Where we are. Where we're going.

SOC-2 Type II report + ISO 27001 alignment: satisfies enterprise procurement requirements

ServiceNow: auto-create incidents, sync resolution status, attach full audit trail

CrowdStrike: device isolation on confirmed threat, compliance gating before access grants

AWS IAM: scoped role assignment, policy attachment, and access key rotation runbooks

Customer-managed encryption keys (BYOK): bring-your-own-KMS for app-level data encryption

Single-tenant deployment option: dedicated Netlify site or BYOC for customers requiring full isolation

99.9% uptime SLA with dedicated support tier for enterprise accounts

BYO-LLM routing: pluggable inference for customers requiring data residency in their own AWS / Azure account

Drag-and-drop workflow canvas with 40+ pre-built action blocks, no YAML required

AI next-step suggestions in canvas based on existing runbook library and ticket history

Real-time SIEM export to Splunk HEC and Microsoft Sentinel

Configurable audit log retention (90d → 7yr) to meet compliance requirements

Pre-execution system-state snapshots: capture-and-rollback engine for reversible actions

PagerDuty alert routing: auto-acknowledge low-severity, escalate high-severity

Google Workspace connector: Gmail, Drive, and Meet provisioning

Independent pen test: commissioned after multi-tenancy + Postgres land; reports available under NDA

Per-tenant customer SSO: each customer's IdP authenticates their own employees against AscendCore (distinct from the admin SSO already live since May 2026)

Multi-tenancy Phase 3: per-tenant Teams JWT audience validation, an enterprise BYOB requirement

Customer billing portal: Stripe-hosted checkout sessions + customer-portal links for plan changes; built on the live Stripe billing foundation shipped May 2026

Public docs site: runbook DSL reference, integration setup guides, API reference

Live status page with connector-level health indicators and incident history

HITL 2.0: per-step approval gates with Slack DM and email, not just per-runbook

Configurable HITL thresholds: auto-approve low-risk, require approval for privileged actions

Runbook YAML editor: inline schema validation and autocomplete

Analytics dashboard live: real deflection rate, resolution time, and labor cost savings

SOC-2 Type I evidence collection begins via Vanta: control mapping, asset inventory, risk register

Strategic runbook #2: customer-driven build from the first design-partner conversation

Hardening polish across the existing runbook library: edge cases, customer-team customization paths

Datadog / PagerDuty alert webhook: auto-ack low severity, escalation cards for critical

Service Account Credential Rotation (RB-016): scans Microsoft Entra ID app registrations for client secrets nearing expiry, rotates the reviewed set on approval, and seals the new value for a single audited dashboard retrieval so it never touches chat or the log; the still-valid old secret is left to lapse for a deliberate cutover. Needs an Entra app credential with Application.ReadWrite.All and the sealing key configured

Dormant Account Review (RB-017) and Unused License Reclamation (RB-024): review cards that surface the longest-inactive Okta accounts or paid Microsoft 365 seats past a configurable threshold, then suspend or reclaim the reviewed set on one approval, re-verifying each target at execution so a recently-active account is refused rather than actioned. RB-024's dormancy tier needs AuditLog.Read.All and Entra ID P1 for sign-in telemetry and says so when that data is unavailable

Contractor Onboarding (RB-022): provisions a time-boxed Okta account and arms its end date so a recurring sweep suspends sign-in automatically and reversibly; if the automatic suspension cannot be scheduled the card says the account is live and needs manual suspension, rather than claiming success

DNS Record Change (RB-027): applies A, AAAA, CNAME, and TXT changes against a configured Cloudflare zone with the exact from-to transition shown; the zone is re-read at execution and a record that drifted since the proposal is refused rather than applied blind

Conditional Access Policy Review (RB-030): reads every Entra ID conditional-access policy, flags common gaps on one card, and records the reviewed findings on the audit chain as approver-attributed access-review evidence. It reads and records only: it creates, changes, or deletes no policy, so remediation stays a deliberate manual step

