Single sign-on upgrade

# Not live yet (gaps #2)
curl -X POST "https://api.sb/leaseline.app/campaigns?mode=try" \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"play":"sso-rung"}'

 1import { $ } from 'startup-builder'
 2
 3return await $.Campaign.create({ play: 'sso-rung' }, { mode: 'try' })   // dry run on the day-0 Startup, 2026-07-20 · Not live yet, gaps #2

npx startup-builder do Campaign.create --json '{"play":"sso-rung"}' --try   # Not live yet (gaps #2)

{
  "name": "do",
  "arguments": {
    "code": "return await $.Campaign.create({ play: 'sso-rung' }, { mode: 'try' })   // dry run on the day-0 Startup, 2026-07-20 · Not live yet, gaps #2",
    "mode": "try"
  }
}

 1{
 2  "type": "https://startupbuilder.dev/errors/refused",
 3  "title": "Refused",
 4  "status": 422,
 5  "detail": "sso-rung can’t start yet: 1 check fails and 2 warn.",
 6  "checks": [
 7    {
 8      "check": "use-when",
 9      "status": "pass",
10      "observed": "6 single sign-on asks in 90 days; the $2,400 plan includes it",
11      "doc": "/plays/sso-rung#check-use-when",
12      "fix": "Nothing to fix: 2 or more asks a month, and a plan that has it.",
13      "then": "Metric.query"
14    },
15  …

curl "https://api.sb/leaseline.app/events?where=name%20in%20(%22Message.received%22%2C%20%22Entitlement.checked%22%2C%20%22Quote.requested%22%2C%20%22Thread.joined%22%2C%20%22Tenant.thresholdCrossed%22%2C%20%22Domain.verified%22%2C%20%22Renewal.opened%22%2C%20%22Deal.lost%22%2C%20%22SSOConnection.failed%22)&limit=1" \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"

# Not live yet (gaps #7)
curl -X POST "https://api.sb/leaseline.app/triggers/fire?mode=try" \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"like":"event_1288"}'

# Not live yet (gaps #7)
curl "https://api.sb/leaseline.app/decisions?where=on%20%3D%20%22customer_33%22" \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"

# Not live yet (gaps #7)
curl "https://api.sb/leaseline.app/actions?where=on%20%3D%20%22customer_33%22" \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"

 1import { $ } from 'startup-builder'
 2
 3const { events: [last] } = await $.Event.list({ where: 'name in ("Message.received", "Entitlement.checked", "Quote.requested", "Thread.joined", "Tenant.thresholdCrossed", "Domain.verified", "Renewal.opened", "Deal.lost", "SSOConnection.failed")', limit: 1 })   // { play } compiled to this Play’s Trigger Events
 4const { subject } = await $.Trigger.fire({ like: last.$id }, { mode: 'try' })   // the same Event again, in try mode · Not live yet, gaps #7
 5const { decisions: [decision] } = await $.Decision.list({ where: `on = "${subject}"` })   // what it chose, and why · Not live yet, gaps #7
 6const { actions } = await $.Action.list({ where: `on = "${subject}"` })   // what it did, with its checks · Not live yet, gaps #7
 7return { decision, actions }

npx startup-builder do Event.list --json '{"where":"name in (\"Message.received\", \"Entitlement.checked\", \"Quote.requested\", \"Thread.joined\", \"Tenant.thresholdCrossed\", \"Domain.verified\", \"Renewal.opened\", \"Deal.lost\", \"SSOConnection.failed\")","limit":1}'
npx startup-builder do Trigger.fire --json '{"like":"event_1288"}' --try   # Not live yet (gaps #7)
npx startup-builder do Decision.list --json '{"where":"on = \"customer_33\""}'   # Not live yet (gaps #7)
npx startup-builder do Action.list --json '{"where":"on = \"customer_33\""}'   # Not live yet (gaps #7)

