Four weeks ago the dominant enterprise AI buying question was still some variant of which model. Today it is which control plane.
Salesforce moved Agentforce Multi-Agent Orchestration to general availability on 15 June with the Summer '26 release, anchored on a new Atlas Reasoning Engine 3.0 and the Agentforce Trust Layer. ServiceNow extended its AI Control Tower into Microsoft Agent 365 through a deepened partnership that puts ServiceNow specialist agents directly into the Microsoft Agent 365 Marketplace. Google's Gemini Enterprise Agent Platform shipped native integrations with Adobe, Atlassian, Salesforce, ServiceNow, and Workday, with partner agents available through a new Agent Gallery inside the Gemini Enterprise app. Anthropic confidentially filed its draft S-1 with the SEC on 1 June after the $65 billion Series H round at a $965 billion post-money valuation.
Four marketplace moves in three weeks. Each from a vendor already embedded inside the average Australian enterprise stack. The collective message is plain: agents are no longer a build versus buy question. They are a procurement question, and the procurement decision now selects a governance fabric, not a model.
Australian CIOs running FY27 planning are about to confront a problem that did not exist in FY26 budgets.
The Buying Criterion Quietly Changed
For most of the last eighteen months the enterprise AI conversation was about raw capability. Which model reasons better, which has the longer context window, which writes code more reliably, which hallucinates less. That conversation has not ended, but it is no longer where the buying decision sits.
The reason is operational. Capability gaps between frontier models have narrowed inside enterprise workflows. Claude, Gemini, GPT, and Llama variants all perform competently against the typical retrieval-grounded business task. What separates one production agent deployment from another is not the underlying reasoning quality. It is whether the agent can be authorised, audited, observed, rolled back, and coordinated with other agents without manual stitching.
That is a control plane question, and every major platform vendor just declared they intend to own it.
Salesforce's Atlas Reasoning Engine 3.0 acts as the orchestrator that reads subagent descriptions and routes work between them. ServiceNow's AI Control Tower is positioned as the single inventory and policy layer across every agent operating inside the enterprise, including non-ServiceNow ones. Microsoft's Agent 365 fabric provides agent identity, lifecycle, and access control across the Microsoft estate. Google's Agent Platform offers the same primitives across Vertex, Workspace, and partner agents.
These are not interoperable layers. They are competing control planes, each selling the same governance story to the same buyer.
What ServiceNow, Microsoft, and Salesforce Are Actually Selling
The marketing language across the four announcements collapses to a small number of repeated promises: governed agent inventory, scoped permissions, audit trails, human-in-the-loop controls, cross-platform interoperability. Each vendor is making the same offer in different words.
That convergence is the story. A year ago the enterprise AI vendors were competing on what their model could do. This quarter they are competing on whether you let them be the system of record for every agent you run.
ServiceNow's positioning is the most aggressive. Its AI Control Tower now claims governance scope over agents that originate from Microsoft, Salesforce, and third parties through Microsoft Agent 365. The pitch is that the existing CMDB and IT operations layer should be the enterprise's agent register, with policy enforcement extending across vendor boundaries.
Microsoft's positioning runs in parallel. Agent 365 is the identity, lifecycle, and access fabric for any agent operating against the Microsoft estate, with ServiceNow's Control Tower integrated as a partner. The two stories are technically aligned right now. The commercial overlap will surface inside customer accounts later this year.
Salesforce, with Agentforce now at $800 million ARR, is building a closed-loop control plane inside Salesforce data. Atlas Reasoning Engine 3.0, the Agentforce Trust Layer, and the new MCP-based Tableau integration are designed to keep agent coordination, data access, and analytics inside the Salesforce trust boundary. Salesforce does not want to be one node in someone else's agent fabric. It wants to be the fabric for the customer-facing motion.
Google's play is the most ecosystem-friendly. Gemini Enterprise Agent Platform leans on native integrations and an Agent Gallery, with explicit support for partner agents from Adobe through to Workday. The bet is that breadth and Google Cloud's developer tooling will outlast the closed-vendor approaches.
