Shadow Tokens: Same Old Vendor, Expensive New Pipelines

The most consequential AI cost-governance gap forming inside Tier-1 banks in 2026 does not originate with employees pasting prompts into consumer chatbots. It originates with the banks' own sanctioned platform vendors. The incumbent systems that run service, operations, and customer records have quietly repriced their AI features from per-seat licensing to metered consumption, and they now bill agentic activity at the data layer and the AI layer on top of subscriptions the banks already hold. The telemetry that would let a finance team attribute that spend to a product, a desk, or a customer sits inside the vendor's platform, not the bank's. Cost observability has gone missing at the precise layer where a Tier-1 institution already carries its heaviest third-party concentration.

For a CFO or COO reviewing FinOps mechanics, the exposure is structural. A variable, hard-to-forecast cost line has entered the most entrenched vendor relationships in the estate, and it arrived through a contract renewal instead of a procurement decision. The controls that finance would normally apply to a new consumption category were never triggered, because from the buyer's paperwork nothing new was bought.

The pricing model changed underneath the contract

Salesforce moved first and most visibly. Its Agentforce platform, embedded across the Sales, Service, and Financial Services Cloud footprint that many institutions run as a system of record, is now priced on consumption. Each agent action draws a fixed number of Flex Credits, with standard actions metered at roughly ten cents and voice actions higher, sold in prepaid blocks. Salesforce frames this as aligning cost to the work an agent performs. The operative change for finance is that a predictable per-seat cost has become a variable line that scales with how often the agents run.

ServiceNow followed with a harder cutover. On 9 April 2026 it replaced its five legacy license tiers with three AI-native tiers and folded its AI capabilities into every one of them, metered in units it calls assists. Legacy license SKUs reach end of sale on 1 July 2026, which means the consumption model stops being optional for any customer renewing after that date. ServiceNow's Action Fabric opens the platform to any agent through a Model Context Protocol server and meters that usage as assists, charged above the base subscription. The number of assists a given interaction consumes varies, which the vendor's own executives acknowledge makes the resulting bills difficult to predict.

SAP made the same shift on its own core. A July 2025 licensing reset moved AI consumption out of the classic per-user metric and into a separate currency the company calls AI Units, and its Sapphire 2026 announcements rebuilt the cloud ERP stack around agentic Joule agents priced the same way. A Joule agent that executes a task autonomously draws materially more AI Units per run than an interactive query, at a rate that scales with task complexity and the number of execution steps. Part of that consumption meters against the customer's own records, because document grounding, the mechanism that feeds a bank's SAP data into the model, is billed at 0.005 AI Units per record processed. SAP has not yet disclosed the runtime metrics for its agent builder, which is the input a finance team most needs to forecast, and independent coverage has warned that autonomous agents on this model can drive spend without a person in the loop.

Industry analysts read these moves as a single pattern. The same base-plus-consumption logic runs through all three vendors. Info-Tech Research Group's Scott Bickley described the ServiceNow approach as structurally similar to those Salesforce and SAP have introduced: a base license carrying some included usage, then consumption-based charging layered on at the data tier and the AI tier. His read on how finance would receive it was direct: variability in pricing and unpredictable monthly expense are the two things a CFO least wants in the budget.

Your own data, metered back to you

The mechanic that makes this a FinOps problem is where the meter sits. Agentic features earn their value only when grounded in the bank's own data, and that grounding is itself a billable event. In the Salesforce model, every retrieval an agent runs against unified Data Cloud draws down the same credit pool the agent's actions consume. The data infrastructure required before an agent produces anything useful carries its own annual cost, documented in the range of tens to low hundreds of thousands of dollars before the first production agent goes live. The bank supplies the data, the vendor hosts the model, and the meter runs on the round trip between them.

Consumption is also non-deterministic in a way traditional infrastructure never was. A single agentic workflow can query records, call an external system, retry on failure, and write results back, and each of those steps meters independently. The failure modes are where the cost concentrates. Bickley's own illustration is the autonomous agent that enters a retry loop when its first attempt fails and consumes credits with every iteration until something stops it. A workflow that costs a known amount on Monday can cost several times that on Tuesday, with no metadata connecting the charge to the feature, the desk, or the customer it served. Metered agent spend arrives as an aggregate with the attribution stripped out.

Consider a wealth management agent handling a portfolio transition. A data-retrieval error that makes it re-query the bank's data tier twenty times before failing inflates the cost to service that one client on the vendor's ledger, with no signal reaching the product owner. Without attribution primitives, the bank cannot compute its true margin per transaction or its product-level cost to serve, which are the numbers a CFO uses to price a product and defend a book of business.

