Agents Hit the Runtime Wall: ServiceNow's 9×, Replica Cyber's Isolation, and How OntiCards Got Ahead

Over the past two weeks we wrote that the semantic layer is the new data stack for agents and that enterprise Text-to-SQL accuracy falls to 25% without one. Both pieces converged on the same claim: model capability is already good enough. Governance is the bottleneck.

In the last week of August, three vendors proved that claim from three different angles — and ended up at the same place: agents locked inside observable, pausable, auditable boundaries.

ServiceNow shipped an AI Control Tower that pushed production-agent customers up 9× in nine months. Replica Cyber gave high-risk agents an isolation engine that security teams can stop or replay. Kyndryl and Google Cloud used a semantic layer plus guardrail agents to push Incore Bank's KYC onboarding to 99% extraction accuracy under FINMA supervision.

Three news items. Three angles. One conclusion: enterprise agents have entered the runtime-isolation era.

1. ServiceNow: Treat AI Agents as a CMDB Configuration Item

On August 27, the day before the Deutsche Bank Technology Conference, ServiceNow was in the market's spotlight. The trigger was the Q2 2026 earnings report published on July 22: total revenue of $3.99 billion, up 24% year over year; AI annual contract value past $1 billion; the number of customers running agentic AI in production grew 9× in nine months; deals above $1 million tripled. Shares rallied 29% in the month that followed.

The most consequential number, though, is buried in the pricing model: 50% of net new business is no longer seat-based. ServiceNow CFO Gina Mastantuuno put it plainly: "Customers aren't paying us for tokens, they're paying for resolutions."

The product behind that commercial shift is the AI Control Tower. Its design logic is unmistakably ServiceNow: treat AI agents, models, and MCP servers as Configuration Items inside the CMDB and reuse decades of IT service-management practice — discovery, scoped access, audit trails, change controls.

• Top layer — Control Tower: governance, compliance, discovery, orchestration. Solves "how many agents actually run inside this company?"

• Middle layer — AI Orchestrator: cross-domain task delegation and inter-agent coordination. Solves "who actually owns this work?"

• Bottom layer — AI Specialists: domain expert agents for IT, HR, security, and customer service. Solves "who actually does the work in each domain?"

This is governance-as-product. ServiceNow turned governance from an internal cost center into a separately priced SKU. Every deployed agent has to be registered, discovered, authorized, and audited — and that friction is now a revenue line.

2. Replica Cyber: An Agent That Needs an Exception Should Never Run

On the same day — August 31 — Replica Cyber in McLean, Virginia, announced an even more aggressive answer: run every agent inside an isolated environment. Each agent gets its own OS, its own network, and its own view of data. Security teams can watch it, pause it, terminate it, and replay every action it took.

Replica co-founder and CEO Kristopher Schroeder stated the commercial thesis in one sentence: "An agent that needs an exception is an agent no regulated enterprise should ever run."

The reason that position matters: it describes the real cause of failed enterprise AI projects over the past year. Models are not too weak. Governance is too late:

• Gartner projects that 40% of agentic AI projects will be cancelled by the end of 2027 due to inadequate risk controls.

• Replica Cyber's "Exception Economy" survey found that 32% of security leaders had delayed or cancelled an AI deployment in the past year because no secure environment existed to run it in.

The word "exception" is the key. Once a security policy grants an exception to a single agent, that agent has high privilege over the production network — and the same risky action can repeat ten thousand times overnight. Replica's isolation environment is not a feature; it is a structural floor on blast radius. Even when the agent misbehaves, damage stays inside the sandbox.

CTO Ryan Underwood sharpened the principle further: "Guardrails and permission lists have not proven to contain agents. The moment you give an agent real freedom to act on its own, isolation is the only boundary that will hold."

This is not a product slogan. Replica's isolation platform has been running in production at U.S. defense and global financial services customers for eight years, backed by 24+ AI-related patents, SOC 2 Type II, and DoD Authority to Operate. Putting an AI agent inside an isolated environment is not a new concept for regulated industries — it is existing security practice applied to a new workload.

3. Kyndryl × Incore Bank: 99% Extraction on a Regulated KYC Pipeline

The third headline on August 31 also came from financial services. Kyndryl and Google Cloud completed an agentic-AI KYC PoC at Switzerland's Incore Bank, a FINMA-regulated B2B transaction bank. The stack was Google Gemini plus the Kyndryl Agentic AI Framework, but the emphasis was not on the model — it was on the governance scaffolding:

• Multiple agents handling structured and unstructured data

• Policy-as-Code: compliance rules, risk factors, and risk thresholds expressed as code

• Guardrail agents that validate every high-risk action before it executes

• Customer risk scoring that is fully explainable and audit-ready

During the PoC the system reached 99% accuracy on automated extraction of onboarding documentation and compressed an onboarding cycle that used to take months into days.

Incore Bank CEO Mark Dambacher framed it in governance language: "Innovation must go hand in hand with trust, transparency, and strong regulatory governance." Kyndryl Alps managing director Jacqueline Wild was even more direct: "In highly regulated industries such as banking, success depends on governance, explainability, auditability, secure data access, and human oversight. Model capability itself is secondary."

