Start with decisions, not events
An instrumentation plan is useful only when it connects a product question to a decision. “Track the Reporting feature” is too vague. “Decide whether to invest in onboarding after measuring eligible-account completion, repeat use, and failure evidence” is implementable.
- State the decision. Name what will change if the evidence is strong or weak.
- Choose the entity. Account, workspace, user, visit, page, or event.
- Define eligibility. Who could realistically perform the behavior?
- Define meaningful use. Specify the authoritative trigger and exclusions.
- Add context. Account, user, role, product area, page, release, and environment.
- Define the metric. Numerator, denominator, window, and aggregation.
- Define evidence and action. Which Visits or records will be reviewed, and by whom?
01
Decision
Invest in onboarding, or leave it alone
02
Entity
The customer account, not the user
03
Eligibility
Reporting enabled, source connected, permission granted
04
Meaningful use
report_exported confirmed by the server
05
Context
Account, role at event time, product area, release
06
Metric
Adopting accounts ÷ eligible accounts, 30 days
07
Evidence & action
Read the stalled Visits, then fix or fund it
Break any link and the chain stops
An event with no decision is cost. A metric with no eligibility is unreadable. Evidence with no owner is never reviewed.
Keep the first release deliberately small: identity, page structure, a few meaningful workflows, and the evidence required to validate them. A compact trustworthy taxonomy is more useful than hundreds of events nobody owns.
Define entities and identity before metrics
| Entity | Purpose |
|---|---|
| Commercial account | Customer relationship, contract, or reporting unit. |
| Workspace or organization | In-product context where work occurs; it may differ from the commercial account. |
| User and membership | Stable person plus explicit account/workspace relationships, roles, and effective dates. |
| Product area and grouped page | Stable analytical structure above noisy routes. |
| Normalized page | Route pattern with identifiers and irrelevant variation removed. |
| Visit | Ordered behavior used for investigation and timing. |
| Event | Point-in-time occurrence with identity and event-specific context. |
Use opaque stable IDs. Names and email addresses change, can be recycled, and may add personal data the analysis does not need. A company rename should update a display attribute, not the account key.
Preserve event-time account context
Store memberships explicitly. For every account-scoped action, capture the active account or workspace and role at event time. Never assign old events by joining them to a user’s current default company. Decide whether an account switch starts a new Visit or emits a context-change event; either can work if the stream never becomes ambiguous.
Before authentication, a browser identifier can support aggregate behavior, but “anonymous” is an analytics state—not a legal conclusion. Test how your destination merges anonymous and known identities across devices, logout, and shared browsers. Separate production, staging, demo, employee, and automated-test traffic from the first event.
Who — stable entities
Commercial account
contract and reporting unit
Workspace
where the work happens — may differ
Membership
user × role × effective dates
One user can hold several memberships. Opaque IDs only — a rename changes a display name, never the key.
Where — page structure
Product area
Reporting
Grouped page
Report builder
Normalized page
/reports/:id/edit?tab=schedule
Raw route
/reports/842/edit?tab=schedule
Kept for debugging, never used for counting.
What happened — the stream
Visit
ordered evidence, one account context
Every event stores its context at event time
never re-derived from the user's current default account
- account_id
- workspace_id
- user_id
- role_at_event
- visit_id
- product_area
- grouped_page
- environment
- occurred_at
Organize pages and product areas
Raw URLs are implementation detail. Normalize dynamic identifiers, preserve only query state with analytical meaning, and group routes into stable product pages and areas such as Reporting, Administration, or Integrations. Keep the raw permitted route separately for debugging.
| Layer | Example | Use |
|---|---|---|
| Raw permitted route | /reports/842/edit?tab=schedule | Debugging after privacy filtering |
| Normalized page | /reports/:report_id/edit?tab=schedule | Stable page-level counts |
| Grouped page | Report builder | Feature/workflow adoption |
| Product area | Reporting | Breadth and portfolio analysis |
Single-page applications must emit logical navigation when the route or state becomes a new analytical surface. Avoid double-counting the initial load and router event. Version grouping rules, preview their effect, and preserve historical comparability when a taxonomy changes. See grouping dynamic SaaS URLs.
Choose events and properties deliberately
| Signal | Represents | Use | Limit |
|---|---|---|---|
| Page view | A route became current | Reach, discovery, sequence | Does not prove completion |
| Autocaptured interaction | UI evidence | Exploration and debugging | Selectors, labels, and privacy can change |
| Semantic client event | Stable user intent | Funnels and workflow starts | Browser may not know the final outcome |
| Server outcome | Persisted or asynchronous result | Completion and business outcomes | May not explain user intent |
| Product state | Durable condition | Configuration and current eligibility | Latest state is not full history |
Name events consistently, but prioritize semantics over casing. If a click only requests an export, call it report_export_requested; emit report_exported when the backend confirms success. Prefer one canonical producer per logical event. If client and server both emit, give the events different meanings or use a documented idempotency key.