{
  "name": "do",
  "arguments": {
    "code": "const { events: [last] } = await $.Event.list({ where: 'name in (\"Message.received\", \"Entitlement.checked\", \"Quote.requested\", \"Thread.joined\", \"Tenant.thresholdCrossed\", \"Domain.verified\", \"Renewal.opened\", \"Deal.lost\", \"SSOConnection.failed\")', limit: 1 })   // { play } compiled to this Play’s Trigger Events\nconst { subject } = await $.Trigger.fire({ like: last.$id }, { mode: 'try' })   // the same Event again, in try mode · Not live yet, gaps #7\nconst { decisions: [decision] } = await $.Decision.list({ where: `on = \"${subject}\"` })   // what it chose, and why · Not live yet, gaps #7\nconst { actions } = await $.Action.list({ where: `on = \"${subject}\"` })   // what it did, with its checks · Not live yet, gaps #7\nreturn { decision, actions }",
    "mode": "try"
  }
}

 1{
 2  "decision": {
 3    "$id": "https://api.sb/leaseline.app/decisions/decision_347",
 4    "$type": "Decision",
 5    "choice": "set-up-first",
 6    "reason": "Pinecrest’s admin opened single sign-on setup on Team; 22 active members is under the 50-seat line, so they test sign-in before paying",
 7    "stakes": "low",
 8    "options": [
 9      "answer-the-ask",
10      "set-up-first",
11      "to-the-ae",
12      "note-the-plan",
13      "not-now"
14    ],
15  …

action_2 opens a test connection that signs in nobody until the admin presses Test; action_3 is the answer, held 2 minutes.

≈ +$1,200 ARR a month at 4

Worth

20 min week 1, then 5 a week

Your time

$0.04 per answer, ~$0.16 a month at 4

Spend

Day 9: first upgrade paid

First signal

2+ single sign-on asks a month, and a plan that has it

Use it when

No plan has it: add it (Offer.publish) · under 2 asks a month: usage-upsell

Not yet when

Worth’s formula: about +21 upgrades per 100 asks (Other Startups’ results; no lift of your own yet) × 4 asks a month × $1,448 per Team-to-annual upgrade ≈ +$1,216. Under First signal: At 4 asks a month, 90 days can tell only +45 per 100 or more, so your file starts at holdout: 0 and reads before-after.

Start it this weekCopy Anchor Link

npx startup-builder add play sso-rung   # 1 · writes plays/sso-rung.mdx (Not live yet, gaps #5)

# 2 · dry run; below, its 422 on 2026-07-20
curl -X POST "https://api.sb/leaseline.app/campaigns?mode=try" \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"play":"sso-rung"}'

# 3 · keep it, at You approve each one
curl -X POST https://api.sb/leaseline.app/campaigns \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"play":"sso-rung"}'

# on
curl -X PATCH https://api.sb/leaseline.app/campaigns/sso-rung \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"endsAt":null}'

# off: asks come to you; active connections keep working
curl -X PATCH https://api.sb/leaseline.app/campaigns/sso-rung \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"endsAt":"now"}'

{
  "type": "https://startupbuilder.dev/errors/refused",
  "title": "Refused",
  "status": 422,
  "detail": "sso-rung can’t start yet: 1 check fails and 2 warn.",
  "checks": [
    {
      "check": "use-when",
      "status": "pass",
      "observed": "6 single sign-on asks in 90 days; the $2,400 plan includes it",
      "doc": "/plays/sso-rung#check-use-when",
      "fix": "Nothing to fix: 2 or more asks a month, and a plan that has it.",
      "then": "Metric.query"
    },
    {
      "check": "billing-connected",
      "status": "pass",
      "observed": "Stripe, connected",
      "doc": "/plays/sso-rung#check-billing-connected",
      "fix": "Nothing to fix: every charge reads from Stripe.",
      "then": "Integration.connect"
    },
    {
      "check": "approved-pages",
      "status": "fail",
      "observed": "no Page lists what the $2,400 plan includes",
      "doc": "/plays/sso-rung#check-approved-pages",
      "fix": "Publish the pricing Page row for the $2,400 plan; answers quote only your own pages.",
      "then": "Site.publish"
    },
    {
      "check": "baseline",
      "status": "warn",
      "observed": "1 upgrade of 6 asks in 90 days",
      "doc": "/plays/sso-rung#check-baseline",
      "fix": "n 6: it reads before-after, not proof, until volume allows a held-back half.",
      "then": "Metric.query"
    },
    {
      "check": "role-unstaffed",
      "status": "warn",
      "roles": [
        "success-manager",
        "sales-engineer"
      ],
      "owned": 4,
      "doc": "/plays/sso-rung#check-role-unstaffed",
      "fix": "Staff the CSM, or leave it: 4 Customers Priya owns get drafts in her queue.",
      "then": "Role.staff"
    }
  ]
}

