Updated 2026-03-28

AGT-0234

SaaS Sprawl Detection Agent

SaaS Sprawl Detection Agent Discovers shadow SaaS usage and recommends consolidation. Operates as draft-then-approve on the Wayam Agent Platform, not as unsupervised send.

Typical impact cost and cycle-time compression, with first value in about 6 weeks. Autonomy is draft-then-approve.

CASE FOR

Best when discovers shadow SaaS usage and recommends consolidation, and a named owner can review drafts before they land in the system of record.

CASE AGAINST

Poor fit when the work has no system of record, no approval owner, or when the Charter data-foundation score is too low to ground the agent.

IT OperationsL3Residency: public cloudStandard: generalHybrid

USE CASE FIT

Discovers shadow SaaS usage and recommends consolidation.
Human review sits on the write-back, not on the research.
Evidence of every draft, approval, and action is kept with the record.

TYPICAL USER

IT Operations lead

TYPICAL OWNER

IT Operations operations

MEMORY PATTERN

durable

HOW IT WORKS

Architecture & Operating Blueprint

End-to-end signal ingestion, model inference, human-in-the-loop review, and write-back audit trail.

SOURCES

RESEARCH

DRAFTING

REVIEW

ACTION

ServiceNow ITSMSYSTEM

Accounts + ownership

DatadogSYSTEM

Live context & signals

PagerDuty

Criteria + won deals

IT Operations research

Reconcile, correlate, score

MCP GROUNDED

Action synthesis

Policy-constrained plan

Claude Sonnetfine-tuned Llama 3.1 8B

IT Operations operationsHITL

Edit, approve, reject

HUMAN GATE

Workflow executionAPPROVED

Committed to system of record

SYSTEM WRITE-BACK

↶ edit feedback·↺ activity log·↳ reply / execution outcomes

Audit trail committed to enterprise ledger

Domain Systems of Record

Function-specific systems this agent depends on

ServiceNow ITSM
Provides domain ground-truth, event subscriptions, and transactional write-back permissions.
Connected
Datadog
Provides domain ground-truth, event subscriptions, and transactional write-back permissions.
Connected
PagerDuty
Provides domain ground-truth, event subscriptions, and transactional write-back permissions.
Connected
Kubernetes
Provides domain ground-truth, event subscriptions, and transactional write-back permissions.
Connected

General Enterprise Sources

Standard sources most deployments draw on

Communication & Sequencing Platform
Executes approved sequences, dispatches notifications, and tracks open, reply, and delivery telemetry.
Document Store & Vector Catalog
Holds approved messaging blocks, case studies, and value propositions used in grounding.
Identity & Access Management (IAM)
Controls which role owners can authorize drafts, inspect audit trails, and execute write-backs.

01 INGESTION

Target records, context, and buying signals

Pulled from ServiceNow ITSM and context streams, enriched with historical records, then matched against policy definitions.

Score accounts against criteria
Identify accountable contacts
Deduplicate against active cycles

02 INFERENCE

Claude Sonnetfine-tuned Llama 3.1 8B

Synthesizes strongest signals into actionable briefs

Foundation models structure raw telemetry into drafted proposals personalized to the specific context.

Summarize target context into brief
Draft steps grounded in approved tone
Flag low-confidence signals

03 REASONING

Evaluates constraints & prioritizes queue

The agent decides which targets deserve action now, which angle fits the detected signal, and checks compliance bounds.

Rank accounts by signal strength
Select policy-approved playbook
Hold drafts conflicting with active campaigns

04 ACTION

Owner review queue & transaction release

Drafted actions land in IT Operations operations's review queue; approved actions are sent from the system and logged.

Queue drafts for edit, approve, or reject
Release approved steps to execution stack
Log audit trail into ServiceNow ITSM

05 FEEDBACK LOOPaction outcomes feed back into ingestion and inference

Owner edits, reply outcomes, and conversion signals feed back into targeting and drafting so the agent learns which angles and signals actually work.

· Capture owner edits as drafting feedback· Track replies, conversions, and meetings· Retire weak triggers and templates that stop converting· Refresh ICP and baseline parameters continuously

Drafts always pass through owner approval before send; autonomous execution without human gate is out of scope by design. Messaging blocks should be curated so personalization stays inside brand and compliance guardrails.

