ServiceNow vs SAP vs Workday: Can Your AI Agent Get In?

A buyer-side, three-way decision matrix: whether your Claude, Copilot, or homegrown agent can reach each system of record, through which gateway, what gets metered, and what one operation actually costs.

ServiceNow vs SAP vs Workday AI agent access, in one table

Across ServiceNow, SAP, and Workday AI agent access in 2026, only one of the three hard-blocks your external agent: SAP. ServiceNow and Workday both let your Claude, Copilot, or homegrown agent in through an official gateway, but charge per operation; SAP routes everything through its own Joule agents under the A2A protocol. If you are an architect deciding whether your agent can reach a system of record (SoR), the question is no longer ‘is there an API’ but ‘which gateway am I forced through, what does it meter, and what does one call cost.’

Every other ranking write-up on this topic is a single-vendor news story. None of them puts the three systems of record side by side and answers the buyer’s actual question. This is that matrix. Read the table first, then the per-vendor sections explain the nuance and the cost math behind each cell.

The pattern that emerged across SAP Sapphire, ServiceNow Knowledge, and Workday’s spring announcements is identical in shape even where the policy differs: the vendor now owns the door (the gateway), the toll booth (per-operation metering), and the bouncer (a governance/control plane that verifies identity and scopes permissions). The differences are in how open the door is and how aggressive the toll.

Can external AI agents access SAP? Not directly anymore

No — as of its April 2026 API policy, SAP bars third-party autonomous and generative agents from planning, selecting, or executing sequences of API calls. Your external agent can only reach SAP data by going through SAP’s own Joule Agents over the A2A protocol; direct OData/REST access for agentic use is no longer permitted. This is the single biggest reason ‘sap blocks third party ai agents’ is now a procurement question, not a technical one.

Section 2.2.2 of SAP’s API Policy v4/2026 states that external AI agents are no longer allowed to use SAP APIs, prohibiting the use of SAP APIs by AI systems that independently schedule or execute calls. SAP’s Chief Customer Officer Thomas Saueressig was explicit per Techzine: ‘for agentic use cases, A2A via Joule is the only way.’ Enforcement is not theoretical — coverage points to a security patch beginning around June 9, 2026 that technically blocks noncompliant calls.

The architectural cost is what integrators call the double-inference problem. Your external agent reasons, then hands the request to a Joule agent, which reasons again to understand and execute it. That is double the latency and double the inference cost on every agentic action, on top of the commercial relationship. For a Microsoft Copilot for Finance instance trying to read the SAP general ledger, the path is now Copilot → A2A → Joule → SAP, not Copilot → SAP.

SAP does provide a management layer for the agents it does allow. The SAP AI Agent Hub, built on SAP LeanIX and unveiled at Sapphire 2026, is a vendor-agnostic command center for inventorying and governing agents, LLMs, and MCP servers — including SAP, Joule Studio, and third-party agents running in connected systems. The SAP Knowledge Graph is the semantic layer that connects entities across SAP and non-SAP data. But governing an agent’s metadata is not the same as letting it execute: the Hub catalogs and risk-rates agents; the API policy still decides which ones may act.

ServiceNow Action Fabric: open, but metered per operation

ServiceNow Action Fabric lets any external agent — built on Claude, Copilot, or your own stack — execute governed enterprise actions headlessly through the now-GA MCP Server, with no proprietary chat UI required. The trade-off is metering: headless actions consume the same Assist currency as Now Assist and AI Agents, so you pay per operation. This is the most open of the three models and the cleanest answer to ‘servicenow action fabric’ as a buyer concern.

Announced at Knowledge 2026 and live as of the May 5, 2026 press release, Action Fabric exposes roughly two decades of ServiceNow workflows, playbooks, and approval chains to external agents via the Model Context Protocol. The MCP Server is generally available today and included in every Now Assist and AI Native SKU. Anthropic is the first design partner, with Claude Cowork wired directly into ServiceNow’s system of action — a useful signal if your agent is Claude-based.

