pressure on independent agentic platforms. If a platform does not control the model layer and cannot reliably assemble global context because judgment is fenced in below, sustaining differentiated orchestration becomes difficult. Orchestration risks collapsing into a feature rather than a defensible layer, squeezed between vendor-owned judgment and model-provider integration above.
This is not a prediction about winners. It is a structural constraint on where value can accumulate.
What Breaks If This Is Not Resolved
As agents become the primary way work gets done, enterprises will increasingly rely on them to reason across systems rather than within them. Real work does not live inside a single SaaS product. It spans sales, finance, support, operations, and compliance. The promise of agents lies in their ability to see those domains together and make tradeoffs that no individual system can assess in isolation.
Vendor-owned agentic layers complicate this future. Each SaaS preserves its own judgment, applies its own rules, and remains authoritative within its domain. From the inside, this looks like correctness. From the outside, it creates fragmentation. Agents are forced to negotiate outcomes across black boxes rather than reason over shared context.
The result is a ceiling on intelligence. Not because models are weak, but because judgment is fenced in. Decisions that require cross-system awareness become slower, more brittle, or impossible to automate. Enterprises gain local reliability at the expense of global understanding.
This is not a failure of vendors or of AI systems. It is the predictable outcome of how enterprise software has historically pursued scale, defensibility, and control. SaaS products were built to be destinations, not participants in a shared reasoning fabric.
Agents invert that expectation. They demand that judgment move.
Until judgment can travel without collapsing accountability, agentic systems will remain powerful but constrained. They will accelerate work inside tools while failing between them, not because intelligence is insufficient, but because no layer in the stack is permitted to own context end to end.
Thank you to Maureen Little, Samir Kumar, Conor Irvine, and Casey Winters for their insights and thoughtful feedback.