Roadmap
Implemented, building, deferred, won't-do.
Updated alongside the changelog and known limitations. Implementation does not by itself establish customer-release readiness. Items are not commitments to any specific customer or date.
| Area | Item | Status | Note |
|---|---|---|---|
| Risk register | Top-down enterprise risk register with appetite, KRIs, residual scoring | Implemented | |
| Compass | Assistive triage + scenario draft + board-pack narrative; HITL on every suggestion | Implemented | |
| Audit chain | SHA-256 hash chain shared with RegAlign®, auditor-verifiable without an account | Implemented | |
| CSV bridge | RegAlign ↔ RiskAlign v1 bridge (findings, controls, obligations round-trip) | Implemented | |
| Golden Path | Operator presenter run-sheet through every register | Implemented | |
| Public surface | Compass methodology, Known Limitations, Security Roadmap, AI Use Disclosure, Changelog, Roadmap | Implemented | |
| Security | DEV_OPEN cutover — mandatory MFA, tenant scoping enforced, dev routes gated | Building now | Current release evidence and operating controls remain the readiness boundary. |
| Operator tools | Board-pack PDF polish, signed-link sharing, regulator token access | Building now | |
| Bridge UI | In-app one-click RegAlign ↔ RiskAlign bridge (currently operator-only) | Next | No committed release date. |
| Public status | Live /status page wired to status_probes | Next | |
| Group view | Multi-entity rollups for group structures | Next | |
| Compass telemetry | Aggregate ratification rates published from /api/public/compass-methodology | Next | Requires a sufficient evidence base before publication. |
| SSO / SAML | Customer-configurable SAML 2.0 | Later | Lands at first enterprise procurement requirement. |
| Public REST API | Documented customer-facing API | Later | |
| SOC 2 Type I | Observation window opened | Later | Trigger: Series A close or second enterprise customer. |
| On-premise | Customer-managed deployment | Won't do | |
| Card payments | Stripe/card rails | Won't do | Regulated buyers use invoice + bank transfer. |
| Generic GRC drift | Repositioning as generic GRC platform | Won't do | Loses the top-down enterprise-risk positioning and the product portfolio. |