# Day-One Provisioning Agent

*/Opportunities/Day-One_Provisioning_Agent*

## Opportunity Overview

**Wedge**: Target software access provisioning for engineering and product teams at mid-market tech companies. Engineering onboarding requires complex, granular access to source control, cloud infrastructure, and ticketing systems, providing a high-value proof point. From there, expand into hardware procurement routing and eventually automate employee offboarding and lateral role transitions.
**Timing**: The complete API-fication of modern SaaS stacks and hardware logistics providers allows software to act directly on infrastructure. LLM function-calling capabilities now enable agents to reliably map unstructured HR titles to specific permission graphs and execute the required API requests without human scripting.
**Why This I C P**: Mid-market tech companies with 500 to 5,000 employees face high hiring volumes but lack the massive, dedicated IT service desks of legacy enterprises. They rely entirely on modern SaaS, ensuring the environment is highly API-ready for an agent to manipulate.
**Size Of Prize**: Roughly 150,000 mid-market and enterprise companies in the US maintain complex SaaS stacks and experience continuous hiring. Capturing an average annual contract value of $15,000 per company for automated IT provisioning yields a $2.25B addressable market.
**Gap Narrative**: IT and HR teams spend hours per new hire manually coordinating hardware procurement, software seat assignments, and access control across fragmented systems. Existing identity access management tools handle single sign-on but fail to execute the physical procurement and nuanced permission approvals required before day one. An autonomous agent reads the HRIS record and directly executes the end-to-end setup.
**Defensibility**: The core moat is deep workflow lock-in and switching costs. Once the agent holds read and write access to the HRIS and dozens of SaaS admin panels, replacing it requires hiring headcount or rebuilding brittle custom integrations. Over time, the agent compounds value by mapping the organization's exact role-to-access graph, automatically adjusting to new software adoptions.
**Why This Thesis**: The Agent thesis matches the problem shape because provisioning requires taking sequential actions across disconnected systems based on a single trigger event. It replaces the human IT worker who currently acts as the manual integration layer between the HRIS and dozens of software admin panels.

## Opportunity Linked Thesis

**Thesis**: [Agent](/Theses/Agent)

## Opportunity Linked I C P

**Icp**: [Managed Service Provider](/CompanyTypes/Managed_Service_Provider)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$250M-350M (targeting ~20,000-30,000 North American mid-tier MSPs managing 50+ client environments)
**S O M**: ~$5M-15M (realistic 3-year capture at current go-to-market capacity)
**T A M**: ~80,000 global Managed Service Providers × ~$12,000/yr automation software spend ≈ ~$1B
**Growth Rate**: ~15-20%/yr, driven by escalating L1 technician wage inflation and increasing SaaS application sprawl within client environments
**Paid Comparable Spend**: ~$30,000-50,000/yr per MSP in dedicated Level 1 technician labor for manual user account creation, license allocation, and endpoint setup

## Opportunity Incumbents

- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — Tool
- [Rippling IT Cloud](/Products/Rippling_IT_Cloud) — Tool
- [ServiceNow Onboarding](/Products/ServiceNow_Onboarding) — Tool
- [Custom PowerShell Scripts](/Products/Custom_PowerShell_Scripts) — DIY
- [New Hire Checklists](/Products/New_Hire_Checklists) — Spreadsheet
- [Managed Service Providers](/Products/Managed_Service_Providers) — Service
- [Jamf Connect](/Products/Jamf_Connect) — Tool

## Opportunity Win Conditions

**Kill Thresholds**:
- Zero-touch provisioning success rate falls below 60 percent by day 45
- Escalation to human technicians exceeds 40 percent of total requests
- Average time to configure a new client tenant remains above 4 hours
- Closed-won ACV drops below $10,000 per MSP after 90 days
**Leading Metrics**:
- Zero-touch user provisioning success rate
- Time-to-first-provisioned-account per new MSP client
- Escalation rate to human Level 1 technicians
- Configuration time required per client tenant
- API token and credential failure rate across SaaS integrations
**What Proves Right**: MSPs deploy the provisioning agent and successfully route over 60 percent of new user account creations and license allocations without human intervention. Trial cohorts retain at 90 percent after three months, directly displacing Level 1 technician labor costs. Customers sign annual contracts at a $12,000 baseline price point to manage their client environments.
**What Proves Wrong**: The agent fails to handle nested Active Directory groups or multi-tenant SaaS license constraints, forcing technicians to manually revert and recreate accounts. The initial setup burden exceeds the time saved, requiring more than five hours to map variables per client environment. MSPs classify the tool as a basic utility, capping their willingness to pay below $3,000 annually.