Governance is mandatory, not optional. Every action runs through the ServiceNow AI Control Tower (AICT), so it is identity-verified, permission-scoped, and fully auditable. The MCP Server Console adds managed OAuth, enterprise audit trails, session management, and role-based tool packages. Analysts at Reworked frame AICT alongside Workday’s Agent System of Record and Microsoft Agent 365 as the emerging class of agent monitoring and management control planes.

On cost, ServiceNow gives you the most concrete numbers of the three. Per third-party licensing guides, Now Assist meters in ‘assists’: small generative tasks run around 25 assists and large agentic actions around 150 assists, and a Now Assist skill exposed as an MCP tool consumes its usual assists plus 1 assist per invocation. There is no separate line item for headless MCP access — it folds into the same consumption model — which is convenient for finance but dangerous for a chatty agent that fans out dozens of tool calls per task.

Workday Agent Gateway metered pricing: delegate or call direct

Workday’s Agent Gateway lets external agents in through open standards — MCP and A2A — and gives you a fork: delegate to Workday’s own agents to inherit Workday’s rails, or call Workday APIs directly. Both paths are now metered per call, billed in Flex Credits. That fork is the most important architectural decision in the whole comparison, which is why ‘workday agent gateway metered pricing’ deserves its own analysis.

Per Josh Bersin’s account of Workday’s reinvention, external agents enter through the Agent Gateway as the single front door, then either delegate to Workday agents (inheriting Workday’s governance and guardrails) or hit APIs directly. The Agent System of Record already has over twelve hundred customers registering and observing agents. Crucially, Workday is moving from pure seat licensing to a hybrid of seats plus consumption, with Flex Credits as the unit — and APIs that external platforms use are now metered per call to capture revenue Workday considers uncollected.

The framing matters for your budget. Workday’s leadership positions agent access as financial upside, pricing the platform to ‘its actions, not how many employees you have.’ Translation for the architect: every external-agent call is a revenue event for the vendor, so assume the meter is designed to grow with your usage, not to merely recover cost. Negotiate the consumption rate and a volume ceiling before you wire agents into payroll, HCM, or financials.

The delegate-vs-direct choice is a governance-versus-control trade. Delegating inherits Workday’s rails — auditability, privilege management, and the standards-based access system — at the price of less control over execution logic. Calling APIs directly gives you full control but moves the compliance and observability burden onto your own agent, and still meters per call. Most enterprises will delegate for sensitive writes (anything touching pay or PII) and reserve direct API calls for high-volume reads where they can batch.

What does one agent operation actually cost across the three?

ServiceNow is the only vendor with publicly traceable per-operation numbers: roughly 25 assists for a small generative task and 150 assists for a large agentic action, plus 1 assist per MCP tool call. Workday meters per call in Flex Credits but does not publish a public rate card, and SAP has no third-party meter because there is no third-party path — your cost there is the Joule commercial relationship plus double-inference overhead. The chart below normalizes what is publicly known into the comparable unit each vendor uses.

The honest caveat: these are not apples-to-apples dollars, because each vendor uses a different unit (Assist currency, Flex Credits, and ‘n/a’) and final dollar rates require account-team quotes. What the numbers do show is the relative shape of the meter — ServiceNow’s per-call increments are small but compound on chatty agents, while SAP’s cost is structural (you pay in latency and inference twice) rather than per-operation.

For planning, model your agent’s workload, not a single call. An agent that reads five records, evaluates a policy, and writes one update is not one operation — on ServiceNow it can be six-plus MCP tool calls (each +1 assist) wrapped around one or more agentic actions (≈150 assists each). On Workday it is one metered call per API hit. On SAP it is one Joule round-trip per agentic step, each carrying double inference. Retries, polling, and overly granular tool design are where these bills quietly explode.

Which is the agent control plane: Action Fabric, SAP AI Agent Hub, or Agent 365?

