Portfolio Architecture · Feature Ownership Matrix

One platform. Two products. Security + Ops, with Manage and My TATER included.

The TATER suite is bigger than any single product. This page is the canonical reference for which app owns which feature, which modules are shared across the suite, and how data flows between them. Use it to answer “which app do I open for X?” and to understand why the platform feels coherent even as it grows.

All features Product brief

Feature ownership matrix

Every major capability in the suite, mapped to the app that owns its primary UI. Shared modules are surfaced in multiple apps but live in one data store with one audit trail.

Security — Compliance & Audit
Ops — Service & Workflow
Manage — Tenant Admin & Telemetry
My TATER — Personal Dashboard
Shared — Surfaced in multiple apps
Capability Primary owner Notes
Compliance & Security
Compliance scans (M365 & endpoint)
CIS, CISA SCuBA, DISA STIG, NIST 800-53 evaluation
Security5,000+ controls, agent + runbook scanners
Controls catalog & framework manager
Unified V2 engine with threshold logic
SecurityDefault + per-org overlay
Risk register, exceptions, audits, BCP/DR
14 GRC modules with full workflow
SecurityLinked to controls bidirectionally
POAM, RMF tracker, SSP generator
Federal/DoD ATO pipeline
SecurityOMB A-130 + eMASS export, OSCAL JSON
Endpoint security & vulnerability data
MDE, CISA KEV, Intune compliance
SecurityPer-device CVE mapping
Identity Security / ITDR
Risky users, sign-in anomalies, conditional access posture
SecurityGraph API + risk policy engine
Remediation runbooks
67 M365 + 1,379 endpoint hardening scripts
SecurityPS7 + PS5.1 dual-runtime
AI Compliance Analyst & Evidence Agent
Agentic Claude with 111+ tools
SecurityBYOK or platform-managed
Service Management & Workflow
Tasks & help-desk ticketing
Categories, priorities, custom statuses, SLA tracking
OpsReplaces PowerApps Tasker
Workflow automation
Template-driven multi-step task spawning
OpsRole placeholders, dependency unlocking
Meeting records & transcripts
Bot + manual + Outlook calendar capture
OpsSensitivity-gated, MCP-first extraction
Business documentation library
SOPs, processes, role descriptions
OpsAI-drafted with provenance trails
Public intake portal (request.html)
Token-gated email-to-ticket
OpsPower Automate friendly
Ops scripts & scheduled runbooks
Device + cloud script library with cron + drift detection
OpsAuto-creates tasks on drift
Knowledge browse (Policies, Docs, Wiki)
Read-only views; edits deep-link to Security
OpsShared substrate
Tenant Admin & Telemetry
Organizations, users, subscriptions
Multi-tenant fleet management
ManageSuperAdmin only
MSP licensing & tier system
T1 Monitor / T2 Operate / T3 Manage
ManageMspRelationships table
Activity log & usage analytics
Cross-channel audit (web / MCP / Copilot / agent / cron)
Managevia field attribution
Integrations marketplace
ADO, Jira, ServiceNow, SIEM, webhook
ManagePer-org encrypted config
Endpoint fleet (devices, agents, vulns)
Go agent v2.1.x deployment + version control
ManageCross-platform binaries
Remote command channel & screens
Per-device PS/bash execution, multi-screen viewer
ManageWebRTC + REST queue
Meeting bot configuration
Per-tenant consent & purpose routing
ManageSA-only UI
MCP feedback & tool policies
Agent telemetry & per-org tool gating
ManageSuperAdmin governance
Personal Dashboard
My dashboard & favorites
Per-user starred entities & activity summary
My TATERSame favorites across all apps
My tasks & mentions feed
Assigned tasks + @mentions across the platform
My TATERTopbar unread badge
Community feed & leaderboard
Org-wide activity stream + gamified rankings
My TATERXP from real compliance work
Achievements (40+ badges)
Leveled milestones for sustained effort
My TATER14 governance-creator badges
Shared modules (one data substrate, multiple surfaces)
Policies library
11 templates, draft → approve → sign workflow
SharedEdit in Security, browse in Ops
TATERpedia (platform wiki)
Generic playbooks & methodology pages
SharedRequired summary field
Configuration Documentation
Per-org living docs (network, infra, dependencies)
SharedAI-maintained via MCP
Vendor / TPRM
Risk scoring, questionnaires, contracts
SharedAuto-creates audit findings on low score
Calendar (iCal + in-app)
18 event sources unified
SharedToken-gated public feed
Change Control & Trust Center
Internal approvals + external posture
SharedLive trust-center data
MCP server (111+ tools)
Same surface for Claude, Copilot, ChatGPT
SharedHTTP + stdio parity enforced

How data flows across the suite

The four surfaces are not separate products bolted together — they are one platform. They share identity, database, audit trail, and design tokens. Three rules govern the architecture.

Rule 1

One identity, one session

Sign in once at login.html. The MSAL session in localStorage is honored by every app domain (security, ops, manage, my). Role hierarchy — SuperAdmin, ServiceProvider, OrgAdmin, Auditor, Viewer — is enforced uniformly by the API regardless of which app issued the call.

Rule 2

One data substrate

All four surfaces read and write to the same Cosmos DB (cosmos-tater-sec) partitioned by tenantId. A risk created via MCP from Copilot, an exception approved via TATER Security, and a task spawned in TATER Ops all flow through the same containers with the same partition strategy and the same audit log.

Rule 3

One audit trail with channel attribution

Every mutating call writes to the AuditLog with a via field: web, mcp, copilot, claude, agent, api, cron, or ado-webhook. Manage → Activity Log filters by channel so SuperAdmins can see exactly which actions came from autonomous agents vs. human operators.

Why this architecture

A single monolithic app would have collapsed under the surface area. Four split-by-audience apps with one substrate gets us focused UX per persona without the data fragmentation that kills cross-product workflows.

Audience

Right tool for the right role

Compliance officers don't need to see device remote-command UI. Help-desk staff don't need the POAM module. SuperAdmins shouldn't have to dig past employee leaderboards to manage subscriptions. Per-app surfaces respect attention; the shared substrate respects continuity.

Operations

Closed-loop documentation

The Three-Doc Rule (Ops task + ConfigDoc + TATERpedia page) means every troubleshooting session leaves behind a durable lifecycle record AND specific org state AND a generic methodology page. MCP agents enforce this automatically. Knowledge doesn't evaporate.

Cost model

MCP-first, no internal LLM

TATER runs no server-side LLM. All AI extraction (meeting transcripts, evidence collection, policy drafting) happens in the user's own Claude / Copilot / ChatGPT session via MCP. TATER's cost is storage + tool routing. The platform scales with usage without per-tenant LLM token bills.