## Opportunity Build Profile

**Hardest Part**: Handling edge-case permission failures across fragmented legacy APIs while maintaining strict audit logs constitutes the primary make-or-break challenge. Reversing half-completed provisioning states without locking out the user requires complex state management.
**Min Viable Scope**: Automate read-and-write account creation for five standard developer tools triggered by a single webhook from a modern HRIS. Leave hardware provisioning, offboarding workflows, and legacy enterprise integrations entirely out of the initial build.
**Cold Start Problem**: Connecting to bespoke active directories requires high initial trust and broad API access before the tool executes a single action. Break this by targeting seed-stage technical teams using a rigid, standardized stack of Google Workspace and GitHub as initial design partners.
**Time To First Value**: 1 to 2 weeks of initial API integration and role mapping before the first successful automated onboarding run.
**Data Moat Available**: false
**Technical Difficulty**: Moderate

## Neighborhood

### Where the gap lives

- [Corporate HR Departments](/Customers/Corporate_HR_Departments) — latent gap · Customers

### Incumbent in

- [Rippling IT](/Products/Rippling_IT) — incumbent in · Products
- [Managed Service Provider](/Products/Managed_Service_Provider) — incumbent in · Products
- [Jamf Connect](/Products/Jamf_Connect) — incumbent in · Products
- [New Hire Checklists](/Products/New_Hire_Checklists) — incumbent in · Products
- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — incumbent in · Products
- [ServiceNow Onboarding](/Products/ServiceNow_Onboarding) — incumbent in · Products
- [Custom PowerShell Scripts](/Products/Custom_PowerShell_Scripts) — incumbent in · Products

### Applies thesis

- [Managed Service Provider](/CompanyTypes/Managed_Service_Provider) — applies thesis · CompanyTypes

### Embodies

- [Agent](/Theses/Agent) — embodies · Theses

### Similar Opportunities

- [Onboarding Orchestration Agent](/Opportunities/Onboarding_Orchestration_Agent) — similar · Opportunities
- [Autonomous Provisioning for Enterprise IT](/Opportunities/Autonomous_Provisioning_for_Enterprise_IT) — similar · Opportunities
- [Employee IT Provisioning](/Opportunities/Employee_IT_Provisioning) — similar · Opportunities
- [Identity Lifecycle Automation](/Opportunities/Identity_Lifecycle_Automation) — similar · Opportunities
- [Autonomous Deprovisioning for IT](/Opportunities/Autonomous_Deprovisioning_for_IT) — similar · Opportunities
- [Automated Onboarding Agency](/Opportunities/Automated_Onboarding_Agency) — similar · Opportunities
- [Managed Auth Operations](/Opportunities/Managed_Auth_Operations) — similar · Opportunities
- [Shared Services Resolver](/Industries/Management_of_Companies_and_Enterprises/Opportunities/Shared_Services_Resolver) — similar · Opportunities
- [Zero-Touch De-Provisioning for HR](/Opportunities/Zero-Touch_De-Provisioning_for_HR) — similar · Opportunities
- [Autonomous Task Runner](/Opportunities/Autonomous_Task_Runner) — similar · Opportunities
- [Autonomous L1 Responder](/Opportunities/Autonomous_L1_Responder) — similar · Opportunities
- [Just-In-Time Provisioning for DevOps](/Opportunities/Just-In-Time_Provisioning_for_DevOps) — similar · Opportunities
- [Tooling Procurement Agent](/Opportunities/Tooling_Procurement_Agent) — similar · Opportunities
- [Turnkey Resolution Desk](/Occupations/Office_and_Administrative_Support_Occupations/Opportunities/Turnkey_Resolution_Desk) — similar · Opportunities
- [AI Onboarding Concierge](/Opportunities/AI_Onboarding_Concierge) — similar · Opportunities
- [Velocity Desk](/Opportunities/Velocity_Desk) — similar · Opportunities
- [Candidate Sourcing Engine](/Opportunities/Candidate_Sourcing_Engine) — similar · Opportunities
- [Attrition Arbitrage](/Opportunities/Attrition_Arbitrage) — similar · Opportunities
- [Automated Triage for IT](/Opportunities/Automated_Triage_for_IT) — similar · Opportunities
- [Vendor Negotiation Agent](/Opportunities/Vendor_Negotiation_Agent) — similar · Opportunities