Properties should answer “in what context?” without copying the entire object. Include stable IDs, Visit, role at event time, product area, grouped page, release/environment, occurrence time, and event-specific enums. Exclude secrets, tokens, free-form customer content, DOM text, large arrays, and mutable profiles.
{
"event": "report_exported",
"occurred_at": "2026-07-29T10:14:22Z",
"project_id": "prj_01",
"account_id": "acct_0298",
"user_id": "usr_1842",
"visit_id": "visit_7711",
"product_area": "Reporting",
"grouped_page": "Report builder",
"export_format": "csv"
}Keep mutable current attributes, such as account plan, on the entity profile. When historical plan context affects a decision, add an intentional plan_at_event snapshot and document the distinction.
Use a tracking-plan contract
For every important workflow, record the business question, entity, exact trigger, qualifying behavior, required context, eligibility, privacy rule, owner, and validation method.
Exact trigger
The server validates and stores an active connection. The button click does not fire it.
Qualifying behavior
First successful connection in the period. Reconnections are classified separately.
Eligibility — the denominator
Accounts where the integration is available on the plan and the actor is authorized.
Properties sent
- account_id
- workspace_id
- user_id
- role_at_event
- integration_type
- environment
- occurred_at
Never sent
- credentials
- api_keys
- tokens
- endpoints
- payloads
Owners
Product: Integrations PM
Technical: Platform team
Proof before the dashboard
success and failure tests reconciled against active connection records delayed jobs and retries deduplicated one Visit read end to end| Question/event | Exact trigger | Qualifying behavior | Eligibility | Privacy | Validation |
|---|---|---|---|---|---|
Did an account create a real report?report_created | Backend commits a user-created report; drafts do not fire | First successful non-template creation in period | Reporting enabled, data source connected, permission granted | No title, query, filters, or content | Contract and integration tests; reconcile committed records |
Did integration setup finish?integration_connected | Server validates and stores an active connection | First connection; reconnections classified separately | Integration available and actor authorized | No credentials, keys, tokens, endpoints, or payloads | Success/failure tests; reconcile active records and delayed jobs |
Did collaboration spread?member_invited | Server stores a valid new invitation; resend excluded | First valid invitation segmented by roles | Capacity and inviter permission | No names, emails, messages, or token | API test and unique invitation reconciliation |
Assign both a product owner and technical owner. The contract changes through review and versioning, not silent edits in code or dashboards.
Implementation acceptance criteria
A definition is ready only when the team can answer these questions:
- Which one system produces the event?
- Does the trigger distinguish an attempt from a successful outcome?
- Can retries, refreshes, delayed jobs, or webhook redelivery create duplicates?
- Are account, workspace, user, role, environment, and occurrence time available when needed?
- Are allowed enum values documented?
- Can a failed action be distinguished from an absent action without collecting sensitive error text?
Test positive, negative, duplicate, delayed, unauthorized, and account-switch paths, then verify:
- An internal tester can find the event in raw data.
- The authoritative database record matches.
- A Visit retains enough surrounding evidence to explain the event.
- A tiny known sample produces the expected derived metric before dashboard exposure.
- Semantic correctness and denominator integrity accompany schema validity.
Instrument Visits and denominators
A correctly fired outcome is misleading if the team cannot identify who had an opportunity to perform it. Instrument feature availability, permission, prerequisites, rollout exposure, and account lifecycle. Decide whether eligibility is evaluated at period start, event time, or any point in the period.
Reporting workflow adoption
eligible active accounts with at least one qualifying report_exported event ÷ eligible active accounts in the selected period
The numerator and denominator must share account definition, scope, environment, and period. Count each account once across the complete period; do not sum daily unique counts.
A Visit groups ordered page and event evidence with timing, account, and user context. It helps answer how an outcome happened, where users stalled, whether an account switch occurred, and whether an event was automated. Define inactivity and maximum-duration rules, exclude background noise where possible, and retain event timestamps separately from ingestion timestamps.
Build privacy, QA, and governance into the plan
Privacy and security
- Allowlist events and properties.
- Block protected routes and sensitive fields.
- Document purpose, retention, access, deletion, and region.
- Review replay separately from ordinary analytics.
