How do you design a RevOps control tower in Palantir Ontology that catches duplicate contacts after acquisition before weekly commit calls for consumption ramp deals with procurement portal mandates in 2027?

Two ways to build the control tower, and what each actually costs you

There are only two credible architectures here, and the choice determines everything downstream — your ingestion cadence, your merge policy, whether procurement blocks you, and how much trust the weekly commit call places in the numbers.

Option A — read-only control tower. Palantir Ontology ingests contact and account records from the acquiring CRM, the acquired company's CRM, the billing/usage system that drives consumption ramp recognition, and the procurement portal integration layer. The Ontology computes duplicate clusters, scores them, and renders them. It writes nothing back. Resolution happens by a human opening the CRM and merging there, using the control tower as a worklist. The Ontology's job is detection, ranking, and evidence — never mutation.

Option B — write-back control tower with Actions. Same ingestion, but the Ontology exposes an Action that performs the merge: it picks a survivor record, maps field-level survivorship, writes the merge decision back to the CRM through an API, and records the decision as a first-class object with an actor, a timestamp, and a reason. Humans still approve the ambiguous band, but the mechanical path is automated.

The trade-off is not "manual versus automated." It is reversibility versus throughput. A read-only tower cannot corrupt your CRM; its worst failure is a worklist nobody clears. A write-back tower can merge two genuinely distinct buyers at an acquired account into one record, silently destroying the second person's activity history and email consent lineage — and in a post-acquisition environment where you do not yet know the acquired book, you will not notice for weeks.

There is a real cost to Option A that people underweight: queue rot. A detection-only worklist that nobody is measured on grows monotonically. If the acquired book contributes 40,000 contacts and 6–9% of them cluster as probable duplicates against your existing book — a typical range for overlapping mid-market territories, higher if both companies sold to the same vertical — that is 2,400 to 3,600 clusters. At a realistic human review rate of 30–60 clusters per hour for clear cases and 10–15 per hour for ambiguous ones, a read-only tower with no automation is 80 to 200 person-hours of work. Nobody has that before the next quarter's commit calls.

The cost of Option B is irreversibility under uncertainty. Most CRM merges are not cleanly undoable — Salesforce merges delete the loser record and reparent its child objects; the pre-merge state is only recoverable from a backup or from a field-history trail you had the foresight to capture. Post-acquisition is exactly when your field-history coverage on the acquired org is worst.

The answer most teams land on is a staged hybrid, and the honest way to describe it is: Option A for the first 10 business days on one segment, then Option B applied only to the score band that Option A proved safe. That is not fence-sitting. It is using the pilot to earn the confidence interval that justifies write-back on a specific, bounded slice.

One more distinction that matters for this exact question: procurement portal mandates change the calculus asymmetrically. If the acquired company's contacts hold registered identities in a buyer-side procurement portal — Coupa, SAP Ariba, Jaggaer, an OEM's or a government agency's own supplier portal — then the contact record is not purely yours to reshape. The portal has its own notion of who your authorized contact is, and consumption ramp deals frequently route their PO increments and usage true-ups through that portal. Merging two contacts in your CRM does not merge them in the buyer's portal. If your survivor record's email no longer matches the portal-registered identity, your next ramp increment PO can bounce. That single failure mode is why write-back needs a portal gate, not just a confidence threshold.

How to decide between them

The decision is not a matter of taste. Run it as a gate sequence, and let the data from the first two weeks pick the branch.

Gate 1 — Do you have field-level lineage on the acquired org? If you cannot answer "which system did this phone number come from and when" for an acquired contact, you cannot write survivorship rules, because survivorship is a statement about source trust. Without lineage, choose Option A and spend the pilot building it. Lineage in Palantir Ontology is cheap to add at ingestion time — stamp every property with a source-system identifier and an ingest timestamp on the way in — and impossible to reconstruct later.

Gate 2 — What is your false-merge tolerance? Compute it concretely. Take the count of open consumption ramp opportunities where the primary or economic-buyer contact came from the acquired book. If that number is under 20, a single false merge is a material forecast event and you should not automate above a very high score. If it is 200+, per-deal blast radius is lower and the queue-rot argument dominates.

Gate 3 — Does the procurement portal own the identity? For every cluster, ask whether either member has an active portal registration. If yes, the cluster is never eligible for automatic merge regardless of score. Route it to a human who owns the portal relationship and can re-register or re-designate the contact on the buyer's side first. Merge in your CRM second. Order matters.

Gate 4 — Can a manager inspect the output in under fifteen minutes on Friday? If the control tower's output cannot be read cold in a quarter of an hour, it will not be read at all before the commit call, and the architecture question is moot.

