The agent conversation has been about what to build. That question is being answered for you. Your CRM, ERP, security platform, and service desk are all shipping agents into tenants you already pay for, and many can be switched on by a department admin with no purchase order. HubSpot put Agent Hub and Agent Builder into public beta in July 2026 for Professional and Enterprise customers. SAP says its AI Agent Hub arrives in Q3 2026. Google Threat Intelligence moved its agentic capabilities to general availability. Gartner projects 40 percent of enterprise applications will feature task-specific AI agents by year end, up from less than 5 percent in 2025. Buy versus build has quietly become govern-what-arrives, and most IT organizations are behind on it.
An embedded vendor AI agent is an autonomous capability shipped inside a SaaS product you already license. It runs on the vendor's infrastructure, uses the data in your tenant, and acts under a permission model the vendor defines. That last part is the whole story.
The distinction that matters is not chat versus agent in the marketing sense. It is whether the software acts in a system of record without a person pressing the button. A copilot drafting an email for review is an assistant. Something that closes an alert as benign, updates a deal stage, issues a credit, or replies to a customer is an agent, and it belongs in change management, access reviews, and audit evidence. HubSpot built a hub because agents without shared context step on each other. The harder version of that problem is what happens across the six other products you run.
Three things changed at once. First, supply: the Gartner forecast is a step change from rounding error to default feature, and July's announcements from HubSpot, SAP, and Google are what that looks like on the ground.
Second, capital and packaging. Microsoft announced Microsoft Frontier Company on July 2, 2026, an operating business for enterprise AI deployment backed by a reported 2.5 billion dollar commitment, and vendors such as Ushur launched agentic platforms the same month. Agents are how software companies expect to be paid now.
Third, a governance tooling market appeared to meet it. Alterion launched Draco on July 16, 2026, a runtime control plane that sits between agents and infrastructure to enforce policy across clouds, vendors, and endpoints. When a category exists to control agents you did not build, that tells you where the pain is.
The constraint has not changed. Across the July reporting, the limit on adoption is organizational: fragmented data, unclear ownership, too few people who can implement this. Model capability is not the bottleneck. Your operating model is the bottleneck.
You are no longer deciding whether to adopt AI agents. You are deciding whether the ones already arriving in your SaaS tenants run under your policy or each vendor's defaults. Write the standard before the first business unit clicks enable, because after that you are doing archaeology instead of governance.
Seven questions, answered in writing, before anything goes live. Send them to every vendor whose roadmap mentions agents, not just the one in front of you.
Does it run as a distinct service principal, as the tenant, or as the user who triggered it? Can you tell an agent action from a human one in the record history? If it inherits a user's full permissions, its blast radius equals that user's and least privilege does not apply. Same problem as in the AI agent governance checklist, and it is the first question, not the fifth one.
Read scope and write scope are separate answers, and vendors often give only the first. Ask for the objects, fields, and attachments in scope, whether it reaches connected systems through the vendor's integrations, and which actions are creates and updates versus deletes and sends. Exclude regulated data explicitly rather than assuming it out.
You need the action, the inputs, the plan where available, the timestamp, and the authorizing identity. Then the question that separates real logging from a dashboard: does it export to your SIEM, and what is vendor-side retention? Evidence you cannot pull into your own stack is not evidence you have.
Ask which actions can be gated, at what granularity (action type, dollar threshold, customer tier, confidence score), and whether a business admin can remove a gate without IT knowing. A control a department can silently disable is no control.
Get contractual language, not a support article. Is tenant data used to train shared models or improve the vendor's product? Is inference isolated per tenant? Which subprocessors and model providers are involved, and are you told when they change? Our AI security and governance work starts here, because answers vary inside a single product line.
You want an instant disable at tenant scope, not a support ticket. Ask who can trigger it, how fast it lands, whether in-flight actions roll back or complete, and whether one agent can be stopped without losing the feature set your team depends on. Test it during the pilot.
Consumption pricing on agent actions is now common, including credit models where custom agents draw down a balance as they act. Ask what counts as billable, whether retries and failures bill, whether you can cap spend per agent, and what alerts fire before the cap. A retry loop is a budget incident, and finance will notice first.
Some will not, and the non-answer is the answer. Treat silence on three of the seven, identity model, audit export, and training-data use, as a default-off decision: the agent stays disabled until you have language you can hold them to. Record the gap in your inventory next to that vendor, with a date, so it is a tracked exception and not an unspoken assumption. Then put it on the renewal agenda, where you have leverage a support ticket will never give you.
