# CUT Enterprise — readiness checklist

For major-label / large-publisher conversations **after** 2–3 paid indie pilots prove the loop.

## Shipped in product (v23 B2B pass)

| Capability | Where |
|------------|--------|
| Tenant-scoped pilot metrics | `label_tenant_metrics()` RPC, `GET /api/label/metrics`, Label console Pilot tab |
| Webhooks | `tenant_webhooks` table, `GET/POST/DELETE /api/label/webhooks`, dispatch on line/pitch/placement |
| Audit log | `audit_log` table; label API writes on member invite, brand update, key mint |
| Billing hook | `stripe-webhook.mjs` → `tenants.status = active` on `checkout.session.completed` |
| Plan/status gates | Paused/churned blocks tenant config + label API; trial fully works |
| Custom domain | `tenants.settings.customDomain` — document for Netlify/DNS; manual CNAME today |
| Placement durability | `schema-h-placement-durability.sql` — cuts are immutable |

## Not shipped (P2 — build when a major asks)

| Requirement | Notes |
|-------------|-------|
| **SSO / SAML** | Supabase SAML or external IdP; map `tenant_id` + `member_role` at login |
| **SCIM provisioning** | Seat sync from Okta/Azure AD |
| **SOC2 / DPA** | Legal/process, not code |
| **Multi-imprint org** | Parent tenant → child slugs; schema is 1 tenant = 1 slug today |
| **ISRC / work IDs** | Columns on `songs`; API fields when catalog sync is scoped |

## Custom domain (manual today)

1. Label sets `customDomain: "room.label.com"` in console settings (stored in `tenants.settings`)
2. Operator adds Netlify domain alias → same deploy
3. Tenant resolution in `cut-tenant.js` already checks subdomain; extend to read hostname → slug map via `/api/tenant?host=`

## SSO integration sketch

1. Enable Supabase SAML for enterprise tenant
2. On first login, `handle_new_user` stamps `tenant_id` from IdP attribute
3. Guest/seat gate unchanged (`schema-e-studios.sql`)

## Sales packet

- [SECURITY-AUDIT.md](SECURITY-AUDIT.md)
- [cut-for-labels.md](cut-for-labels.md)
- [cut-pilot.md](cut-pilot.md) + one case vignette
- Live demo: brand morph + consent handshake + embed slot on [labels.html](labels.html)