Forty-eight products, each with its own login, its own user list and its own idea of who is an admin, is not a suite. It is forty-eight tabs.
So the first thing we built was not a product. It was the control plane: one place to sign in, launch any product, manage people and access, read the audit trail and watch a shared pool of AI credits. Every product we ship plugs into it.
Why a control plane first
It sets the contract. When a new product is scaffolded it already knows how to verify a session, who the current user is, where "home" is and how to record that it spent some AI budget. That keeps every product small — none of them carry their own auth, and none of them can drift into a slightly different login screen.
Sign in once. Open anything. The product never sees a password.
How the sign-in works
The control plane issues a signed session cookie for the shared domain. Each product verifies it — in the web layer for pages, in the API for requests — with a shared secret. No product stores credentials; a sign-out at the control plane signs you out everywhere.
No session? You are sent to the control plane with a return address.
Self-service sign-up can be switched on; invites and reset links are built in.
The cookie is set; the product verifies it and knows who you are.
The launcher lists every registered product; the switcher lives in each product's header.
What it manages
Product registry
Every product's name, code, ports and URL — the launcher and the in-product switcher read from it.
People and invites
Users, roles, invitations, password reset, session list and revocation.
Access grants
Who may open which product, granted and revoked with a reason.
Audit
Sign-ins, grants, invites and settings changes, searchable.
Shared AI credits
Agentic products spend model tokens. Rather than every product carrying its own meter, the control plane keeps one credit pool: admins top it up, products debit it through a single API call with the product and user attached, and the ledger shows who spent what, where. A product that would exceed the pool is told so before it runs.
The product template
The control plane also fixed the house stack. Every product is a Go backend (standard-library routing, SQLite, seeded demo data, table-driven tests) and a Next.js 16 / React 19 frontend on shadcn/ui and Tailwind v4, in the same dark-and-gold theme with a light mode. A scaffold copies that starter, renames the module, assigns ports and registers the product — so the first commit of a new product is already signed in.
AccessReviews and AgentTable are live on the control plane today; ApprovalsHub is next. Every product in the catalog will follow.