Enterprise Readiness Assessment | Bootspring Docs

The Enterprise Readiness workflow helps you evaluate your product's readiness for enterprise customers and guides you through implementing the necessary features.

Overview#

Property	Value
Phases	4
Tier	Business
Typical Duration	4-8 weeks
Best For	B2B SaaS, enterprise sales preparation

Why Enterprise Readiness Matters#

Enterprise customers have specific requirements that differ significantly from SMB or consumer products:

Security: Strict compliance requirements (SOC 2, GDPR, HIPAA)
Control: Need for admin oversight and policy enforcement
Integration: Must fit into existing IT infrastructure
Support: Expect dedicated support and SLAs

Without these features, you'll lose deals to competitors or face lengthy procurement delays.

Enterprise Feature Checklist#

Must-Have Features#

Feature	Priority	Description
SSO/SAML	Critical	Single Sign-On integration
RBAC	Critical	Role-based access control
Audit Logging	Critical	Track all user actions
Admin Console	High	Organization management
API Access	High	Programmatic access with tokens
Data Export	High	Full data portability

Nice-to-Have Features#

Feature	Priority	Description
SCIM Provisioning	Medium	Automated user management
Custom Domains	Medium	White-label capability
Data Residency	Medium	Region-specific data storage
Custom Contracts	Low	Flexible legal terms
On-Premise Option	Low	Self-hosted deployment

Phases#

Phase 1: Assessment (3-5 days)#

Agents: architecture-expert, security-expert

Evaluate your current state against enterprise requirements.

Tasks:

Audit current authentication system
Review existing permission model
Assess logging and monitoring coverage
Identify compliance gaps
Create prioritized implementation roadmap

Assessment Framework:

┌─────────────────────────────────────────────────────────────┐
│                   ENTERPRISE READINESS SCORE                │
├─────────────────────────────────────────────────────────────┤
│ Authentication     [████████░░] 80%  │ SSO needed         │
│ Authorization      [██████░░░░] 60%  │ RBAC incomplete    │
│ Audit & Logging    [████░░░░░░] 40%  │ Major gaps         │
│ Admin Controls     [██░░░░░░░░] 20%  │ Not started        │
│ API & Integrations [██████████] 100% │ Complete           │
│ Data Management    [██████░░░░] 60%  │ Export needed      │
├─────────────────────────────────────────────────────────────┤
│ Overall Score: 60% (Not Enterprise Ready)                   │
└─────────────────────────────────────────────────────────────┘

Phase 2: SSO Implementation (1-2 weeks)#

Agents: backend-expert, security-expert

Implement SAML-based Single Sign-On for enterprise identity providers.

Tasks:

Choose SSO library (Auth0, WorkOS, or custom)
Implement SAML 2.0 support
Add identity provider configuration UI
Handle JIT (Just-In-Time) provisioning
Test with common IdPs (Okta, Azure AD, OneLogin)

SSO Implementation Example:

// lib/auth/sso.ts
import { SamlConfig } from 'saml2-js';

export interface SSOConnection {
  id: string;
  organizationId: string;
  provider: 'okta' | 'azure' | 'onelogin' | 'custom';
  metadataUrl?: string;
  certificate: string;
  entryPoint: string;
  issuer: string;
}

export async function initiateSSOLogin(
  organizationSlug: string,
  redirectUrl: string
): Promise<string> {
  const connection = await prisma.ssoConnection.findFirst({
    where: { organization: { slug: organizationSlug } }
  });

  if (!connection) {
    throw new Error('SSO not configured for this organization');
  }

  const samlRequest = createSAMLRequest({
    issuer: process.env.SAML_ISSUER,
    destination: connection.entryPoint,
    assertionConsumerServiceUrl: `${process.env.APP_URL}/api/auth/sso/callback`,
    state: { redirectUrl, orgId: connection.organizationId }
  });

  return connection.entryPoint + '?SAMLRequest=' + encodeURIComponent(samlRequest);
}

export async function handleSSOCallback(
  samlResponse: string
): Promise<{ user: User; session: Session }> {
  const assertion = await validateSAMLResponse(samlResponse);

  // Extract user attributes
  const email = assertion.getAttribute('email');
  const firstName = assertion.getAttribute('firstName');
  const lastName = assertion.getAttribute('lastName');

  // JIT provisioning - create user if doesn't exist
  const user = await prisma.user.upsert({
    where: { email },
    update: { firstName, lastName, lastLoginAt: new Date() },
    create: {
      email,
      firstName,
      lastName,
      organizationId: assertion.orgId,
      authMethod: 'sso'
    }
  });

  const session = await createSession(user.id);
  return { user, session };
}

Phase 3: RBAC Implementation (1-2 weeks)#

Agents: backend-expert, database-expert

Build a flexible role-based access control system.