Embedded agents win when the work lives entirely inside one vendor's data and permissions. Ticket triage in the service desk, alert triage in a security platform, record hygiene in the CRM, invoice matching in the ERP: the agent has the context natively, the vendor solved the integration, and building it yourself means rebuilding their data model. Google moving agentic threat hunting to general availability is work best served next to the data it interrogates. If a vendor agent covers 80 percent of a job, take it.
Build, or orchestrate, when any of these apply. The workflow crosses systems no vendor owns, which is most of the ones that move a number. The logic is proprietary and part of how you compete, and a generic vendor agent flattens that advantage. Regulation or contract requires your own audit trail, residency, or model choice. Per-action economics break at your volume. Or you need one policy applied identically across vendors, not seven defaults. That is the case for custom AI agents and the layer above them, in multi-agent orchestration and governance.
For most mid-market companies the answer is both: vendor agents for in-app work, workflow automation and custom agents for cross-system paths, neither growing without an owner. The trade runs along four lines.
Data scope: everything in that tenant, under the vendor's permission model. Deep inside the app, blind outside it.
Audit trail: the vendor's log format and retention. Real evidence only if it exports to your SIEM.
Cost model: per action or per credit. Cheap to start, hard to forecast at volume.
Lock-in: the logic lives in the vendor's canvas and leaves when you do.
Data scope: exactly what you grant, across systems no single vendor can see.
Audit trail: your schema, your retention, one format across every workflow.
Cost model: build and run cost you own. Higher up front, predictable per unit at volume.
Lock-in: portable logic, with models and vendors swappable underneath.
Shadow IT took years to accumulate because someone had to enter a credit card. Shadow agents accumulate in months, inside tools that already passed procurement, one toggle at a time.
Picture a mid-market estate at year end: seven SaaS platforms, each with two or three agents enabled by the department that owns the tool, each with its own permission model, log format, approval settings, and meter. No inventory lists them, and nobody can say how many autonomous actions ran against customer data last week. That is exactly what an auditor will ask.
The failure modes are predictable: conflicting actions on one record, permission creep as agents get broader scope to make a demo work, orphaned agents whose creator changed roles, no consolidated view of cost. Treat every enabled vendor agent as a non-human identity with a named owner and a documented purpose, the standard in governing an AI agent workforce.
To be fair, some vendors are reaching past their own products. SAP's AI Agent Hub, generally available in Q3 2026 inside SAP LeanIX, is pitched as vendor-agnostic: it auto-discovers agents through integrations with SAP, Google, and Microsoft repositories, captures risk ratings and compliance mappings per agent, and governs an agent from proposed to decommissioned. That is genuinely cross-vendor, and more than most of the market offers.
It is still not your control plane, for three reasons. Coverage is bounded by which repositories that vendor has integrated, so agents in the platforms outside the list stay invisible. It is anchored to one vendor's policy model, a good fit if you are standardized there and a non-starter if you are not. And a control plane owned by a company that also sells you agents is not a neutral referee, however well built. Use what a vendor hub gives you, and keep the accountable layer yours. It has four elements, all achievable with tools you already own.
None of this needs a new hire. It needs a named owner, in most mid-market companies the IT director or the security lead, and roughly four to six hours a month to run the review once the inventory exists. What it does not survive is being nobody's job, which is where an AI consulting engagement earns its keep.
Embedded vendor agents are the fastest path to useful AI and the fastest path to an ungoverned estate. Same fact: enablement is easy, which is why the standard has to exist before the toggles get flipped. Ask the seven questions, pilot with gates on, keep custom agents for the cross-system work vendors cannot see, and build the control plane while the inventory is still short enough to write down in an afternoon. The companies that look competent in 2027 will not be the ones with the most agents. They will be the ones that can say, in one query, what every agent did last week. Infonaligy designs and governs agent estates across Dallas–Fort Worth and, through remote delivery, nationwide.
Infonaligy helps IT and executive teams evaluate, enable, and govern vendor-embedded AI agents alongside custom ones, from our Dallas–Fort Worth home base and, through remote delivery, for companies nationwide.
Book an assessment and we will inventory the vendor agents already enabled in your tenants, set the evaluation standard, and design the control plane that keeps them accountable.
Infonaligy