- Never send credentials, tokens, payment data, or customer-entered content by default.
Validation
- Review semantics before coding.
- Schema-test allowed and required fields.
- Run a black-box journey in non-production.
- Use a production canary and inspect raw evidence.
- Reconcile authoritative database records.
- Monitor volume, missing identity, duplicates, nulls, and drift.
Version event definitions and grouping rules. A semantic change to report_created is not a harmless implementation detail: document the effective date, preserve the old definition where needed, and annotate reports. Establish deprecation rules so low-value events do not become permanent cost and privacy liabilities.
Monitor analytical drift
Monitoring should cover both technical and analytical drift. Alert on unexpected volume changes, new property cardinality, missing IDs, duplicate event identifiers, timestamps far from ingestion, unknown enum values, and events appearing in the wrong environment. Also review whether the event still represents the product concept after interface, permission, billing, or workflow changes. A technically stable stream can still become analytically wrong.
For every production release that affects a measured workflow, include the tracking contract in the release review. Confirm whether eligibility changed, whether an experiment or staged rollout changes exposure, whether a background job now owns completion, whether page-grouping rules need an update, and whether replay exclusions still cover sensitive surfaces. Annotate material changes so pre/post analysis does not silently compare two definitions.
Common mistakes to prevent
- Tracking every click while omitting authoritative outcomes.
- Using current account membership to rewrite historical context.
- Firing “success” before the backend succeeds.
- Letting client and server events double-count one completion.
- Adding unbounded or sensitive properties.
- Building dashboards before validating raw events.
- Changing definitions without versioning or annotations.
- Measuring adopters without instrumenting eligibility.
- Combining staging, employees, bots, and customers.
Roll out in phases and connect the evidence
- Foundation: projects, environments, stable IDs, account/workspace membership, page normalization, consent, and exclusions.
- Core workflows: a small set of meaningful client and server events with eligibility.
- Evidence: Visits, safe replay where justified, event-time account context, and outcome reconciliation.
- Governance: owners, versioning, monitoring, deprecation, and change review.
- Expansion: add instrumentation only for a named decision or unresolved evidence gap.
Hymetry organizes this B2B model around Companies, Users, grouped Pages, product areas, and Visits. It does not remove the need for a correct identity, event, privacy, and eligibility contract.
Frequently asked questions
What is a product analytics instrumentation plan?
It is an implementation contract connecting business questions to entities, exact event triggers, properties, eligibility, privacy controls, ownership, validation, metrics, and evidence. It is more than an event-name spreadsheet.
How many events should a B2B SaaS product track?
No universal number is useful. Start with identity, page structure, and the smallest set of meaningful workflows needed for current decisions. Add an event only when it has an owner, a defined question, and a validation method.
Is autocapture enough for product analytics?
No. It helps with discovery and UI evidence, but durable outcomes, asynchronous work, eligibility, and B2B account context usually require semantic events, server confirmation, and product state.
How should one user in several accounts be tracked?
Keep one stable user ID, explicit membership records, and the active account or workspace plus role on every scoped event. Never reconstruct old events from the user’s current default company.
What is the difference between an event property and an account attribute?
An event property describes one occurrence, such as export format or plan at that time. An account attribute describes current entity state. Use an intentional event-time snapshot when historical state affects analysis.
When is instrumentation finished?
It is maintained, not finished. Review schema drift, identity, privacy, volume, duplicates, eligibility, event usefulness, and product changes continuously; version or retire definitions through governance.
Sources
Method note: Official documentation was used for implementation patterns, not as a universal standard. Sources were accessed August 3, 2026.
Methodology and evidence limits
The recommendations synthesize vendor-neutral modeling principles with official identity, schema, tracking, privacy, and validation documentation. Exact identity merge, replay, retention, and group behavior varies by destination and contract; test it in your own environment.
Privacy references identify design principles, not legal advice. The cited 2026 CNIL session-replay recommendation was a non-binding consultation draft at access time.
Full source directory
- Amplitude data-planning playbook, unique users, and event validation
- Segment implementation guide, common fields, Identify, Group, Track, Page, Alias, and tracking plans
- Mixpanel identity management, Group Analytics, and deduplication
- PostHog event sending, autocapture, analytics practices, and path cleaning
- Snowplow schemas, schema versioning, and failed events
- W3C Page Visibility, OWASP logging guidance, and NIST Privacy Framework
- GDPR Article 5, ICO data minimisation, and CNIL 2026 session-replay consultation draft
Additional preserved references
These references supported the original detailed guide and remain available for claim verification and further reading.





