Permissions, provenance and the price of go-to-market software

Two threads ran side by side today. One was about the money underneath AI, where acquisition prices and infrastructure spending are being questioned out loud. The other was about small, concrete controls arriving inside the tools businesses already run: who can see what, and how you check an AI's work before you trust it.

For anyone choosing software this week, that split is the useful lens. The headline deals tell you where the market is heading and what it will cost. The feature notes tell you what will change on a Tuesday morning for the people who actually use the product. Both matter, and they rarely point in the same direction. We build 360REV around the less glamorous half of this: access you can reason about and data you can trust. That is the only place our own product appears in what follows.

Access control stops being all-or-nothing

Permissions are one of those topics that feels administrative until it goes wrong. The principle behind good access control is simple: a person should be able to do the job in front of them and nothing more. The accounts clerk who raises purchase orders does not need to approve payments. The contractor who needs one report does not need the whole ledger. This is sometimes called least privilege, and the reason it matters is risk. Every extra permission is a surface for a mistake or a misuse, and the cost of that surface grows quietly as a team grows.

The hard part has always been the granularity. Many tools model access as a single key. You either hand it over or you do not, and handing it over brings everything attached to it along for the ride. Xero wrote today about rebuilding its user permissions, framing the old model exactly this way: "Access in Xero has worked a bit like a house key." [1] The direction of travel, splitting a coarse key into finer rights, is the one worth watching across every tool you buy. When you evaluate software, ask what the smallest grantable unit of access is. If the answer is "the whole house," that is a trade-off you are accepting whether or not anyone names it.

We have written before about what a permission system is really protecting in keeping customer data current. The short version: access is not a convenience feature, it is part of your data's integrity.

Checking the AI's work before you trust it

The second thread is about provenance. When a tool generates data for you, the obvious question is where the data came from. For years, AI features answered that question with silence: a cell filled in, a paragraph written, no way to see the source. That is fine for a first draft and dangerous for anything you will act on.

Google Workspace addressed exactly this today. Its recap notes that "Fill with Gemini now provides cell-level citations for web sources and supports larger requests." [2] Strip away the product name and the useful idea is the cell-level citation. An AI-generated value you can trace back to a source is a value you can check, challenge, and defend. One you cannot trace is a number you are repeating on faith.

This is the standard to hold any AI feature to, not just this one. Before a generated figure goes into a board pack or a customer quote, you need to know its source. We said something similar in what AI should and should not do in your business: the question is never whether the AI is confident, it is whether you can verify what it produced. Citations are the mechanism that makes verification possible, so a tool that offers them is a tool that lets you keep responsibility where it belongs, with the person signing off on the number.

Paying people in other countries

If your business works with suppliers, contractors or sellers abroad, cross-border payouts are a recurring source of friction. Each new country tends to bring its own banking rules, its own setup delay, and its own quiet failure rate where payments bounce or stall. The cost is rarely the fee. It is the weeks of setup and the proportion of payments that silently do not arrive.

Stripe published a note today about moving its own vendor payments onto its Global Payouts product, and the figures it reported are the ones to borrow as a yardstick: "New-market setup fell from six weeks to one, with a 99.9% payout success rate." [3] Whether or not you use that particular product, those two numbers, time-to-first-payment and success rate, are the right questions to ask any payments provider. A six-week setup is a real cost when you are trying to onboard a supplier this quarter. A success rate below the high nineties is a stream of support tickets you will own forever.

What the market will pay for go-to-market software

Acquisition prices are a signal, even if you are not buying or selling. They tell you what sophisticated buyers think a category is worth, and that shapes which products get funded, maintained and expanded over the years you will depend on them. Today SaaStr examined go-to-market software through one recent deal, noting that "Salesforce agreed the other day to buy Braze for $5.66 billion, 6.8x trailing revenue." [4] The piece frames go-to-market as the B2B category the markets are most wary of right now, which is the detail that matters: a high headline price inside a category investors are cautious about tells you consolidation is happening even where enthusiasm has cooled.

Salesforce's buying did not stop there. TechCrunch reported a separate, reported deal in which "The AI logistics startup will bolster the CRM giant's Missionforce defense platform." [5] For a business choosing tools, the practical read on consolidation is mixed. A larger owner can fund a product for the long run. A larger owner can also fold it into a suite, change its pricing, or shift its roadmap toward the parent's priorities. Neither outcome is good or bad in itself. It is a trade-off to price in when you commit to a vendor that has just changed hands.

The spending boom and what it means for buyers

Underneath all of this is the money. TechCrunch reported today that "Big Tech is pouring billions into AI infrastructure, but mounting debt, negative cash flow, and growing investor skepticism are raising questions about the sustainability of the AI spending boom." [6] You do not need a view on whether that skepticism is right to draw a buyer's conclusion from it.

The conclusion is about lock-in. When a category is being funded by heavy spending that may not last, the AI feature you adopt today could be repriced, bundled, or scaled back tomorrow as the economics tighten. That does not mean avoiding these tools. It means preferring the ones whose value survives a price change: the ones where your data stays yours, where you can export it, and where the useful part is a feature you control rather than a subscription you cannot leave. We covered a related point in yesterday's daily briefing, and the theme holds. The exciting announcements and the sober financial ones are describing the same market from two ends.

The through-line

The day rewards a boring kind of attention. Ask what the smallest unit of access is. Ask where a generated number came from. Ask how long a payout takes and how often it fails. Ask who owns the tool and what happens if its price changes. None of these questions are about the newest capability. All of them are about whether the tool will still serve you in a year, which is the only test a business choosing software actually needs to pass.