Four vendors. Four control planes. One enterprise.
The 14 Per Cent and the 42 Per Cent
The Australian context sharpens the decision. Gartner's local forecast has IT spend reaching A$172.3 billion in 2026, with data centre systems up 22.5 per cent and server spend up 30 per cent on the back of AI workloads. Fourteen per cent of Australian CIOs say they already have agents running in production. Forty two per cent expect to within twelve months.
That second number is the budget event hiding inside FY27 plans. The procurement calendars for those rollouts are running now. Most are being scoped against vendor demonstrations that emphasise capability, not governance. The control plane choice is being made implicitly, by whichever vendor closes the first agent deal in the account.
Once that choice is made, the second and third agent deployments tend to follow the same fabric. Not because the procurement team decided to standardise. Because the integration cost of running an agent under a different control plane is steep enough to discourage it. The control plane question gets answered by inertia rather than design.
This is how vendor lock-in resurfaces in the agentic era. It does not arrive labelled. It arrives as a sequence of pilot decisions that each looked tactical at the time.
The ASD and ACSC Have Already Set the Baseline
In May, the Australian Signals Directorate's Australian Cyber Security Centre, alongside CISA, the NSA, and partners in Canada, New Zealand, and the United Kingdom, published Careful Adoption of Agentic Artificial Intelligence (AI) Services. The guidance is direct: until evaluation methods, security practices, and standards mature, organisations should assume agentic AI systems may behave unexpectedly, plan deployments with resilience, reversibility, and risk containment ahead of efficiency gain, and adopt incrementally with low-risk tasks.
That guidance now sits on top of every vendor marketplace pitch. Australian regulated industries, federal agencies, and critical infrastructure operators have a published baseline against which their agent deployments will be measured. The marketplace decisions being made this quarter need to be defensible against that baseline.
Vendor demo scripts rarely run against the ASD and ACSC checklist. Procurement teams should.
What a Defensible Control Plane Evaluation Looks Like
The good news is that the enterprise teams running pilots successfully have converged on a small number of evaluation questions. They cut through the marketing layer without requiring deep technical analysis of the underlying model.
Six questions decide whether a vendor's control plane is enterprise-grade or marketing-grade:
- Does the agent have its own identity at the IAM layer, distinct from the user it acts on behalf of, with short-lived credentials and per-action authorisation rather than session-wide trust?
- Can the platform produce a real inventory of every agent operating in the environment, including third-party and partner agents, with system owner, tool scope, and blast radius recorded against each?
- Does logging capture the agent's reasoning trace, tool calls, and authorisation decisions at a granularity that supports incident reconstruction, not just outcomes?
- Is there a reversibility plan for every agent writing to a system of record, with detection, isolation, and rollback paths defined before deployment?
- Are containment boundaries enforced at the platform layer, limiting which tools an agent can call and which data it can read, rather than left to agent prompt configuration?
- Are agents adversarially tested against malformed and adversarial inputs before deployment, not just against the intended workflow?
Salesforce, ServiceNow, Microsoft, and Google all claim to support these in marketing collateral. The procurement question is which ones do so as enforced platform behaviour and which ones leave them as the customer's responsibility to configure. The gap between the two is where most production incidents will originate.
The Anthropic IPO Tells a Parallel Story
The other notable move this month sits one layer down the stack. Anthropic's confidential S-1 filing on 1 June, following the $65 billion Series H at a $965 billion post-money valuation, made it the most valuable AI company by market expectation. Run-rate revenue crossed $47 billion in May, with an October Nasdaq listing being targeted.
For enterprise buyers the IPO matters for two reasons. First, it confirms that the underlying model layer is now commercially mature enough to underwrite public-market valuations. The model layer is not the differentiating risk in an enterprise agent deployment. Second, it changes the disclosure surface for any enterprise relying on Claude inside production workflows. A listed Anthropic will publish quarterly figures, customer concentration data, regulatory commentary, and capacity guidance. That information feeds directly into vendor risk reviews and capacity planning conversations that today rely on private disclosures and analyst inference.