The PoC does not prove that an agent can do KYC. It proves the minimum bar for letting an agent do KYC inside a regulated industry: every step has to be auditable, every judgment has to be explainable, and every high-risk action has to be pausable.

4. Where OntiCards Sits: A Cross-Cutting "Global Security & Permission" System

Three companies, three different angles, the same destination: agents locked inside governance. OntiCards' response inside our own architecture is not a module — it is a cross-cutting system called "Global Security & Permission". It does not belong to any of the four core layers; it is the foundation under all of them.

Concretely, it is a three-layer permission chain plus four governance actions that run across all three layers:

The four governance actions run across all three:

1. Least privilege. The token an agent receives is exactly enough for the current task — not a full account.

1. Full audit trail. Every access, invocation, and modification leaves a trace that can be replayed after the fact.

1. Full lineage. From a user question to the skill that ran, every step traces back to a specific data-card field and skill version.

1. Mandatory approval for high-risk operations. Writes, deletes, transfers, and similar actions pause automatically for human sign-off — never relying on agent self-discipline.

This system does not try to keep agents from doing wrong things. It makes sure that even when an agent wants to do the wrong thing, it cannot — and when it does, the act is immediately visible and immediately stoppable. That is exactly what ServiceNow, Replica, and Kyndryl are doing — replacing moral constraints with structural constraints.

5. Three Judgments for Enterprise AI Leaders

If you are planning an agent roadmap for the second half of 2026, the three judgments below may be worth more than any tool-selection spreadsheet:

1. Governance capability is itself a budget line. ServiceNow's earnings proved it: 50% of new contracts are priced per resolution, not per token, not per seat. Whoever can put governance around an agent can shift pricing from seats to outcomes. The category of the budget line has changed — and so has the procurement logic.

2. Isolation is not optional; it is the entry ticket for regulated industries. Replica's 32% is not an isolated finding. In financial services, healthcare, government, and energy, the reason enterprise agent projects fail security review has never been "the model is too weak" — it is "we have no working environment that the security team can approve". Treat isolation as an early investment, not a postmortem, and the return is higher than most teams expect.

3. The data semantic layer is the foundation of agent governance, not a layer above it. We have made this argument for the last eighteen months: the semantic layer is what lets agents pick the right data; data cards are the productized form of that semantic layer; access and masking rules are one of the six elements of every data card. Kyndryl's PoC hides Gemini behind Policy-as-Code, but what actually keeps it stable is the layer underneath — the semantic layer that structures and traces customer-due-diligence concepts. OntiCards treats that layer as the product itself.

Closing

In the second half of 2026, the competitive focus of enterprise agents has shifted from "who has the smartest model" to "who has the most controllable governance". ServiceNow, Replica Cyber, and Kyndryl — three independent news items in one week — confirmed that shift.

Model progress will keep pushing agents forward. How much enterprises are willing to pay for agents is bounded by how much they are willing to pay for the insurance against agent errors. Governance is the ceiling.

OntiCards' take: in the agent era, the truly scarce resource is not a stronger model. It is the semantic and permission infrastructure that lets agents start, lets them run stably, and stops them the moment they make a mistake. That is why we built "Global Security & Permission" as a cross-cutting system, not as a paid module — it is the substrate of OntiCards, not a configuration switch.

To see data cards, the agent ecosystem, and the global permission system working together end to end, email hello@onticards.com to request a test account. Our FDE engineers will run a minimum-viable PoC alongside your team.

References

• ServiceNow Q2 2026 Earnings: AI ACV Crosses $1B, Zacks Equity Research, 2026-07-23. https://www.zacks.com/stock/news/2981296/agentic-ai-adoption-boosts-now-s-growth-prospects-against-msft-crm

• ServiceNow AI Revenue Crosses $1B as Non-Seat Deals Hit 50% of New Business, Tech Times, 2026-08-27. https://www.techtimes.com/articles/325759/20260827/servicenow-ai-revenue-crosses-1b-non-seat-deals-hit-50-new-business.htm

• Replica Cyber Makes High-Risk AI Automation Safe for Financial Institutions, PR Newswire / Replica Cyber, 2026-08-31. https://www.prnewswire.com/news-releases/replica-cyber-makes-high-risk-ai-automation-safe-for-financial-institutions-302864439.html

• Replica Cyber puts financial AI agents in isolation, with an off switch, RuntimeWire, 2026-08-31. https://runtimewire.com/article/replica-cyber-isolates-financial-ai-agents

• Kyndryl and Google Cloud advance agentic AI at Incore Bank, Kyndryl Newsroom, 2026-08-31. https://www.kyndryl.com/us/en/about-us/news/2026/08/agentic-ai-incore-bank

• AI Agents Directory News Brief: August 31, 2026, AI Agents Directory, 2026-08-31. https://aiagentsdirectory.com/news/ai-agents-news-brief-august-31-2026