Suspicious Sign-In Investigation (RB-032): pulls recent sign-in activity for a user into one card and offers an approval-gated containment action (revoke sessions, suspend sign-in, reset MFA); the Okta tier works whenever Okta is connected, the Entra ID tier needs AuditLog.Read.All and P1 (P2 for risk signals), and even a dismissed investigation records the full report on the audit chain

Microsoft Teams Provisioning (RB-034): creates the Microsoft 365 group with a named owner and activates the team on it, retrying directory replication lag; if the group lands but activation needs another pass the card says exactly that. Needs a tenant with Teams and Microsoft 365 licensing and a Graph credential with Group.Create and Team.Create

Jira Project Access Grant (RB-036): resolves the user, project, and role, routes the grant to an approver (project lead where configured), and adds the user to the project role on approval, recorded in the audit chain. Runs against a configured Atlassian credential for the org's instance

Requester-confirm gate (REQUESTER_CONFIRM): every slash command can render an ephemeral Send/Cancel preview of the exact approval card before it posts to the admin channel, so a mis-resolved target is caught by the requester, not the approver. The previewed card is stored server-side and posted verbatim on Send, so nothing about the target is tamperable client-side

Asynchronous approval acknowledgement (ASYNC_APPROVAL_ACK): the Slack handler acknowledges inside Slack's three-second window and finalizes the runbook in the background, removing the 'app isn't responding' warning and interaction retries on runbooks that take longer than three seconds

Atomic approval claim: the claim path is now a single Neon INSERT ... ON CONFLICT, so concurrent approvals and webhook retries resolve to exactly one execution

Microsoft Teams natural language extended to multi-argument runbooks (group membership, SSO assignment, privilege elevation, software decommission) through a parameter-carrying propose-confirm card

Unit-test suite grows to 1,387 (Vitest), up from 672 at the close of Phase 2; production deploys stay gated on the full suite passing

Compromised Account Response (RB-018): one approval revokes every active session, invalidates the password, resets MFA factors, and revokes the Microsoft Entra ID counterpart's sessions; reports the containment incomplete if any step fails

Temporary Privilege Elevation (RB-014): time-boxed membership in a privileged group with automatic removal at expiry by a recurring sweep, recorded as a system-actor audit event; refuses standing members so a grant can never become a delayed revocation

Distribution List Creation (RB-023): create a mail-enabled Microsoft 365 group and seed its members, with an execute-time name re-check that refuses same-named duplicates

Slack Channel Provisioning (RB-035): create a channel, set its purpose, and invite the requester, leaving any existing channel untouched

Four new audit verb namespaces (account_compromise, privilege_elevation, dl_creation, slack_channel) for clean compliance-evidence separation, including a dedicated system-actor lane for automatic expiry events

Device Enrollment Assignment (RB-021): approve a user into the Intune enrollment group from Slack or Teams; existing managed devices reported for context

Guest Account Cleanup (RB-019): approval-gated removal of external guest accounts with an execute-time safety gate that refuses member accounts; 30-day restorable

SSO App Assignment (RB-015): direct Okta user-to-app grant with exact-label resolution at execution and idempotent re-runs

Three new audit verb namespaces (device_enrollment, guest_cleanup, sso_app) for clean compliance-evidence separation

RB-004 VPN Access Grant: Slack + Teams approval flow → Entra security group add → optional Intune device sync (per-device, isolated failures); 19 unit tests

RB-010 Software Decommission: Slack + Teams approval flow → M365 license revoke + seat-pool delta + Intune device-discovery audit trail; 23 unit tests

RB-012 Confluence Space Provisioning: Slack + Teams approval flow → propose-time key-collision detection → Atlassian Confluence Cloud REST API v2 create; 25 unit tests

OIDC SSO admin login (Microsoft Entra + Okta): NextAuth v5 provider integration, email-allowlist gating, env-var-configured per deployment, fully additive to existing credentials path