The model layer is becoming a stable, listed, governable input. The control plane layer is where the strategic decision still lives.
What This Means for FY27 Planning
For Australian technology and business leaders running FY27 planning, three changes deserve to land in the document this month rather than next quarter.
The first is to treat the agent control plane decision as an architectural choice with five-year consequences, not as a tactical procurement decision tied to the first agent rollout. The control plane sets the governance ceiling for every subsequent deployment.
The second is to write the ASD and ACSC agentic guidance into vendor evaluation criteria explicitly. Vendor responses against the six questions above should be a documented part of the procurement record. A vendor that cannot answer them in plain language is not yet a defensible enterprise partner for agentic deployments.
The third is to expect orchestration vendors to compete on each other's accounts. ServiceNow, Microsoft, Salesforce, and Google have each declared themselves the agent governance layer. They cannot all be right inside a single enterprise. Procurement room available right now will compress quickly once one of them is incumbent.
Where Wai and ARC Fit
Wai works with technology, SaaS, and enterprise teams on the layer that sits underneath the public AI agent story: how agents are deployed, how they are governed, how their outputs are made discoverable, and how the organisation's authority is positioned in front of buyers and AI retrieval systems.
ARC is Wai's authority and AI-visibility infrastructure layer. It is built for the world that Salesforce, ServiceNow, Microsoft, and Google have just declared open: one in which agents read, rank, and act on enterprise content at scale, and in which discoverability inside AI retrieval systems is as commercially material as discoverability inside Google search was a decade ago. ARC is the layer that makes an organisation's content, expertise, and product surface area discoverable, attributable, and cited inside AI retrieval systems while keeping the underlying infrastructure governable.
For Australian technology teams running agent strategy and AI visibility in parallel, that combination is the work.
Frequently Asked Questions
What is the AI agent control plane and why does it matter now?
The agent control plane is the platform layer responsible for agent identity, inventory, permissions, logging, and policy enforcement across an enterprise's agent deployments. It matters now because the four largest enterprise platform vendors, Salesforce, ServiceNow, Microsoft, and Google, all moved in the last month to claim that layer for themselves. Choosing a control plane sets the governance ceiling for every subsequent agent deployment in the organisation.
What changed with Salesforce Agentforce in the Summer '26 release?
Agentforce Multi-Agent Orchestration reached general availability on 15 June, anchored on the new Atlas Reasoning Engine 3.0 and the Agentforce Trust Layer. The release adds an orchestrator agent that reads subagent descriptions and routes work between specialists, with permissions and data access governed by the Trust Layer. Tableau integration via MCP brings analytics into the agent fabric inside Salesforce's trust boundary.
How does ServiceNow AI Control Tower integrate with Microsoft Agent 365?
ServiceNow and Microsoft deepened their partnership to integrate AI Control Tower with Microsoft Agent 365, extending governance across Microsoft's AI agent ecosystem. ServiceNow specialist agents are also available through the Microsoft Agent 365 Marketplace, which lets ServiceNow's Autonomous Workforce operate across Microsoft 365 tools. The combined positioning is that AI Control Tower becomes the cross-vendor agent register and policy layer.
Should Australian enterprises commit to a single-vendor agent fabric or multi-vendor?
Neither answer is universally correct. Single-vendor fabrics simplify governance and accelerate deployment inside that vendor's data and workflow surface. Multi-vendor fabrics preserve negotiating room and avoid concentration risk but require the organisation to operate its own integration and policy layer. The defensible position is to make the choice deliberately, document it against the ASD and ACSC guidance, and revisit it annually rather than letting it be set by the first pilot procurement.
What does Anthropic's IPO filing mean for enterprise AI buyers?
Anthropic's S-1 filing, following the $965 billion valuation Series H, signals that the model layer is now commercially mature enough for public-market scrutiny. For enterprise buyers it makes Claude-based deployments easier to underwrite at board level and brings additional disclosure that supports vendor risk review. The strategic differentiation in enterprise AI continues to move up the stack, from model to control plane.