All three SoR vendors now ship an agent control plane — ServiceNow AI Control Tower, SAP AI Agent Hub (on LeanIX), and Workday’s Agent System of Record — and analysts increasingly equate them with Microsoft Agent 365 as the management and monitoring layer for agents. The difference is whether the control plane also gates execution (SAP) or mainly governs and observes while the gateway gates access (ServiceNow, Workday).

This is where the systems converge architecturally even as their access policies diverge. Reworked explicitly groups Action Fabric and Workday’s Agent SoR with Microsoft Agent 365 as the new agent-management category. Microsoft’s own Build 2026 stack — Agent 365, the Windows Agent Framework, and Foundry Agent Service — pushes the same idea from the OS and cloud side: a registry, an identity model, and a meter for every agent. The SoR vendors are racing to be the control plane so that the meter (and the lock-in) lives with them.

For a buyer, the practical question is overlap. If you standardize on Microsoft Agent 365 as your enterprise-wide agent control plane, you will still hit each SoR’s own gateway and meter when your agent acts on that system — Agent 365 governs your agent’s identity and lifecycle, but ServiceNow’s AICT and Workday’s gateway still authorize and meter the action inside their walls. Expect to run two control planes in series, not one, until interoperability matures.

Verdict: which system of record is friendliest to your external agent?

For external AI agent access, ServiceNow is the friendliest (open via Action Fabric, transparent per-operation metering), Workday is a close second (open via Agent Gateway, but with an opaque per-call meter framed as revenue upside), and SAP is the most restrictive (no third-party agentic path — Joule only, the only HIGH procurement-risk flag in our matrix). Pick your architecture around the gateway you are forced through, not the connector you wish you had.

If your agent strategy is multi-SoR — and most are — design for the lowest common denominator: MCP plus A2A tool definitions that stay portable, delegation to vendor agents for sensitive writes, and a hard cap on tool-call fan-out to keep the meters in check. Treat SAP as a special case requiring a Joule relationship, and treat the per-operation cost as a first-class line in your agent’s unit economics.

Builder’s take

I build agents that have to touch real systems of record, so I read these announcements as an integrator, not a press-release reader. The headline isn’t ‘everyone is opening up.’ The headline is that the door, the toll booth, and the bouncer all moved to the vendor’s side of the wall in the same quarter.

• Treat the gateway as a hard architectural dependency, not a connector detail. SAP’s Joule-only rule means a design that assumed direct OData calls is now a procurement risk, not a refactor.
• Price the agent like an employee with a meter. ServiceNow charging ~150 assists for a large agentic action and +1 assist per MCP tool call means a chatty agent can cost more than the human it replaced. Cap retries and batch reads.
• The delegate-vs-direct fork is the real decision. Delegating to the vendor’s own agent inherits its guardrails and audit trail for free; calling APIs directly gives you control but puts the governance burden (and often the higher meter) on you.
• Assume metering is a revenue line, not a cost-recovery line. Workday’s CEO framed agent access as upside; budget for it to climb as your agents get busier, and negotiate consumption rates before you wire anything up.
• Build vendor-agnostic at the protocol layer. MCP plus A2A is now the common substrate across all three; keep your agent’s tool definitions portable so a policy change at one SoR doesn’t strand your whole architecture.

Frequently asked questions

Primary sources

• SAP blocks external AI agents. Salesforce and ServiceNow don’t. — Techzine Global
• ServiceNow opens its full system of action to every AI Agent — ServiceNow Newsroom
• The Reinvention of Workday: From System of Record to Platform of Agents — Josh Bersin
• SAP launches AI Agent Hub at Sapphire 2026 to tame vendor agent sprawl — The New Stack
• ServiceNow Wants to Be the Control Layer for Every AI Agent — Reworked
• SAP is Attempting to Become the Gatekeeper of Enterprise AI — Forrester
• ServiceNow Now Assist Pricing 2026: AI Licensing & Negotiation Guide — Atonement Licensing

Last updated: June 6, 2026. Related: Governance.