That last node matters more than it looks. Whichever branch a cluster takes, it terminates in the same audit object. When someone asks in the commit call why the contact on a $1.4M ramp deal changed on Wednesday, there is one place to look and the answer includes who decided and on what evidence.

A practical tiebreaker: if your acquisition closed under 90 days ago, default to Option A. Post-close, the acquired org's data is still moving — their reps are still working their old CRM, their admin is still fixing things, the migration backfill is still running. Automating merges against a moving source produces merges you will have to un-make. Wait until the acquired org's contact table has a stable daily change rate — under roughly 1% of records modified per day — before turning on write-back.

The numbers that actually drive the choice

Vague guidance kills these projects. Here are the concrete thresholds and volumes to plan against, with the reasoning so you can adjust them to your own data rather than copying them blind.

Match scoring bands. Use a composite score from 0 to 100, built from weighted components rather than a single string-similarity number:

• Normalized email exact match: 55 points. Normalize by lowercasing, stripping dots in the local part for providers that ignore them, stripping +tag suffixes, and resolving known domain aliases created by the acquisition (the acquired company's old domain almost always forwards to the new one — capture that mapping explicitly as an object in the Ontology, not as a hardcoded list in a transform).
• Phone match on last 10 digits after stripping formatting: 15 points.
• Name similarity via Jaro-Winkler above 0.92: 15 points. Jaro-Winkler outperforms Levenshtein here because it weights common prefixes, which handles "Rob"/"Robert" and "Kate"/"Katherine" better than raw edit distance.
• Same resolved account: 10 points. "Resolved account" means the account after your account-level dedup runs, not the raw CRM account ID — otherwise the acquisition itself guarantees this signal never fires, since the same buyer exists as two accounts.
• Same title normalized to a role taxonomy: 5 points.

Thresholds. Auto-merge at 92 and above. Human review from 70 to 92. Suppress below 70, but keep the link as a weak association so a reviewer looking at one record can see the other. The reason 92 rather than 85: at 85, an email match plus a phone match plus a weak name signal clears the bar, and after an acquisition, shared main-line phone numbers at the same office produce exactly that pattern for genuinely different people. Push it to 92 and you require the email to be right, which is the only property that reliably identifies a person.

Expected volumes. For an acquired book of 40,000 contacts against an existing book of 250,000 in overlapping segments, expect roughly 6–9% to form duplicate clusters, of which about 55–70% land in the auto-merge band, 25–35% in the review band, and the remainder suppressed. That means a review queue in the 600 to 1,200 range — real, but clearable at 40–60 per reviewer-hour over two or three weeks by two people. Compare that to 2,400–3,600 clusters if you run detection-only. The automation is buying you roughly 70% of the labor, not 100%.

Procurement portal gating volume. In practice, portal-registered contacts are a minority of the book but a majority of the revenue-critical ones. Expect 3–8% of contacts to carry an active portal registration, but 30–60% of your open consumption ramp deals to have at least one portal-registered contact on them. This is the whole point: the small slice you must not auto-merge is disproportionately the slice attached to the forecast.

Latency budget. Work backward from the commit call. If commit is Monday at 10:00, the readiness view must be stable by Friday 09:00 so managers have the business day to clear blockers. That means the nightly scoring job runs Thursday night, escalations fire Thursday evening, and the portal API checks — which are slow and rate-limited, often 2–5 requests per second at best — run against a bounded candidate set, not the whole book. Score first, gate second. Checking 40,000 contacts against a portal API at 3 req/sec is nearly four hours; checking the 1,500 that appear in clusters is under ten minutes.

Cost of a false merge, quantified for your own case. Multiply: (number of open ramp deals touching the acquired book) × (probability a merge lands on one) × (average days of forecast disruption when the buyer contact bounces a PO). Even at a 0.5% false-merge rate on a 900-cluster auto-band — four or five bad merges — if two land on ramp deals with portal mandates, you have introduced two PO delays into a quarter. Price that against 80–200 hours of manual review and the answer stops being ideological.

Field survivorship, concretely. Do not pick a survivor record and take all its fields. Pick per property:

• Email: survivor is the one matching the active procurement portal registration, if any; otherwise the most recently active on an inbound email or meeting.
• Phone: most recently modified with a non-null value.
• Opt-out and consent flags: union of the strictest values, always. If either record is unsubscribed, the merged record is unsubscribed. This is not negotiable and it is the single rule most likely to be gotten wrong by a naive "survivor wins" implementation.
• Activity history: preserve both, reparented. Losing the acquired rep's call history destroys the relationship context that made the acquisition worth doing.
• Owner: the owner of the record attached to the open opportunity, with a notification to the other owner rather than a silent reassignment.