Tasks:

Design permission model (roles, permissions, resources)
Create database schema
Implement permission checking middleware
Build role management UI
Set up default roles (Admin, Member, Viewer)

RBAC Database Schema:

// prisma/schema.prisma

model Organization {
  id        String   @id @default(cuid())
  name      String
  slug      String   @unique
  users     OrganizationUser[]
  roles     Role[]
  ssoConfig SSOConnection?
}

model Role {
  id             String       @id @default(cuid())
  name           String
  description    String?
  organizationId String
  organization   Organization @relation(fields: [organizationId], references: [id])
  permissions    Permission[]
  users          OrganizationUser[]
  isSystem       Boolean      @default(false)

  @@unique([organizationId, name])
}

model Permission {
  id       String @id @default(cuid())
  resource String
  action   String // create, read, update, delete, manage
  roles    Role[]

  @@unique([resource, action])
}

model OrganizationUser {
  id             String       @id @default(cuid())
  userId         String
  organizationId String
  roleId         String
  user           User         @relation(fields: [userId], references: [id])
  organization   Organization @relation(fields: [organizationId], references: [id])
  role           Role         @relation(fields: [roleId], references: [id])

  @@unique([userId, organizationId])
}

Permission Check Implementation:

// lib/auth/permissions.ts

export type Resource =
  | 'projects'
  | 'members'
  | 'settings'
  | 'billing'
  | 'api_keys'
  | 'audit_logs';

export type Action = 'create' | 'read' | 'update' | 'delete' | 'manage';

export async function hasPermission(
  userId: string,
  organizationId: string,
  resource: Resource,
  action: Action
): Promise<boolean> {
  const membership = await prisma.organizationUser.findUnique({
    where: {
      userId_organizationId: { userId, organizationId }
    },
    include: {
      role: {
        include: { permissions: true }
      }
    }
  });

  if (!membership) return false;

  return membership.role.permissions.some(
    p => p.resource === resource && (p.action === action || p.action === 'manage')
  );
}

// Middleware for API routes
export function requirePermission(resource: Resource, action: Action) {
  return async (req: NextRequest) => {
    const session = await getSession(req);
    if (!session) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const orgId = req.headers.get('x-organization-id');
    if (!orgId) {
      return NextResponse.json({ error: 'Organization required' }, { status: 400 });
    }

    const allowed = await hasPermission(session.userId, orgId, resource, action);
    if (!allowed) {
      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
    }

    return null; // Continue to handler
  };
}

Phase 4: Audit Logging (1 week)#

Agents: backend-expert, database-expert, security-expert

Implement comprehensive audit logging for compliance and security.

Tasks:

Design audit log schema
Create logging middleware
Implement log retention policies
Build audit log viewer UI
Add export capabilities

Audit Log Implementation:

// lib/audit/logger.ts

export interface AuditEvent {
  actor: {
    userId: string;
    email: string;
    ip?: string;
    userAgent?: string;
  };
  action: string;
  resource: {
    type: string;
    id: string;
    name?: string;
  };
  organizationId: string;
  metadata?: Record<string, unknown>;
  timestamp: Date;
}

export async function logAuditEvent(event: AuditEvent): Promise<void> {
  await prisma.auditLog.create({
    data: {
      actorId: event.actor.userId,
      actorEmail: event.actor.email,
      actorIp: event.actor.ip,
      actorUserAgent: event.actor.userAgent,
      action: event.action,
      resourceType: event.resource.type,
      resourceId: event.resource.id,
      resourceName: event.resource.name,
      organizationId: event.organizationId,
      metadata: event.metadata,
      timestamp: event.timestamp
    }
  });
}

// Higher-order function for automatic audit logging
export function withAuditLog<T>(
  action: string,
  resourceType: string,
  handler: (req: NextRequest, context: any) => Promise<T>
) {
  return async (req: NextRequest, context: any): Promise<T> => {
    const session = await getSession(req);
    const startTime = Date.now();

    try {
      const result = await handler(req, context);

      await logAuditEvent({
        actor: {
          userId: session.userId,
          email: session.email,
          ip: req.headers.get('x-forwarded-for') || req.ip,
          userAgent: req.headers.get('user-agent')
        },
        action,
        resource: {
          type: resourceType,
          id: context.params?.id || 'unknown',
        },
        organizationId: session.organizationId,
        metadata: {
          duration: Date.now() - startTime,
          success: true
        },
        timestamp: new Date()
      });

      return result;
    } catch (error) {
      await logAuditEvent({
        actor: {
          userId: session?.userId || 'anonymous',
          email: session?.email || 'unknown',
          ip: req.headers.get('x-forwarded-for') || req.ip,
          userAgent: req.headers.get('user-agent')
        },
        action,
        resource: {
          type: resourceType,
          id: context.params?.id || 'unknown',
        },
        organizationId: session?.organizationId || 'unknown',
        metadata: {
          duration: Date.now() - startTime,
          success: false,
          error: error.message
        },
        timestamp: new Date()
      });

      throw error;
    }
  };
}

Starting the Workflow#

# Start the enterprise readiness assessment
bootspring workflow start enterprise-readiness

# Check current status
bootspring workflow status

# Run specific phase
bootspring workflow run enterprise-readiness --phase sso

# Generate readiness report
bootspring enterprise readiness-report

Deliverables#

A successful Enterprise Readiness workflow produces:

Enterprise readiness score and gap analysis
SSO integration with SAML 2.0 support
RBAC system with customizable roles
Comprehensive audit logging
Admin console for organization management
API documentation for enterprise integrations
Security compliance documentation

Best Practices#

Start with assessment - Know your gaps before building
Prioritize based on deals - Build what customers are asking for
Use proven libraries - Don't roll your own crypto or auth
Test with real IdPs - Set up test accounts with Okta, Azure AD
Document everything - Enterprise procurement needs documentation
Plan for scale - Audit logs grow fast, plan retention

Common Pitfalls#

Building SSO without customer validation
Over-engineering RBAC before understanding needs
Insufficient audit log coverage
Poor admin UI leading to support burden
Ignoring data residency requirements