Predictika · Zero trust network access quotes

An AI sales agent's Appgate zero trust quote, checked before it goes out

An AI sales agent prepares a quote for Appgate, the zero trust network access vendor: AppGate ZTNA licensed per user, Portal User, Service User, Site and Connector Resource Group, with the AppGate Risk Sentinel, Digital Experience Monitoring and Application Discovery feature licenses, on a Cloud Hosted, Self Hosted or Isolated deployment, with support and ZTNA Implementation, for a term of one, three or five years. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the licensing units and prerequisites Appgate documents and returns a verdict, every reason, a line-item quote and the figures it computed.

Scope: Appgate zero trust quotes: AppGate ZTNA user, Portal User, Service User, Site and Connector Resource Group licenses, Risk Sentinel, Digital Experience Monitoring and Application Discovery, Cloud Hosted, Self Hosted and Isolated deployments, support and implementation, for any user count, on a 1-, 3- or 5-year term. See everything this validator covers

This validator models Appgate zero trust quotes as described in the Appgate public license and deployment documentation, not just the scenarios shown below.

  • Licenses — AppGate ZTNA user licenses (an always-on Client uses two), Portal User licenses for clientless access, Service User licenses, Site licenses and Connector Resource Group licenses (up to 60 per Connector), in any quantity.
  • Feature licenses — AppGate Risk Sentinel, Digital Experience Monitoring and Application Discovery, each with its documented prerequisites.
  • Deployment — Cloud Hosted (Controller in the Zero Trust platform cloud), Self Hosted and Isolated (no connection to the Zero Trust platform), with the Portal, LogServer and LogForwarder roles.
  • What the validator checks — that user licenses cover the users and the always-on Clients, that Portal Users have a Portal, that Site licenses cover the Sites, that Resource Groups fit the Connectors, that Risk Sentinel and Application Discovery are not quoted on an Isolated deployment, that Application Discovery has a LogServer or LogForwarder, the groups claim and a user-group count within the version limit, that the feature licenses do not exceed the user licenses, that a support plan is quoted, that the term is one, three or five years, and that the stated term total matches the computed one.
  • Approvals — a five-year term, a term total above $6 million, user licenses with fewer than 50 to spare at over 95 percent use (the level at which the Controller health check warns), and ten or more Sites without the implementation service go to a person.

Any Appgate zero trust quote that touches these licenses, features and deployment models is in scope — not only the scenarios pictured here. Not covered: 360 Fraud Protection, Cyber Advisory Services, the Connector HA clone rule, Log Server sizing, taxes and negotiated discounts. Appgate publishes no prices, so every price on this page is illustrative.

The AI sales agentBuilds the Appgate quote from the conversation with the customer and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Always-on Clients draw two user licensesOnly with care
The license guide says an always-on Client uses a full and a headless user license; a rep who counts people quotes too few, and catching it takes a calculated field and a validation rule that someone keeps in step.		Users and always-on users are separate inputs and the license count is checked against both on every call.
Feature licenses that depend on the deploymentOnly with workarounds
Risk Sentinel and Application Discovery need a connected deployment, and Application Discovery also needs a LogServer or LogForwarder, the groups claim and a group count that depends on the version; that is a chain of product rules plus a field for each prerequisite.		Each prerequisite is a fact in the request and is checked against the feature quoted, in one pass.
Connector capacityOnly with care
One Connector holds 60 Resource Groups; a validation rule can compare the two numbers, but nothing asks the rep how many Connectors the design needs.		Resource Groups are compared with 60 times the Connectors quoted.
Per-unit prices that change with the termOnly with workarounds
Every license has a rate for one, three and five years and the stated total has to follow; that is a price table per license per term, kept in step by hand.		The rate is chosen from the term for every license and the term total is compared with the stated figure in the same pass.
License headroomOnly with workarounds
The Controller warns above 95 percent use with fewer than 50 licenses left; a quote that sits right at the line needs a rule that mixes a percentage with an absolute count.		The same two conditions are checked on the quote and sent to a person.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the quote is saved or a step is completed, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1The quote has a 5-year term, a long price commitment, so a person should confirm.
2The quote has a term of 2 years; the licenses are quoted for 1, 3 or 5 years.
3The quote includes no Appgate product, so there is nothing to price.
4The quote has 2,000 user licenses for 2,000 needed; the Controller health check warns when usage is above 95 percent with fewer than 50 licenses left, so a person should confirm.
5The quote has 1,999 user licenses, but 2,000 workforce users and 0 always-on users need 2,000; an always-on Client uses two user licenses per person, the full Client and a headless one.
6The quote has 2,500 always-on users but only 2,000 workforce users; always-on users are a subset of the users.
7The quote includes 300 Portal User licenses, which are for clientless browser access, and the design includes no Portal appliance role.
8The quote has 2 Site licenses for a design with 3 Sites; each Site draws a Site license.
9The quote includes 61 Connector Resource Groups with a Connector count of 1; one Connector holds up to 60 Resource Groups, 60 in total.
10The quote includes Risk Sentinel for 2,000 users, which gets its risk level from the Risk Engine cloud service, and the deployment is Isolated, with no connection to the Zero Trust platform.
11The quote has Risk Sentinel for 2,300 users and Digital Experience Monitoring for 0 users, and only 2,200 user licenses; both are licensed per user.
12The quote includes Application Discovery, which needs a Collective connected to the Zero Trust platform, and the deployment is Isolated.
13The quote includes Application Discovery, which exports its data through a LogServer or LogForwarder, and the design includes neither.
14The quote includes Application Discovery, which needs an identity provider attribute mapped to the groups claim, and that mapping is not confirmed.
15The quote expects 201 user groups on an application; Application Discovery on the chosen version holds up to 200 user groups per application.
16The quote has no support plan; the licenses are quoted with Standard or Premium support.
17The design has 10 Sites and the quote includes no ZTNA Implementation service, so a person should confirm.
18The quote states a term total of $840,599; the prices give $840,600.
19The term total is $6,089,400, above $6 million, so a person should confirm.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Global manufacturer, 7,000 users: A quote for a global manufacturer's zero trust rollout across plants and contractors