This is the inversion of the shadow-AI story most banks have spent two years managing. The recognised risk has been unsanctioned tools slipping in through the back door, carried by employees reaching for whatever was fastest. The larger unmeasured cost is walking in through the front door, inside platforms that procurement already approved and under contracts that legal already signed. The shadow is being cast by the vendor of record.

Why this lands hardest in a Tier-1 estate

Three characteristics of a Tier-1 bank turn a general enterprise nuisance into a specific and material exposure.

The first is concentration. The systems repricing to consumption are core-adjacent platforms, CRMs, and enterprise workflow engines that an institution cannot casually replace and frequently cannot dual-source. The layer now generating variable, opaque cost is the same layer that carries the bank's deepest vendor lock-in and its most material third-party dependency.

The second is the reporting culture. FSI finance functions run on tight variance reporting and a defensible cost-to-serve for every product. A metered line whose monthly value depends on model behaviour, user prompting, and retry frequency does not reconcile cleanly against that discipline, and the reconciliation gap widens with every workflow that migrates from a form to an agent. Month-end close was not designed to absorb a cost that moves with how chatty an autonomous process happened to be. For a Tier-1 institution, unmanaged non-deterministic consumption degrades the efficiency ratio directly, converting scale-driven operating leverage into OpEx volatility on the cost line that analysts and examiners watch.

The third is attribution. Sourcing and FinOps leaders have limited line of sight into how a rise in data volume or interaction complexity translates into a vendor's model-usage fees, because the translation happens inside the vendor's platform. KPMG's Q2 2026 Global AI Pulse survey found that 42 percent of leaders have only partial visibility into their AI spending, and among large organisations just 26 percent report full, real-time visibility into what their AI systems cost to operate. In a regulated institution that gap is more than a budgeting inconvenience. It touches the same third-party risk and operational resilience obligations that examiners already expect a bank to evidence, and an unobservable cost inside a critical system is difficult to govern under any of them. If an examiner asks a bank to quantify the systemic exposure of a failed multi-agent workflow and the telemetry does not exist, that governance gap is a documented control weakness in third-party risk and operational resilience, a domain supervisors weigh when they assess a firm's operational risk.

The control that is missing

The vendors have offered governance surfaces of their own. ServiceNow markets an AI Control Tower positioned to oversee native and third-party agents across the enterprise. Independent reporting on that tooling has described the view it offers into spend as hazy, which is the heart of the matter. A governance layer supplied by the party doing the metering is not an independent control, however capable, because it answers to the vendor's telemetry and the vendor's definitions.

What a Tier-1 finance and procurement function needs is an interception and attribution layer at the vendor boundary that the bank itself owns. In practice that means metering agentic consumption as it crosses from the bank's systems into vendor-hosted models, mapping each unit of consumption back to the business line and use case that triggered it, and holding the total against a budget the bank sets in advance instead of one the vendor reports in arrears. The capability is a direct extension of the discipline FinOps already applies to cloud, pointed at a category the practice has not historically owned.

The contract carries the other half of the control. Bickley's guidance points at the specific clause work: locate the line of demarcation where the meter starts running and write it explicitly into the agreement, because vendor licensing metrics have a long history of vagueness about what counts as a metered object and how it is counted. For a renewal landing in 2026, that clause work includes requiring assist-level or credit-level usage disclosure, capping overage exposure as a fixed percentage of the base fee, excluding sandbox and internal QA traffic from billing during the ramp period, and securing a true-down right if the first full quarter comes in below the committed volume. The more important control is enforcement at the perimeter. The bank should retain the right, through its own interception layer, to throttle or halt agentic API access when consumption breaches an agreed threshold, so a single runaway test cycle cannot auto-scale into an unapproved six-figure invoice before anyone reads the meter. The first ninety days of these deployments routinely run well above forecast as test traffic, internal QA, and retry loops all meter, so the ramp terms are not a minor concession to leave for later.

None of this requires waiting for a sales conversation to begin. Most of it is FinOps maturity applied ahead of renewal, and it has to be in place before the model converts, not after the first surprising invoice lands on the desk.

What's next

The forcing function is the renewal calendar. ServiceNow's legacy SKUs leave the price list on 1 July 2026, which converts a large installed base to consumption over the year that follows. Salesforce's consumption model is already the default posture for new Agentforce deployments. As more incumbent platforms embed agents and switch on the meter, the buy-side response will standardise the way security attestation did a decade ago. Cost legibility and metering transparency become a gate a core vendor has to clear at renewal, and the banks that write that gate now will negotiate from a stronger position than the ones that discover it during a budget overrun.

The demand a Tier-1 CFO should put to every embedded-AI vendor is narrow and answerable: the event at which the meter starts, the telemetry the vendor will expose so the bank can attribute that consumption to its own units, and the contractual ceiling that caps exposure when an agent loops. A vendor that cannot commit to all three is asking the institution to carry an unbounded and unobservable cost inside its most critical systems.