Twenty-three of the roughly fifty employees on my NetSuite test account hold the Administrator role. A vendor custom field stores a plaintext credential. The invoice and vendor-bill approval workflows are installed and not initiating, so invoices and most bills flow through unapproved, and the only approval gate that runs is a single three-way-match workflow.
Those are the three findings the NetSuite Instance Technical Documentation prompt puts at the top of its executive summary, before it maps the other 437 custom record types, 1,843 active script deployments, 109 roles, and 17 workflows to their owners, dependencies, and upgrade risk. It went into the Sonar AI Prompt Library in September. If you're new to this, Sonar AI is an AI agent that runs inside NetSuite. Every prompt in the library is a playbook that I engineered and tested against live NetSuite data, and you run it inside your own account, against your own records. Nothing leaves the account, and nothing is written to it.
Separating the Bundles From the Account
The first thing the documentation does is tell you what's yours. Of 437 custom record types and 1,843 deployments, the large majority belong to managed bundles: SuiteSuccess, Fixed Assets, Electronic Bank Payments, SuiteTax, Ship Central, Manufacturing Mobile, the 360-family analytics apps, and about forty performance-management suitelets. The genuinely local footprint is small and identifiable, and the report lists it: a product-sourcing app with four custom records, an in-house API layer with token auth, audit logging, webhooks, and staged writes, a family of single-page apps for CRM, point of sale, collections, journal entry, and reporting, and the AI agent tooling.
Attribution is by script ID prefix, because the bundle-origin column on this account is unreliable, and the report says so. A handful of generic-prefix fields have inferred ownership, marked as inferred.
What Couldn't Be Read
I want to point at the gaps before the findings, because the way the report handles them is the reason to trust the rest. Custom forms aren't queryable through SuiteQL on this account. Neither are workflow states, integration records, CSV import maps, or the mapping of custom segments to record types. Each is flagged as a documentation gap with the UI path where it can be filled in, rather than guessed. One user event script, deployed to fifteen transaction types, has a source file that's access-blocked to the session, and the report says its logic could not be read and should be characterized before anyone touches a transaction form. That's marked as a black box, with the file ID.
There's also a section titled "Known schema quirks (verified, save future you the hours)": the transaction subsidiary field isn't exposed, regular-expression matching is rejected, sales order amounts come back negative, and so on. Every NetSuite developer who has lost an afternoon to one of those will know why it's there.
Workflows Versus Scripts
Seventeen workflows against 1,843 script deployments. Automation on this account is overwhelmingly script-driven, and workflows handle field defaulting and bundle-internal locking. The workflow table lists every one with its trigger, its origin, and its status, and three of the seventeen are the approval routing workflows that are installed and not initiating. The report's advice is to decide deliberately: activate them or remove them, because a future admin will see them installed and assume approvals are enforced.
Only one locally visible script holds an active schedule, a weekly role sync for the AI Companion. Everything else that's local and schedulable is deployed and not scheduled, which means on-demand only. No workflow uses a saved-search initiation condition, and the reporting surface is SuiteQL-first through the local tool family, which the report notes removes the classic fragility of someone editing a saved search that automation depends on.
Roles
109 roles, 79 of them custom. Fifty-two custom roles have zero assignees, including an entire fifteen-role pack that was provisioned and never used, and two assigned roles named TEST_DELETE_ME and smoketest. Thirty-one custom roles are unrestricted by subsidiary in a OneWorld account, which the report says is acceptable for integrations and worth reviewing for humans. The admin-like grants inside custom roles are itemized by permission, and the heaviest full-permission counts are listed by role.
The recommendation on the 23 administrators is to reduce to two or three named people and move daily work to the functional roles that already exist.
Dependencies and Risk
The cross-object dependency map is the section I'd want on day one. Each automation is listed with what it depends on and what breaks if that thing is removed. The point-of-sale app has hardcoded internal IDs for a location, a subsidiary, a walk-in customer, and a bank account, and inactivating any of them silently breaks sales entry. The journal-entry app has a hardcoded chart of accounts, so new accounts won't appear until the script is edited. Three workflows depend on specific custom fields. Matrix items depend on three custom lists, and list edits ripple into historic transaction lines.
The security table has eight findings with severities. Beyond the credential and the administrators: an admin toolkit RESTlet that can create roles and set permissions has a blank deployment audience, two RESTlets are deployed to all roles, a user event emails employee changes to an external domain, and a webhook subscription points at a public test bin. Each has a recommendation.
Then the upgrade and maintainability risks, including the observation that the local single-page apps depend on pinned CDN libraries and should be tested after each NetSuite release, and a list of debris: test record types, a dead prototype file, duplicate read-only roles, suitelets in testing status.
Data Flow
The core process flows are drawn with document counts at each step, quote-to-cash from 22 opportunities down to 49 deposits, procure-to-pay from 740 purchase orders to 1,002 payments, and record-to-report through the elimination subsidiary. A table of where data originates, how it's transformed, and where it lands covers the point-of-sale app, the CRM apps, external agents through the API layer, webhook dispatch, and the employee-change email.
Wrapping Up
The plaintext credential in this report is the same one the Instance Integrity Diagnostic flagged as still present three weeks after it was first found, and the Sensitive-Data Hazard Scan later in the release is the prompt built to find every field like it.
NetSuite Instance Technical Documentation is in the paid tier of the library. The full sample report from the test account is online, and I covered the whole September release in a separate post.
Run it on day one, before the first surprise. On the test account, the first three surprises were waiting in the executive summary.