The Scarcity Isn't Code Anymore

What enterprises actually buy when they buy SaaS

For most of the SaaS era, the transaction has been straightforward: enterprises pay a vendor to build, host, and operate software on their behalf. The per-seat license covers not just the application, but the entire management plane beneath it: identity, access control, audit logging, compliance, uptime, security patching, data residency.

When a CISO approved a SaaS vendor, they were not approving the features alone. They were approving the operational envelope: the SOC 2 report, the incident response process, the data handling practices, the authentication model. The management plane came bundled with the product. The price of the license covered both.

This model works when building software is expensive. If it costs millions to build a CRM, it makes sense to buy one and let the vendor absorb the operational overhead. The economics were clear for decades.

The economics are changing.

The cost collapse

The marginal cost of producing working software is approaching zero. Large language models have compressed the cycle from specification to functioning code from months to hours. A single engineer with an AI coding assistant can produce in a day what previously required a team and a quarter. A product manager can prototype a working system over a weekend. An operations team can build an internal tool between meetings.

This is not a marginal improvement in developer productivity. It is a structural change in who can build software, how fast, and at what cost. The capability is real, it is accelerating, and it is available to every enterprise with a browser and a subscription.

This changes the calculus of make versus buy. When the application layer was expensive to produce, buying made sense. When it is cheap to produce, the question shifts: what are you actually paying for when you pay a SaaS vendor $150 per seat per month?

Disruption from two directions

The pressure on the existing model is not coming from one direction. It is coming from two, simultaneously.

From below, the cost of building replaces the need to buy. Internal teams can now produce functional alternatives to SaaS tools that previously required a vendor, a contract, and a six-month implementation. The long tail of enterprise SaaS — the tools that are useful but not critical — is being rebuilt in-house.

From above, hundreds of agentic SaaS tools are spreading through enterprises with minimal oversight. Every AI-native application that connects to enterprise data brings a new integration point, a new set of permissions, a new data flow that someone needs to govern.

Both directions converge on the same problem. The management plane that SaaS vendors bundled into their products — identity, policy, audit, compliance — is becoming the enterprise's direct responsibility.

The management plane becomes your problem

Here is what the make-versus-buy reframing misses: when you build rather than buy, the management plane is no longer someone else's problem. It is yours.

A SaaS vendor bundles identity management into the product. When you replace that product with an agent, you need identity management for the agent. A SaaS vendor provides audit logging. When you replace the product, you need audit logging for the agent's actions. Compliance evidence. Access control. Data residency. Incident response. All of it, for each system, from day one.

The application layer got cheaper. The management plane did not.

As the number of agent-built and agent-operated systems grows — and it will grow, because the economics are irresistible — the management plane cost does not grow linearly. It grows combinatorially. Each new agent needs identity, policy, audit, compliance. Each new agent-to-tool connection needs governance.

Where value concentrates

The structural inversion is now visible: as the cost of producing working software falls, value migrates to the constraint that does not fall.

That constraint is governance. Identity. Policy. Audit. Compliance. The proof that software behaves correctly, at scale, to regulators, boards, and customers.

Every prior era of enterprise computing produced this pattern. When networks grew complex, the bottleneck was authentication and directory services. When applications became distributed, the bottleneck was governing API access. When infrastructure moved to the cloud, the bottleneck was managing secrets and orchestrating containers. In each case, the application layer commoditized. Value concentrated at the operations layer.

The agent era follows the same arc — the scarcity is not code, it is control.

A new budget category

Enterprise technology spend is reorganizing around this shift. The enterprises that recognize this early will build governance as infrastructure — a platform that applies consistently across every agent, every tool, every runtime. One identity model. One policy engine. One audit trail. Deployed once, extended across the estate.

The enterprises that do not will accumulate governance debt: per-agent, per-tool, per-team solutions that become more expensive and more fragile as the number of agents grows.

When code is cheap, governance is the scarce resource. The enterprise that treats governance as durable infrastructure captures the value that the commoditizing application layer leaves behind.