Draft Enterprise Saas Agreement Deal Points

Skill: Draft Enterprise SaaS Agreement from Deal Points Memo

1. Subject-matter triage

• Treat the deal points memo, vendor overview, internal emails, and playbook as one integrated instruction set; reconcile them before drafting.
• Confirm whether the customer context implicates regulated, sensitive, or personal data; if so, build the privacy/security/processing exhibit as a mandatory companion to the MSA and cross-reference it throughout.
• Determine whether the requested output is a clean-form agreement, a lightly negotiated draft, or a provisionally complete version with open items; draft accordingly and flag any unresolved commercial or compliance points in the cover memo.
• If the source set contains multiple competing drafts or assumptions, identify the controlling instruction set and note the conflict rather than silently choosing.

2. Failure modes the skill is correcting

• Drafting only from the deal points memo and omitting the playbook’s mandatory vendor-protective terms, which leaves the agreement underbuilt.
• Treating privacy, security, and data-handling obligations as optional even though healthcare-adjacent or sensitive-data processing requires a dedicated exhibit and tight cross-references.
• Producing a polished agreement while failing to surface unresolved judgment calls, silent assumptions, and memo/playbook conflicts for attorney review.
• Allowing the main agreement and the privacy/security exhibit to diverge on incident response, audit rights, subprocessors, retention, deletion, or breach handling.
• Filling gaps with boilerplate that is inconsistent with the vendor’s standard SaaS framework or with the negotiated deal points.
• Writing a cover memo that summarizes the work but does not explain why each non-obvious drafting choice was made.

3. Legal frameworks / domain conventions that apply

• SaaS MSAs typically allocate subscription scope, permitted use, support, uptime, data ownership, confidentiality, security, warranty disclaimers, liability limits, indemnities, and termination mechanics.
• Where regulated or sensitive information is processed, the agreement should incorporate a privacy, security, and data-processing exhibit that governs controller/processor-like obligations, incident notice, subprocessors, retention, deletion, and audit/access mechanics.
• The playbook functions as the vendor’s default risk posture; use it for mandatory clauses and fallback positions unless the deal points expressly override it.
• The deal points memo governs the customer-specific commercial deal; if it conflicts with the playbook, surface the conflict and implement the instructed override.
• Internal emails may reflect negotiated expectations, practical concessions, or drafting preferences; use them to resolve ambiguities, but do not treat them as higher authority than the deal points or playbook unless the source set clearly says so.
• Legal and regulatory references should be stated precisely where relied on, including the governing privacy, security, e-sign, limitation-of-liability, indemnity, and data-handling authorities applicable to the draft.
• The agreement should read as a complete enterprise form, not as a note-to-drafter, and should preserve internal consistency across the main body, exhibits, and any order-form mechanics.

4. Analytical scaffolds

• Source reconciliation: extract every operative commercial and legal term from the deal points, then compare each against the playbook and internal communications to identify required insertions, overrides, and open questions.
• Clause architecture: build the draft in the ordinary SaaS sequence—definitions, subscription grant, use restrictions, customer obligations, support/service levels, security/privacy, IP/data ownership, fees, warranties, indemnities, liability, term/termination, and general terms—while adapting to the playbook’s required structure.
• Privacy/security integration: draft the exhibit first in substance if needed, then ensure the MSA incorporates it by reference and does not contradict it on access, notice, transfer, subprocessors, retention, deletion, or security controls.
• Conflict handling: where a term is silent, choose the playbook default unless the source set indicates a customer-specific reason to depart; where the sources conflict, implement the deal point and identify the override in the cover memo.
• Judgment-call logging: for any drafting choice not dictated by the sources, record the chosen position, the basis for the choice, and any alternative left open for business or legal confirmation.
• Open-issue triage: flag unresolved items that affect price, scope, compliance, implementation, renewal, support, data flows, or liability so the reviewer can close them quickly.
• Consistency check: verify defined terms, exhibit cross-references, indemnity hooks, security commitments, and termination triggers align across all documents before finalizing.

5. Vertical / structural / temporal relationships

• Draft the MSA as the controlling agreement and the privacy/security exhibit as a subordinate but operative schedule incorporated by reference.
• Make sure any order form, statement of work, or service description is consistent with the MSA hierarchy and does not accidentally override core legal terms unless intended.
• Align timing-sensitive obligations across the package: onboarding, service commencement, notice periods, incident notification, cure periods, renewal mechanics, data return/deletion, and post-termination assistance.
• Ensure operational obligations flow in the correct direction: vendor service obligations, customer cooperation obligations, then remedies, suspension rights, and termination rights.
• If the source set describes multiple service lines, data environments, or deployment phases, draft so that the core legal terms apply uniformly while any special terms are isolated in the relevant exhibit or schedule.

6. Output structure conventions

• Primary deliverable first: produce the complete MSA as a standalone, operative contract with all required exhibits attached and cross-referenced before turning to the cover memo.
• If a privacy/security/processing exhibit is required by the facts or playbook, include it as an integrated exhibit with substantive operative terms, not a placeholder.
• Secondary deliverable: prepare a cover memo to the reviewer that is concise but decision-oriented, organized by topic rather than by source document.
• In the cover memo, separate: conflicts resolved, judgment calls made, assumptions adopted, and open issues needing input.
• Use clear contract drafting conventions: defined terms, numbered sections, internal cross-references, and exhibit references that would survive export to Word.
• Keep the agreement vendor-favorable but commercially usable; avoid commentary inside the contract body except where the drafting convention requires it.
• Before finalizing, confirm that the named agreement file is complete and substantive, and that the cover memo does not substitute for missing operative language.