    
The agent's request. Please quote AppGate ZTNA on an Isolated deployment, version 6.6, for 7,000 users, 600 of them on the always-on Client, with 7,000 user licenses, 400 Portal Users, 60 Service Users, 14 Sites with 14 Site licenses, 150 Connector Resource Groups on 2 Connectors, AppGate Risk Sentinel for 7,000 users, Digital Experience Monitoring for 2,500 users, Application Discovery (150 user groups per application), Premium support and ZTNA Implementation, on a 3-year term. The quote states $2,007,000 over the term. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Too few user licenses. The quote has 7,000 user licenses, but 7,000 workforce users and 600 always-on users need 7,600; an always-on Client uses two user licenses per person, the full Client and a headless one.
    • 
      
  • Portal Users need the Portal. The quote includes 400 Portal User licenses, which are for clientless browser access, and the design includes no Portal appliance role.
    • 
      
  • Resource Groups exceed Connector capacity. The quote includes 150 Connector Resource Groups with a Connector count of 2; one Connector holds up to 60 Resource Groups, 120 in total.
    • 
      
  • Risk Sentinel needs a connected deployment. The quote includes Risk Sentinel for 7,000 users, which gets its risk level from the Risk Engine cloud service, and the deployment is Isolated, with no connection to the Zero Trust platform.
    • 
      
  • Application Discovery needs a connected deployment. The quote includes Application Discovery, which needs a Collective connected to the Zero Trust platform, and the deployment is Isolated.
    • 
      
  • Application Discovery needs a LogServer or LogForwarder. The quote includes Application Discovery, which exports its data through a LogServer or LogForwarder, and the design includes neither.
    • 
      
  • Application Discovery needs the groups claim. The quote includes Application Discovery, which needs an identity provider attribute mapped to the groups claim, and that mapping is not confirmed.
    • 
      
  • Stated total does not match. The quote states a term total of $2,007,000; the prices give $5,032,500.
    • 
    

    
2. Global manufacturer, 7,000 users: The agent resubmits after fixing the errors

    
The agent's request. Please quote AppGate ZTNA on a Self Hosted deployment, version 6.6, for 7,000 users, 600 of them on the always-on Client, with 7,700 user licenses, 400 Portal Users with the Portal role, 60 Service Users, 14 Sites with 14 Site licenses, 150 Connector Resource Groups on 3 Connectors, AppGate Risk Sentinel for 7,000 users, Digital Experience Monitoring for 2,500 users, Application Discovery (a LogServer, the groups claim mapped, 150 user groups per application), Premium support and ZTNA Implementation, on a 3-year term. The quote states $5,309,700 over the term. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. One-time implementation of $252,000, annual charge of $1,685,900 and a term total of $5,309,700.
    • 
    

    
3. Hospital network, 12 Sites: A quote for a hospital network with risk scoring, monitoring and application discovery

    
The agent's request. Please quote AppGate ZTNA on a Cloud Hosted deployment, version 6.6, for 3,000 users, with 3,100 user licenses, 12 Sites with 9 Site licenses, 75 Connector Resource Groups on 1 Connector, AppGate Risk Sentinel for 3,000 users, Digital Experience Monitoring for 3,500 users, Application Discovery (a LogForwarder, the groups claim mapped, 340 user groups per application) and Standard support, on a 3-year term. The quote states $2,242,800 over the term. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Fewer Site licenses than Sites. The quote has 9 Site licenses for a design with 12 Sites; each Site draws a Site license.
    • 
      
  • Resource Groups exceed Connector capacity. The quote includes 75 Connector Resource Groups with a Connector count of 1; one Connector holds up to 60 Resource Groups, 60 in total.
    • 
      
  • Too many user groups per application. The quote expects 340 user groups on an application; Application Discovery on the chosen version holds up to 200 user groups per application.
    • 
      
  • Feature licenses exceed user licenses. The quote has Risk Sentinel for 3,000 users and Digital Experience Monitoring for 3,500 users, and only 3,100 user licenses; both are licensed per user.
    • 
      