Building it, in the order that works

Sequencing matters more than tooling. Here is the order, with the reason each step precedes the next.

Week 0 — model the objects before ingesting anything. Define Person as the resolved identity object, distinct from CrmContact, which represents a row in a specific source system. This is the single most important modeling decision and the one people skip. Person has a one-to-many link to CrmContact. A duplicate is not "two contacts" — it is "one Person with two CrmContact links." Once you model it that way, merging becomes a link operation with a history, not a destructive row operation, and un-merging becomes possible inside the Ontology even when it is not possible in the CRM. Add MatchCandidate (a scored pair with its component sub-scores retained, not just the total), PortalRegistration (portal name, buyer org, registered email, status, last verified), and MergeDecision (actor, timestamp, action, reason, resulting survivor).

Retaining the component sub-scores on MatchCandidate is what lets you tune later. If you only store 87, you can never answer "how many of our review-band items were email-match-plus-weak-name versus phone-plus-title," which is the exact question you need to move the threshold responsibly.

Week 0 — stamp lineage at ingest. Every property carries source system and ingest timestamp. Cheap now, impossible later.

Week 1 — baseline before you build detection. Export 30 real cases where a duplicate contact already caused observable damage: a bounced PO, a double-counted ramp deal, a rep emailing a buyer who had already unsubscribed under the other record, a commit call where the same logo appeared twice. Thirty is enough to find the pattern and few enough to read in an afternoon. Write the definition of done from those thirty cases, not from a vendor's framework. If 22 of your 30 failures involve the acquired company's old email domain, your normalization rule is worth more than your name-similarity algorithm.

Week 1 — run scoring in shadow mode. Compute scores across the full book, write nothing, take no action. Sample 100 clusters from each band and have a human label them. This gives you a real precision figure for your 92 threshold before anything is at stake. If precision at 92 is under about 98%, do not automate — raise the threshold or fix the normalization until it is.

Week 2 — wire the procurement gate. Populate PortalRegistration from whatever source you actually have. Be honest here: many teams do not have API access to the buyer's portal, because it is the buyer's system, not theirs. The fallback is real and workable — maintain PortalRegistration from your own deal desk's records of which contact was registered for which portal on which deal, sourced from the CSV exports and confirmation emails the deal desk already has. A manually maintained registry covering your top 60 accounts by ramp ARR beats an API integration you will not get approval for this quarter. Do not stall the project waiting for portal API access.

Weeks 2–3 — pilot on one segment. One pod, one territory, or one acquired-company business unit. Read-only. Manager opens the same saved view every week. Measure three things: review queue depth week over week, precision of the auto-band on a re-sampled 100, and the count of ramp deals with unresolved portal-blocked clusters.

Week 4 — turn on write-back, bounded. Enable the merge Action only for clusters that score above 92 and carry no portal registration on either member and sit in the pilot segment. Rate-limit the Action to a ceiling — 50 merges per run is a reasonable start — so a bad rule cannot process the entire book overnight. Add a circuit breaker: if the manual-reversal rate on auto-merges exceeds 2% in any week, the Action disables itself and requires a human to re-enable it.

Week 5 and beyond — expand by segment, never by threshold. Widen scope one segment at a time with the same threshold. Resist the pull to lower the threshold to clear the queue faster; that is the move that produces the incident.

The Friday readiness view. One page, four tiles, no drill-down required to understand it: unresolved clusters by band; portal-blocked clusters with the specific blocker named; ramp deals at risk with the cluster that puts them at risk linked directly; and merge velocity against the count needed to clear before Monday. The rule that makes this stick is a forecast rule, not a data rule — a consumption ramp deal whose primary contact sits in an unresolved cluster cannot be carried in Commit. Best Case, yes. Commit, no. That single rule converts data hygiene from an IT chore into something the sales manager has a reason to care about on Friday afternoon, which is the only mechanism that has ever made this kind of RevOps work survive past the pilot.

Escalation timing. Portal-blocked clusters attached to ramp deals notify the deal desk 48 hours before the commit call — Thursday morning for a Monday call. Forty-eight hours is chosen because portal re-registration on the buyer's side typically requires the buyer's own admin to act, and that is a one-business-day round trip at best. A 24-hour warning is a warning you cannot act on.

What to instrument from day one. Log every scoring run's band distribution. A sudden shift — the auto-band jumping from 60% to 80% of clusters overnight — means an upstream source changed, usually a migration backfill rewriting emails. Catch that as a distribution alert rather than as a wave of bad merges discovered a week later.

Related questions

Should the acquired company's CRM be migrated before building this?

