# Step 12 -- Multi-Customer Delivery (Later)

## Goal

Support mixed customer deployment restrictions without changing the
reusable baseline.

## Likely Mature Pattern

``` text
sentinel-platform
      |
      +--> versioned modules/releases
              |
       +------+------+------+
       |             |      |
 Customer A     Customer B  Customer C
 deployment      deployment  manual
```

Potentially use customer-specific repos for parameters, exceptions,
identity, approval, and deployment workflow.

## Important Separation

Central platform owns reusable implementation and standards.
Customer-specific locations own environment values, exceptions,
deployment identity, and local workflow.

## Possible Future Distribution

-   Git release package
-   customer GitHub
-   customer Azure DevOps
-   MSSP GitHub Actions
-   private Bicep registry/ACR
-   manual Bicep/ARM handoff

## Security

Avoid one identity with access to every customer Azure environment.
Prefer customer-scoped identities and workload federation.

## Decisions

Repo-per-customer vs other isolation, platform version pinning, upgrade
process, identity ownership, approval ownership, and customer code
ownership.