Failure PatternDecision layer

Why Agencies Fail With KeyKosh by Treating It as a SaaS

Symptom: Client onboarding stalls because the agency waits for KeyKosh support tickets instead of handling Docker and PostgreSQL deployment itself. Root cause: KeyKosh's one-time perpetual license (Pro $699, Pro+ $2999) misleads agencies into assuming vendor support and patching are included, but self-hosting means the agency owns infrastructure upkeep.

By InnovaAI ResearchPublished

IAM Access Control
Symptoms
  • •Client onboarding stalls because the agency waits for KeyKosh support tickets instead of handling Docker and PostgreSQL deployment itself.
  • •Agencies discover the Free tier's 2-application limit only after migrating a client with 3+ apps, forcing an unplanned $699 Pro purchase.
  • •Audit log CSV exports in Pro are requested by clients, but the agency never configured role-based access, so every team member sees every secret.
  • •Real-time updates stop working because the agency skipped SSL certificate setup, and clients report stale environment variables.
  • •The agency bills clients a monthly retainer for KeyKosh management, but the one-time license means there is no recurring vendor cost to pass through, confusing margin calculations.
Root Causes
  • •KeyKosh's one-time perpetual license (Pro $699, Pro+ $2999) misleads agencies into assuming vendor support and patching are included, but self-hosting means the agency owns infrastructure upkeep.
  • •The Free tier's hard limits (1 organization, 2 applications, 5 users) are not surfaced during initial demos, so agencies under-scope client needs and hit paywalls mid-delivery.
  • •KeyKosh's per-organization RBAC with least-privilege roles (Developer, Viewer) is only available on Pro, so agencies on Free cannot enforce separation between client teams.
  • •Agencies treat KeyKosh like a cloud SaaS and neglect the prerequisite setup of Docker, PostgreSQL, and SSL, which are documented but not automated.
Fast Fixes
  • •In the KeyKosh admin console, create a separate organization per client and assign Developer or Viewer roles only to relevant team members, ensuring least-privilege access.
  • •Before onboarding any client, audit their application count against the Free tier's 2-app limit and budget for the $699 Pro license if they exceed it.
  • •Enable SSL certificates and verify real-time update delivery by testing a config change in a staging environment, confirming propagation in under 5 seconds.
  • •Export the audit log as CSV weekly and review it for unauthorized access attempts, using the Pro feature to maintain client trust.
Browse the AcademyExplore IAM Access Control

More for IAM Access Control