The Business-Rules Moat: Why 'Forms on Databases' Are Unclonable
B2B SaaS lock-in isn't the UI or data model — it's years of accreted, configured business rules
- Difficulty
- Advanced
- Time to result
- ~ongoing to results
- Steps
- 3
- Confidence
- 90%
Clowes rebuts the meme that AI makes B2B SaaS trivially clonable. Yes, apps like Jira, Salesforce, and Workday are 'forms on databases,' but the real lock-in is the business rules — years of configuration that make the app fit your company's specific processes so tightly it becomes a black box even the vendor can't fully describe. Even in an agentic future with no UI, agents must still operate against those business rules — so the rules, not the interface, are the durable moat.
Origin
Clowes' synthesis from years at Atlassian (Jira) and Salesforce, applied to the 'AI will clone SaaS' debate.
Core principles
- 01All vertical/business SaaS is ultimately 'forms on databases,' which sounds easy to replicate
- 02Real lock-in is the business rules that encode each company's specific processes
- 03The longer you run the software, the more it becomes your company and less the vendor's
- 04Configured rules become a black box even the vendor can't fully explain without reading the code
- 05Removing the UI (agents) doesn't remove the rules — agents must operate against them
How to run it
- 1
Separate the three layers of value
Distinguish the data model (fields — boring, low lock-in), the UI/system-of-record default (some value), and the business rules (the real driver of lock-in). Locate a product's defensibility in the rules layer.
Pro tip Ask: what would it take to replicate not the screens, but the accreted configured workflows?
Watch out Underestimating this is the standard error — 'people really underestimate where the value is created... and get it completely wrong.'
- 2
Recognize configuration as compounding lock-in
Every company configures the software to its own processes over years, so it becomes 'Lenny Inc's Workday,' fitting your org and no one else's — and becoming opaque even to you.
Pro tip The vendor themselves often can't state all the encoded rules 'without reading the code of their instance.'
Watch out That opacity is a feature of the moat, not a bug — it makes wholesale replacement terrifying.
- 3
Stress-test the AI-disruption claim against the rules
Imagine the app 'without a head' — no UI. It still has the business rules that tell any agent what is possible and allowed. Conclude that AI most likely makes incumbents stronger, or enables new multi-object platform plays, rather than spawning easy clones.
Pro tip The party best positioned to introspect and rebuild on those rules is the incumbent itself.
Watch out A cheaper 'not as good Salesforce' has no angle; you must be materially different, not just a cheaper clone.
In the wild
Clowes notes that if you asked Salesforce to define all the processes by which software is sold inside Salesforce, 'they couldn't tell you that without reading the code of their Salesforce instance' — because over years the sales process simply became how the internal tooling works.
→ Demonstrates that the configured business rules are the real, hard-to-replicate asset.
Common mistakes
Believing AI makes SaaS trivially clonable
Treating apps as 'just forms on databases' ignores the years of accreted business rules; cloning the UI and schema still leaves the moat untouched, so incremental clone value trends to zero.
Assuming agents make the app disappear
Concluding that headless agentic workflows remove the need for the SaaS ignores that agents must still operate against the business rules that define what is allowed — the rules, and the app, remain.
Is it for you?
Best for
Founders and investors evaluating whether to attack (or defend) an entrenched B2B SaaS category in the AI era
Not ideal for
Greenfield categories with no incumbent and no accreted configuration, where this moat doesn't yet exist
From the transcript
“all vertical SAS or business SAS is ultimately forms on databases”
“it's all about the business rules like that is what drives the lock in”
“it's not Shan inks workday it's l inks workday”
“they couldn't tell you that without reading the code of their Salesforce instance”
“those business rules are what Define what the agent should do”
From the episode
Why great AI products are all about the data
Shaun Clowes (CPO Confluent, ex-Salesforce, Atlassian)