  • Stated total does not match. The quote states a term total of $2,242,800; the prices give $2,307,600.
    • 
      
  • Ten or more Sites without implementation. The design has 12 Sites and the quote includes no ZTNA Implementation service, so a person should confirm.
    • 
    

    
4. Hospital network, 12 Sites: The agent resubmits after fixing the errors

    
The agent's request. Please quote AppGate ZTNA on a Cloud Hosted deployment, version 6.6, for 3,000 users, with 3,100 user licenses, 12 Sites with 12 Site licenses, 75 Connector Resource Groups on 2 Connectors, AppGate Risk Sentinel for 3,000 users, Digital Experience Monitoring for 3,000 users, Application Discovery (a LogForwarder, the groups claim mapped, 340 user groups per application) and Standard support, on a 3-year term. The quote states $2,315,700 over the term. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Too many user groups per application. The quote expects 340 user groups on an application; Application Discovery on the chosen version holds up to 200 user groups per application.
    • 
      
  • Ten or more Sites without implementation. The design has 12 Sites and the quote includes no ZTNA Implementation service, so a person should confirm.
    • 
    

    
5. Hospital network, 12 Sites: The agent resubmits after fixing the errors

    
The agent's request. Please quote AppGate ZTNA on a Cloud Hosted deployment, version 6.6, for 3,000 users, with 3,100 user licenses, 12 Sites with 12 Site licenses, 75 Connector Resource Groups on 2 Connectors, AppGate Risk Sentinel for 3,000 users, Digital Experience Monitoring for 3,000 users, Application Discovery (a LogForwarder, the groups claim mapped, 180 user groups per application), Standard support and ZTNA Implementation, on a 3-year term. The quote states $2,531,700 over the term. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. One-time implementation of $216,000, annual charge of $771,900 and a term total of $2,531,700.
    • 
    

    
6. Federal contractor, air-gapped: A quote for a federal contractor's air-gapped zero trust access

    
The agent's request. Please quote AppGate ZTNA on an Isolated deployment, version 6.6, for 3,000 users, 1,200 of them on the always-on Client, with 3,000 user licenses, 25 Service Users, 6 Sites with 6 Site licenses and 40 Connector Resource Groups on 1 Connector, on a 4-year term. The quote states $1,283,850 over the term. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Term is not 1, 3 or 5 years. The quote has a term of 4 years; the licenses are quoted for 1, 3 or 5 years.
    • 
      
  • Too few user licenses. The quote has 3,000 user licenses, but 3,000 workforce users and 1,200 always-on users need 4,200; an always-on Client uses two user licenses per person, the full Client and a headless one.
    • 
      
  • Support plan missing. The quote has no support plan; the licenses are quoted with Standard or Premium support.
    • 
      
  • Stated total does not match. The quote states a term total of $1,283,850; the prices give $1,711,800.
    • 
    

    
7. Federal contractor, air-gapped: The agent resubmits after fixing the errors

    
The agent's request. Please quote AppGate ZTNA on an Isolated deployment, version 6.6, for 3,000 users, 1,200 of them on the always-on Client, with 4,300 user licenses, 25 Service Users, 6 Sites with 6 Site licenses, 40 Connector Resource Groups on 1 Connector and Premium support, on a 5-year term. The quote states $3,125,750 over the term. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • Five-year term. The quote has a 5-year term, a long price commitment, so a person should confirm.
    • 
      
  • Quote summary. Annual charge of $625,150 and a term total of $3,125,750.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares a quote for Appgate, the zero trust network access vendor: AppGate ZTNA licensed per user, Portal User, Service User, and more. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the licensing units and prerequisites Appgate documents and returns a verdict, every reason, a line-item quote and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote AppGate ZTNA on an Isolated deployment, version 6.6, for 7,000 users, 600 of them on the always-on Client. The quote states $2,007,000 over the term. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with eight findings, all in one answer. The quote has 7,000 user licenses, but 7,000 workforce users and 600 always-on users need 7,600; an always-on Client uses two user licenses per person, the full Client and a headless one. The quote includes 400 Portal User licenses, which are for clientless browser access, and the design includes no Portal appliance role. The quote includes 150 Connector Resource Groups with a Connector count of 2; one Connector holds up to 60 Resource Groups, 120 in total. The other five are on screen.
    6. 
      
  6. The validator returned eight blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other and against the stated total.
    7. 
      
  7. What this shows: for always-on Clients draw two user licenses, a rules-based CPQ is error-prone for this.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the deployment to Self Hosted, the user licenses to 7,700, the portal role to included, the connectors to 3 and the stated term total to $5,309,700. Two more changes are on screen.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. The validator also returns the line-item quote. It starts with AppGate ZTNA user licenses and AppGate ZTNA Portal User licenses; the other eight lines are on screen.
    13. 
      
  13. All eight earlier findings are cleared, and the validator's total, $5,309,700, matches the quote.
    14. 
      
  14. Eight problems caught in one call, fixed in one pass, and a clean $5,309,700 quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    15.