# Overlap and a decision per tool

Rules behind OVL01 to OVL03, the eight dispositions, replacement tests and retirement.

## What industry figures can and cannot tell you

They are context for a question, never evidence for one company's cut.

- Zylo's 2026 SaaS Management Index reports application counts almost flat while spend rose 8%, across its enterprise-oriented vendor dataset.
- Vertice reports 62% of SaaS licences unused or underutilised as of Q3 2026 (61% at the end of Q2): 16% unused and 46% underutilised, where underutilised means fewer than half of the purchased licences are used (page updated October 2026). That is not the share of spend you can cancel.

Every finding cites the company's own evidence. Quote an industry figure only with its source and edition.

## Jobs, not categories

- Map every tool to capability IDs from [../assets/capability-vocabulary.csv](../assets/capability-vocabulary.csv). The job column describes work, not a product category.
- Overlap means two or more active tools doing one job for the same population, region and data grain. Two "email tools" can serve different people, consent rules or triggers.
- Record `customer_actions` (what each tool does to customers) and `system_of_record_for` (what each tool is the authority for). Those two columns find the overlap that hurts.

Checks:

- OVL01 (WARN): two or more active or trial tools share a capability. Compare the jobs with the people who run them before any decision. INFO when one of them is migrating or retiring with a disposition; confirm its end date and owner, then rate it PASS.
- OVL02 (FAIL): two active tools list the same customer action, for example `email:trial_onboarding`. The same people can get the same message or task twice. Check both tools' send logs for the same people in the same week.
- OVL03 (FAIL): two tools are recorded as the system of record for the same object or field.

## Five kinds of waste and the smallest change for each

- Unused seats: reclaim them at the next reduction point, after checking occasional critical users.
- Oversized tier: right-size, after listing the features that need the current plan and testing custom objects, permissions, reports and integrations under the lower one.
- Unused purchased capacity (contacts, events, credits, sends): renegotiate at renewal; know what consumes the unit.
- Duplicate execution: consolidate. Urgent when customers are affected.
- A capability nobody operates: ask why first (missing training, bad source data, no owner, no demand), then enable or retire. Paying less will not fix an unreliable account model.

## Dispositions and their required fields

- keep: the tool stays as it is; owner named.
- enable: owner, a setup or training task, and an outcome to check by a date.
- right-size: the new quantity or tier, the reduction point from the order, and the feature check.
- renegotiate: the term to change (price, cap, flex-down, discount continuity) and the decision target.
- consolidate: the destination tool.
- replace: the destination tool and the replacement test.
- retire: the dependency list and the notice action.
- investigate: the open question, an owner and an answer date.

Consolidate, replace and retire need all five of: destination, owner, acceptance test, commercial deadline and dependency list. Missing any one makes the disposition investigate. Never leave consolidate as a permanent status.

These labels map onto other frameworks: Adobe's promote, consolidate, negotiate, retire, and Gartner's TIME (tolerate, invest, migrate, eliminate). Use whichever the leadership team already reads; keep the five-field rule.

## Replacement tests

- Demonstrate the job in the candidate with your own fields, identities and edge cases. "The platform supports automation" is not evidence.
- Answer the dependency questions first:
  - Which tools write to it, and which read from it?
  - Which fields, identifiers and calculations does it control?
  - Which scheduled jobs, webhooks, forms and embedded assets depend on it?
  - Which users and service accounts authenticate through it?
  - Which histories, reports, preferences, suppression state and pending actions must stay usable?
  - Which limits or paid features does the replacement tier add?
- Downgrades need the same review. HubSpot documents that losing all Enterprise subscriptions changes what custom objects can do, including record editing and custom-object workflows; read the live downgrade page against the account's actual hubs and tiers.
- Test what ships today. A vendor roadmap feature, including an announced AI agent, is not a replacement until it passes the same test with your data.
- Suite against specialist: run the same hard scenario in both. Example: a trial account with two users, one unsubscribes, the account upgrades during a delayed workflow, and a billing update arrives twice. Record configuration, missing features, operator effort and recovery.

## Parallel run and cutover

- During a comparison, the candidate computes eligibility and state with sends and writes turned off. Two systems sending the same live message is not a test.
- People already waiting in a workflow finish in the old system, move at a defined checkpoint, or exit. Re-enrolling every imported record repeats onboarding.
- Define recovery as state: which changes after cutover must be replayed, and how repeated actions are prevented. Switching an old workflow back on can act on stale records.

## Retirement checklist

Retire only after the replacement passed the agreed cases and the observation period ended:

- SSO assignment and user access removed.
- API keys, OAuth grants and webhooks revoked, by the admin, from a revocation list the audit drafted.
- Embedded forms, tracking references and external consumers removed or repointed.
- DNS records the tool used (CNAMEs for landing pages, help centres, tracking or link domains, SPF includes, DKIM selectors) listed and removed by the DNS owner after cutover. A CNAME left pointing at a cancelled service can be claimed by someone else (subdomain takeover), and every sending tool's SPF include counts towards SPF's limit of 10 DNS lookups, past which SPF returns permerror for all senders (RFC 7208, section 4.6.4).
- Exports keep relationships, preferences and suppression state. Customer.io's GDPR suppression export hashes IDs and email addresses with SHA-256, so it is not a plain list to import; plan the matching.
- Data deletion follows the DPA.
- Commercial notice sent by the contract owner and acknowledged; the next invoice checked.
- The register row set to retired, with `evidence_date` as the cutover date, so INV08 flags anything after it.
- Documentation archived so historical reports stay explainable.

## Intake rule so overlap does not return

Every new tool request names: the capability gap, the existing tool evaluated, the accountable owner, the cost meter, the data it will hold, the DPA and the security review, the exit route and a trial review date with a condition for continuing. Put retirements on the same roadmap as their replacements.