MSSP fit: honest today, getting better

• Per-customer ADMIN access. An MSSP analyst can be added as ADMIN on each customer's tenant and operate normally within that tenant.
• Per-customer integrations. Each customer's webhooks, Slack channels, and exports work independently. One Slack channel per customer, or one shared channel filtered customer-side.
• Tenant isolation. Four independent layers — session, BFF, Go API, database. Your customer cohort's data does not commingle.
• Audit isolation. Every action an MSSP analyst takes is logged in the customer's tenant with the analyst's email. Your customer can audit you.

Until the MSSP-specific aggregation features ship, MSSPs running 1–5 customers can use Tricognita with these patterns:

• Browser tab per customer. Tedious past ~10 customers but workable for small cohorts.
• SIEM as unified queue. Configure every customer's Tricognita to push webhooks to your shared SIEM with a customer-id tag. Your SIEM becomes the unified analyst surface.
• SIEM NDJSON pull. Each customer's /api/admin/exports/siem.ndjson can be polled from a central aggregator. Customer id is in every event envelope.

• No unified multi-customer queue. Today you switch tenants to see each customer's queue. There's no "all my customers' criticals" view yet.
• No cross-tenant search. "Which customers are affected by CVE-X?" requires logging into each separately.
• No first-class MSSP organization. The MSSP itself isn't an entity above the tenant layer — yet.
• No multi-customer bulk evidence. End-of-month reports are per-customer, not "Q1 evidence for all 12 of my customers in one zip."

The MSSP-specific Phase 18+ build, in priority order:

1. 1. Cross-customer unified queue — priority-sorted across every customer you're authorized for.
2. 2. Customer roster — tabular health summary across your book.
3. 3. Cross-tenant search — search across all your customers.
4. 4. SLA aggregation — your book-level SLA compliance dashboard.
5. 5. First-class MSSP entity — MSSP organization above tenants with roster, analysts, billing.

Timeline is not committed publicly. Design partners get earlier access to the roadmap and can shape priority.