Skip to content

Current availability & roadmap

What is shipping, what is being worked on next, and what is deliberately later. Dates are when the state was last reviewed, not delivery commitments.

Last reviewed: 6 August 2026.

Availability lives on the Control Plane page

The feature-by-feature table — API route, UI page, and status — is on Control Plane. This page is about sequencing: what comes after what, and why.

Available today

Organization-scoped policy publication, audit ingest and query, fleet heartbeats and registration, the provider/capability catalog, API keys, and email/password sign-in — through both the API and the enterprise UI. Details and exact routes: Control Plane → What works today.

Next

Item Why it is next What it changes
SSO / OIDC Email and password is the single biggest gap between this and what an enterprise identity team expects An identity provider becomes the source of sign-in; the Settings page stops reporting OIDC as planned
Real organization onboarding Organizations can be listed but not created through the product A second organization becomes a supported operation rather than a manual step
RBAC enforcement on routes Roles are carried in the token but nothing refuses a request because of one — a role today is a label, not a boundary /api/v1 routes reject calls the role does not permit, and the claim becomes trustworthy
REQUIRE_AUTH=true for non-demo deployments The shared deployment is open on purpose; a deployment holding real data must not be /api/v1 requires a JWT or API key; /metadata/authentication reports it
Durable storage when data must survive The shared deployment writes SQLite inside the container, so data resets with each revision Postgres (DATABASE_DRIVER=postgres) for any deployment whose history matters

Later

Item Why it waits
AI Governance as its own surface AI-driven operations are already governed by the same policy and audit path as human and CI ones. A separate product area only earns its place once it does something that path cannot
Richer multi-org experience An org switcher and cross-org views are worth building after organizations can actually be created — not before
Login page polish (dashboard preview and similar) The entrance is thin on purpose. Substance belongs in these docs; chrome ranks below functionality

Not planned

Item Why not
Remote policy evaluation Decisions stay local. runtime portal sync writes a policy file and stops — a Control Plane outage must never change what a command is allowed to do
A second execution path Nothing executes through the Control Plane. The only portal verbs are portal status and portal sync
Making the Control Plane required The runtime works standalone, and that is a property to defend, not a phase to grow out of

See also