PRACTICAL EXAMPLES

Standing the it operations workflow up
A team already lives in ServiceNow ITSM. Discovers shadow SaaS usage and recommends consolidation. Drafts stay in Review until a named owner signs.
INPUTS
Named accounts or records from ServiceNow ITSM, plus the policy block on the Charter.
OUTPUTS
Drafted next steps queued for the owner, with evidence attached to the record.
OUTCOME: Coverage goes up without unsupervised send. First value in about 6 weeks.
A noisy week, not a greenfield
Volume spikes. The agent keeps researching and drafting; Review is the only write-back.
INPUTS
The live queue, prior outcomes, and the same MCP connectors.
OUTPUTS
A ranked draft list. Weak signals flagged for suppression rather than sent.
OUTCOME: The owner spends time on exceptions. The playbook improves from measured replies.
When it should not run
Poor fit when the work has no system of record, no approval owner, or when the Charter data-foundation score is too low to ground the agent.
INPUTS
No system of record, or Charter data-foundation below the layer gate.
OUTPUTS
The agent stays on the shortlist and does not deploy.
OUTCOME: Manthan refuses the SKU rather than shipping an unsupervised send.

ROI BAND

Cost-out range

10–25

Revenue-up range

15% to 35%

Time to first benefit

6 weeks

Personalized ROI & Capacity Engine

Enterprise Impact Simulator

Scoped Annual Spend

Target Team Headcount (FTEs)

Estimated Cost-Out Savings

$2.50M – $6.25M

10% to 25% benchmark band

Capacity Unlocked

~52 FTEs

≈ 101,400 hours/year reallocated

Value / Employee

$7K/yr

First benefit in ~6 weeks

Calibrated against Wayam production metrics

ENTERPRISE TOPOLOGY

Architecture Integration Hub

End-to-end data pipeline, model reasoning cluster, and governance write-back boundary.

STAGE 1: INGESTION

Upstream Signals & CDC

ServiceNow ITSM

Datadog

PagerDuty

Protocol: Kafka / Webhook / REST Poller

STAGE 2: REASONINGdraft-then-approve

SaaS Sprawl Detection Agent

Claude Sonnet

Deterministic Guardrails & Policy

Tools: ServiceNow ITSM, Datadog

STAGE 3: WRITE-BACKHITL GATE

System of Record Commit

Dual Approval > $50K threshold

WORM Immutable Audit Log

Compliance: general

Multi-Turn Agent Reasoning Architecture

Model ensemble, chain-of-thought verification, and specialized tool-calling harness.

PRIMARY REASONING LLM

Claude Sonnet

Structured output validation with temperature clamped at 0.15.

AUTONOMY SPEC

draft-then-approve

Bounded execution loops with hard ceiling of 8 agentic reasoning steps.

VERIFICATION HARNESS

Deterministic Guardrail

Mathematical checksums and boundary rules evaluated prior to tool calls.

Inspect Normalized Telemetry Payload (JSON)

{
  "event_id": "evt_agt-0234_9481",
  "timestamp": "2026-09-16T18:16:42.102Z",
  "source_system": "ServiceNow ITSM",
  "agent_target": "AGT-0234",
  "function": "IT Operations",
  "security_context": {
    "tenant_boundary": "public cloud",
    "compliance_class": "general",
    "pii_redacted": true
  },
  "inference_pipeline": {
    "model": "Claude Sonnet",
    "temperature": 0.15,
    "max_tokens": 4096,
    "tools_invoked": [
      "ServiceNow ITSM",
      "Datadog",
      "PagerDuty"
    ]
  },
  "downstream_destination": "Datadog"
}

Dependencies and prerequisites

What must be in place first

Minimum maturity this agent assumes, on a 0–5 scale. Below these thresholds it can still draft, but there is nothing to ground the draft against or anyone accountable for approving it.

L1 FoundationsRequires ≥ 2.0 / 5.0
Strategy and architecture: a named owner, a defined decision right, and a place this agent's output lands.
0.05.0
L2 Data foundationRequires ≥ 2.0 / 5.0
Instrumented, queryable source data with known lineage. This agent reads before it writes.
0.05.0

Build vs buy: HybridData residency: public cloud, sovereign cloudGovernance tier: general

RISK AND GOVERNANCE

generalHITL: REQUIRED

Autonomous write-back is bound to validated sandbox policies. Every high-consequence transition requires human sign-off, bounded model vocabulary, and full immutability of audit trails.

IT Operations operations approval required before write-back
Approved enterprise taxonomy bounds the generative response space
Strict role-based access control (RBAC) enforced over MCP tools
Full audit logging of input parameters, inferences, and owner decisions
Automated guardrail intervention on anomalous volume spikes

Systems of record

ServiceNow ITSM
Datadog
PagerDuty
Kubernetes

Inferred. A typical stack for this function, not a verified integration list. Only 30 of the 850 reference agents carry system data in the Atlas source.

Foundation Models

Claude Sonnet
fine-tuned Llama 3.1 8B

Inferred. A typical stack for this function, not a verified integration list. Only 30 of the 850 reference agents carry system data in the Atlas source.

SIMILAR AGENTS TO COMPARE

Ready to evaluate this SKU for your estate? Shortlist it or talk to Wayam.

AGT-0234·SaaS Sprawl Detection Agent