No. Build the control tower against both systems as they stand. The Ontology's job is precisely to span them. Waiting for migration means running blind through the two or three quarters when duplicate risk is highest, and migration itself creates duplicates you would then have no detector for.

What if the procurement portal has no API?

Maintain PortalRegistration manually from deal desk records for your top accounts by ramp ARR. Coverage of the top 50–60 accounts captures most of the forecast risk. A manual registry that exists beats an API integration that is still in security review.

How do you handle a contact who legitimately exists at two accounts?

Model it as one Person linked to two account relationships, not as a duplicate. This is common with consultants and with buyers who moved companies during the acquisition window. Your scoring should down-weight, not merge, when emails differ across two active domains.

Does this replace CRM-native duplicate rules?

No — keep them for prevention at entry. Native rules stop new duplicates at creation; the Ontology control tower resolves the historical backlog the acquisition created and applies cross-system logic native rules cannot see.

Who owns the merge decision when two reps disagree?

The owner of the record attached to the open opportunity, with the second rep notified and given a defined window to object. Encode the decision and the objection in the MergeDecision object so the pattern is visible if it recurs.

FAQ

Why model a separate Person object instead of just flagging duplicate contacts?

Because a flag is a fact about a row, and identity is a fact about a human. Once Person exists as its own object with links to source-system contact rows, a merge becomes a reversible link change with a recorded decision, and every downstream analysis — pipeline coverage, ramp deal contact quality, procurement readiness — can be written against resolved identity rather than against whichever CRM row happened to be picked. It also means un-merging is possible in the Ontology even when the underlying CRM merge was destructive.

How long before the control tower is useful?

Detection is useful in the first week — shadow scoring across the full book will immediately show you where the acquisition created overlap, and that map alone changes how you run the next commit call. Trustworthy automated merging takes four to six weeks, most of which is spent measuring precision and building the portal registry rather than writing transforms.

What is the single most common failure in this build?

Turning on write-back before measuring precision at the chosen threshold. The second most common is treating the procurement portal check as a data-quality nicety rather than a hard gate — teams discover the coupling only when a ramp increment PO bounces because the buyer's portal no longer recognizes the contact email their supplier record points at.

How do you keep this from becoming a queue nobody clears?

Attach it to the forecast. If a consumption ramp deal cannot sit in Commit while its primary contact is in an unresolved cluster, the queue clears itself because a sales manager has a reason to clear it. Data-quality worklists with no forecast consequence decay within two months regardless of how good the tooling is.

Should the auto-merge threshold be tuned per segment?

Eventually, but not during the pilot. Expand scope at a fixed threshold first so that any change in outcomes is attributable to the new segment rather than to the new threshold. Once you have three or four segments running clean at one threshold, per-segment tuning becomes a measurable experiment instead of a guess.

What happens to activity history and consent flags on merge?

Activity history from both source records is preserved and reparented to the surviving record — losing the acquired rep's call and email history destroys exactly the relationship context the acquisition was meant to buy. Consent and opt-out flags take the strictest value across both records, always, with no survivorship override.

Sources

• https://www.palantir.com/docs/foundry/ontology/overview/
• https://www.palantir.com/docs/foundry/ontology/actions-overview/
• https://help.salesforce.com/s/articleView?id=sf.managing_duplicates_overview.htm&type=5
• https://knowledge.hubspot.com/records/manage-duplicate-records
• https://www.coupa.com/products/supplier-management
• https://www.ariba.com/
• https://www.gartner.com/en/sales/topics/revenue-operations
• https://hbr.org/2011/10/the-big-idea-the-new-ma-playbook
• https://www.iso.org/standard/35347.html
• https://gdpr.eu/data-subject-consent/

Related on PULSE

• How do you design a RevOps control tower in Palantir Signals for GTM alerts that catches duplicate contacts after acquisition before weekly commit calls for services-led sales with procurement portal mandates?
• How do you design a RevOps control tower in Palantir Foundry that catches duplicate contacts after acquisition before weekly commit calls for channel co-sell with strict IT security review blocks integrations?
• How do you use Palantir Foundry to alert on product usage not syncing to CRM in Zoho CRM during AE-led pods when procurement portal mandates?
• How do you prove Palantir pipeline digital twins improved win rate without creating a new shadow data mart for enterprise outbound teams on Zoho CRM when procurement portal mandates?
• How do you operationalize power and cooling constrained enterprise deals handoffs between sales, finance, and delivery when procurement portal mandates and leadership only reviews stage conversion monthly?
• How do you use Palantir-driven forecast simulations to measure product usage not syncing to CRM in Zoho CRM during usage-based pricing when procurement portal mandates?