Each answer costs $0.04 from your Domain (Worker cost); POST /{namespace}/entitlements/check and a test connection cost nothing. That comes to about $0.16 a month at 4 asks and $0.08 at 2.

When it startsCopy Anchor Link

{
  "$id": "https://api.sb/leaseline.app/events/event_1288",
  "$type": "Event",
  "name": "Entitlement.checked",
  "at": "2026-10-19T10:22:31Z",
  "seq": 1288,
  "data": {
    "customer": "customer_33",
    "entitlement": "single-sign-on",
    "allowed": false,
    "offer": "team",
    "activeMembers": 22
  }
}

npx startup-builder trigger Entitlement.checked --like event_1288   # replays the delivery
npx startup-builder clock advance --by 2d   # then runs the follow-up’s tested check
npx startup-builder listen Entitlement.checked --forward-to http://localhost:3000/hook

Who runs itCopy Anchor Link

CSM · your agent (role:success-manager, worker_5) holds the Key Result. It hands questionnaires and Quotes to AE · Priya Shah (person) (role:sales-lead, worker_3), and held Customers to you (Dana Okafor, person, worker_1), because the CSM and Sales Engineer Roles have no person. Your number links to Did it work.

What it reads · What it may call. It reads the ask, the Entitlement, the live Price and the active-member count, and quotes only the pricing Page. It opens a test connection; turning single sign-on on for members and POST /{namespace}/subscriptions/{subscription}/switch are the admin’s own presses, never the agent’s. Its tools are POST /{namespace}/entitlements/check, POST /{namespace}/conversations/{conversation}/answer, POST /{namespace}/sso-connections, POST /{namespace}/conversations/{conversation}/escalate, POST /{namespace}/quotes/{quote}/send, POST /{namespace}/tasks/{task}/assign, and any other call becomes an Approval under the Role’s Mandate.

You hold the CSM Key Result: 50 upgrades per 100 single sign-on asks by 2026-12-31. ← worker, metric
Answer each ask within 1 business hour with the plan that includes it, its live Price and today’s charge. ← chooses.answer-the-ask, Answer-time stop
At 50 seats, a questionnaire or a Quote on an open Deal, choose To the AE.       ← your file, line 4
Offer a test sign-in before any charge.                                          ← chooses.set-up-first, your file line 5
Never turn single sign-on on for a team; the admin does.                         ← Lockout stop

The slow loop. The weekly Decisions kept 50 seats as the AE line, and no Change was merged in the window, so there is no replay or read-back to print.

What it can do nextCopy Anchor Link

When it hands to youCopy Anchor Link

Questionnaires and Quotes go to AE · Priya Shah (person); held Customers come to you. One Brief per Role, as captured (brief is Not live yet, gaps #7).

