Skip to main content
The Rogue Stack view surfaces every SaaS app Layer discovers across your tenant — from OAuth consents, SSO sign-ins, and expense receipts — and reconciles them against the catalog of known applications. Anything Layer can’t confidently identify is routed to a review queue so a human can confirm what it is before it flows into spend, access, and offboarding workflows.

​
How discovery classifies apps

Every analysis run walks each unresolved row from three raw discovery sources and tries to identify the underlying app: For each unique app name, Layer runs a two-stage pipeline:
  1. Catalog match — a pure database lookup against your SaaS catalog using domain, subdomain, OAuth client ID, and previously classified aliases. When it matches, Layer stamps the resolved catalog entry onto every source row for that app so it stops being re-scanned on subsequent runs.
  2. LLM classification — if the catalog lookup returns unknown, Layer sends the signals (app name, domain, OAuth scopes) to Claude Haiku to identify the product.
    • High confidence results are auto-applied to your catalog and treated as a normal discovered app.
    • Low confidence results are queued in Rogue Stack as review_pending for an admin to confirm or reject.
Catalog matching runs on every analysis pass regardless of configuration. Only the LLM step requires an API key — see LLM classification below.

​
What the review queue shows

Open Rogue Stack → Review queue in your Layer dashboard. Each pending item includes:
  • The raw app or vendor name Layer observed.
  • The discovery source (OAuth, SSO, or email receipt) and the domain, client ID, or scopes it was seen with.
  • Claude’s best guess at the product, with a confidence score and reasoning.
  • Suggested catalog matches you can accept in one click.
For each item you can:
  • Approve the suggested match — Layer links every source row for that app to the chosen catalog entry.
  • Reject the suggestion and pick a different catalog entry, or mark the app as Ignored if it isn’t a real SaaS tool (e.g. a personal Google account or a one-off receipt).
Once resolved, the app disappears from the queue and won’t be re-classified on future runs.
If the review queue is empty and reads “All clear”, either every discovered app has already been matched, or the LLM classification step is disabled (see below).

​
LLM classification

Layer uses Anthropic’s Claude Haiku to identify apps that don’t match your catalog. This step is optional — without it, catalog matching still runs and back-fills known apps, but truly unknown apps will remain unresolved instead of appearing in the review queue.

​
Enable it

Set ANTHROPIC_API_KEY on the Layer worker environment:
Restart the worker. The next analysis run will start populating the review queue.

​
Cost and rate limits

Classification is designed to be cheap and bounded:
  • One Haiku call per newly discovered unknown app, then cached — the same app is never classified twice.
  • At most 25 LLM classifications per analysis run across all sources combined. Remaining candidates roll over to the next run.
  • Up to 200 catalog-match attempts per source per run (the non-LLM step).
  • Per-app failures are swallowed — a bad response never breaks the analysis job.
If you want to disable classification without removing the key, unset ANTHROPIC_API_KEY on the worker. Catalog matching and back-fill continue to run.

​
When apps stop being re-scanned

Layer writes the resolved catalog ID back onto every source row as soon as it’s identified — whether by catalog match, LLM auto-apply, or an admin’s decision in the review queue. Writes are idempotent, so a hand-curated match is never overwritten by a later automated one. This means an app you approve today won’t show up in the queue again the next time it appears in an OAuth grant or SSO event, and your daily analysis cost stays flat regardless of how much new activity your tenant generates.
  • Browser extension — the client-side source of domain-visit discovery.
  • Notifications — alert your team when new apps land in the review queue.
  • MCP server — query discovered apps and review-queue state from Claude.