[
  {
    "$id": "https://api.sb/leaseline.app/tasks/task_506",
    "$type": "Task",
    "assignee": "worker_3",
    "due": "2026-10-16T16:05:00Z",
    "on": "contact_14",
    "brief": {
      "who": "Northgate Rentals, open Deal on the $2,400 plan",
      "said": "Item 14 of the security questionnaire: SAML single sign-on required.",
      "chose": "to-the-ae",
      "why": "a questionnaire on an open Deal is the AE’s",
      "answer": "the $2,400 plan includes SAML; the trust page link is attached",
      "never": [
        "a discount",
        "single sign-on on Team"
      ]
    }
  },
  {
    "$id": "https://api.sb/leaseline.app/tasks/task_489",
    "$type": "Task",
    "assignee": "worker_1",
    "due": "2026-10-09T17:00:00Z",
    "on": "customer_19",
    "brief": {
      "who": "Harbor Row",
      "said": "Do you have SSO?",
      "chose": "not-now",
      "why": "at risk since Oct 2: 3 support threads on late notices",
      "held": "keep-first"
    }
  }
]

The owner answers with POST /{namespace}/tasks/{task}/claim (Take this one), POST /{namespace}/tasks/{task}/return with a reason, or POST /{namespace}/actions/{action}/redirect, each a one-call window. Once a person claims, the agent’s pending answers to that Customer cancel with claimedByPerson (Not live yet, gaps #7), and every reply goes to the owner. A Task nobody claims by its due time goes up a Role through POST /{namespace}/tasks/{task}/escalate, and person-promise fires.

On time: 2 of 2 claimed within their due time, median 25 min, n 2, ■□□□ Too early to tell beside Other Startups’ 95 % on time. Your queue: in week 1, 4 approvals; after the promotion, about 1 hand-off every 2 weeks.

The fixed line: POST /{namespace}/deals/{deal}/assign sets owner to the receiving person, the agent is never a Deal’s owner, and Meetings land on the owner’s calendar under the owner’s name.

When it won’t sendCopy Anchor Link

The captured refusal, then the Stop that fired as a Campaign.paused reason (Not live yet, gaps #2); the rewrite that sent is the Quarry Lane thread in Example.

{
  "type": "https://startupbuilder.dev/errors/refused",
  "title": "Refused",
  "status": 422,
  "detail": "The answer to Quarry Lane Homes did not send: it offers single sign-on on Team, which no live Offer shows.",
  "checks": [
    {
      "check": "price",
      "status": "fail",
      "doc": "/plays/sso-rung#check-price",
      "fix": "Quote the plan that includes it, or get the discount approved.",
      "then": "Approval.approve"
    },
    {
      "check": "keep-first",
      "status": "pass"
    }
  ]
}

[
  {
    "reason": {
      "limit": "answer-time",
      "observed": "1h 25m",
      "bound": "1 business hour",
      "window": "1 ask"
    },
    "doc": "/plays/sso-rung#stop-answer-time",
    "task": "task_377"
  }
]

Did it workCopy Anchor Link

At 4 asks a month, no held-back half reads within 90 days, so the basis is before-after (rule o): the columns read Now and Before, and nothing prints as Added. Each figure’s call is POST /{namespace}/metrics/query by node, and every node above the leaf is Not live yet (gaps #4).

{
  "$id": "decisions/decision_347",
  "$type": "Decision",
  "choice": "set-up-first",
  "reason": "Pinecrest’s admin opened single sign-on setup on Team; 22 active members is under the 50-seat line, so they test sign-in before paying",
  "stakes": "low",
  "options": [
    "answer-the-ask",
    "set-up-first",
    "to-the-ae",
    "note-the-plan",
    "not-now"
  ],
  "by": "worker_5",
  "on": "customer_33",
  "expected": "Subscription.switched to the annual plan within 60d",
  "reopensWhen": "no Subscription.switched for customer_33 within 60d"
}

Before against after reads the 91 days against the 90 before them; an ask counts once its 60 days have passed. It is not proof, and Other Startups’ results print beside it.

How it moves it: a median first answer of 6m 40s against 2 days 4 hours before, each naming the plan, its live Price and today’s charge, with a test sign-in before any charge.

Guardrails: before against after: contraction-arr, $0 from switches back to Team against $0 before, and logo-churn, 0 of 6 upgraded Customers gone; 6 of 6 upgraded teams had an active connection by day 14.

{
  "$id": "https://api.sb/leaseline.app/campaigns/sso-rung",
  "$type": "Campaign",
  "play": "play:sso-rung@1",
  "path": [
    "tier-upgrade-rate",
    "expansion-arr",
    "net-new-arr",
    "arr"
  ],
  "experiment": {
    "metric": "tier-upgrade-rate",
    "unit": "per-100",
    "heldBack": 0,
    "decision": null
  },
  "readout": {
    "value": null,
    "n": 8,
    "maturing": 3,
    "interval": null,
    "readability": "inadmissible",
    "basis": "before-after",
    "pooled": true
  },
  "ledger": {
    "spend": 1,
    "workerCost": 1,
    "hours": 0.9,
    "pipelineArr": 2393,
    "wonArr": 8688,
    "projectedArr": 1216,
    "paybackDays": 1
  }
}

Outside benchmark: 3.2 % of Subscriptions on a plan without single sign-on move to one with it in their fourth month (a subscription-analytics firm’s billing data, 2026-09-30).

Before it · After it. Before it: signal-expansion hands it a team that reaches 20 active members, and trust-pack hands it questionnaire items on open Deals. After it: written-references hears the Customers it upgraded, and annual-prepay already holds them on the annual plan; keep-first holds both while a Customer is at risk.

ExampleCopy Anchor Link

Leaseline ran it from 2026-07-20 to 2026-10-19 (91 days): 11 asks and setups on 10 Customers and 1 Deal, 8 of them matured past their 60-day window. Read every captured thread at ?threads=all; three follow the tables.

Leaseline → Pinecrest’s admin, Oct 19, 10:29 · Single sign-on comes with the $2,400-a-year plan, which also adds directory sync.¹ Switching today costs $2,366.87, after the $33.13 left on Team this month.² Test sign-in with your own accounts first; nothing is charged until you press Switch.³ *Signed with the Role’s disclosure line.*⁴

Pinecrest, Oct 19, 11:52 · test sign-in passed, then pressed Switch. Subscription.switched, +$1,448 ARR.

- We can turn on SSO for you on Team at no extra cost for the first 3 months.
+ Single sign-on with your Google accounts comes with the $2,400-a-year plan; you can test sign-in before you pay.

Northgate Rentals, 2026-10-16 15:05 · questionnaire item 14: “SAML single sign-on required.” · Leaseline, 15:06 · *Thanks. Priya, your account lead, replies by 16:05 with the answer and the trust page.*⁵ The Brief went to Priya (task_506); she answered at 15:41.

¹ Only what the pricing Page lists for the plan. ² The live Price and today’s charge, after the Team credit. ³ The test sign-in before any charge. ⁴ The fixed signature line, compiled from the Role’s disclosure Setting. ⁵ The routed line, compiled from the Role’s Settings.

Your settingsCopy Anchor Link

---
holdout: 0        # 4 asks a month is too few to hold any back; it reads before-after
---
Answer every single sign-on ask within the hour with the $2,400 plan. At 50 seats, a questionnaire or a Quote, bring in the AE.
Let the admin test sign-in before any charge.

$ npx startup-builder show plays/sso-rung
holdout 0 · AE line 50 seats · test before charge     your file  plays/sso-rung.mdx:2,4,5 (Ask 2026-07-20)
family expansion · worker role:success-manager, owns never · chooses 5 (2 rule, 3 read) · sequences sso-ask-follow-up, sso-proactive-note, sso-go-live · checks owned-by-a-person, keep-first, customer-ask-cap, reconcile, price · stops 12 · placements gmail, outlook    catalog  play:sso-rung@1 (Not live yet, gaps #5)

Every key from the catalogCopy Anchor Link

Compiled, not written: edit the Play record sso-rung and its Leaseline run, then regenerate. Every step runs from a sentence or a line of code. In your words: the CRM words you know, and where each lives here.