Mandatory-SSO toggle (ADMIN_REQUIRE_SSO): when enabled, password login is server-side disabled and the login UI hides the credentials form. IdP becomes the sole admin sign-in path, matching the procurement-grade pattern used by enterprise SaaS for MFA delegation

Stripe billing foundation: customer + subscription tables in Postgres, webhook receiver at /api/webhooks/stripe with signature verification, plan-tier resolution from price IDs, enforcement primitives (requirePlan() + getEffectiveRateLimit())

Plan-tier enforcement: graduated API rate limits per tier (free 60/min, pro 600/min, enterprise 6000/min); admin-set per-key overrides honored verbatim; backward-compat invariant tested (free-tier behavior IDENTICAL to before)

Microsoft Intune integration foundation: shared Graph token module + Intune client (device configurations, managed devices, mobile apps, sync trigger); reuses existing Entra app registration with extra Graph permissions

Atlassian Confluence Cloud client: env-var fallback to JIRA_* for shared-Atlassian-tenant deployments, v2 API for space lookup + create

All 13 runbook /runbooks detail pages now show 'live' status (was 10 live + 3 templates at start of Phase 2)

Drizzle migration 0004 applied to production Neon: stripe_customers + stripe_subscriptions tables (caught up missed migration 0003 for webhook_subscriptions in same operation)

672 unit tests passing (was 493 at start of Phase 2; +179 across the 8 sessions)

Every Phase 2 change purely additive or 100% backward-compatible, with zero regression in existing functionality

Group membership runbook (RB-013): Entra security group add/remove with idempotent execution and full HITL parity in Slack and Teams

New employee provisioning enhanced: optional group assignments at propose time, deferred when user not yet in Entra

Public /runbooks library: 13 documented runbooks with SEO-optimized detail pages and YAML previews

SHA-256 hash-chain audit library: canonical JSON serialization, chain verification, CSV export, 98 unit tests

Audit chain handler wiring: every Slack interactive + Teams invoke approve/deny path calls logRunbookOutcome() with graceful no-op when DB unavailable

Neon Postgres attached: tamper-evident audit chain live in production (US East 2), single-column hash markers viewable in /dashboard/audit

/dashboard/audit live chain reader: paginated load-more, hash-prefix column for verification, demo-aware (fictitious Acme rows for prospect demos)

Multi-tenancy Phase 1+2: org-scoped credential vaults via Zod-validated schema, secret-ref resolution (env: / doppler:), resolvers wired into Slack/Teams/Okta/Entra handlers

Dual-mode dashboard security: real owner data vs public demo data on identical URLs, 4-layer enforcement (auth, middleware, client header, API guard)

Trust Center / /security page: implementation-accurate Live / In Progress / Roadmap split with sub-processor list and CISO FAQ

Idle-timeout (5 min, server-enforced) + closed-tab session termination, for SOC-2 CC6.1 alignment

Read-side RBAC isolation: demo / non-owner sessions never see real production telemetry

Per-IP rate limiting + idempotent action handling: no double-execution under retry, no abuse via public endpoints

AscendCore, Inc. C-Corp filed (Stripe Atlas, May 2026): forward-looking entity references in /privacy and /dpa now have entity backing

Datadog ↔ AscendCore integration live in production: webhook receiver + monitor mute API (us5 region)

Vitest infrastructure: 305 unit tests across hash-chain, multi-tenancy, classifier, runbooks, audit, format helpers, parser edge cases

Entra findUser() mail/proxyAddresses fallback: resolves users by email alias when UPN differs (B2B Member accounts, +addressing). Discovered via own smoke testing.

Slack/Teams group-name parser strips surrounding quotes: `/group-add user@x.com "My Group"` now works as users naturally type it

MFA reset (Okta): intent classified via Claude Haiku, HITL-gated, factor cleared and re-enrollment sent on approval

Password reset (Okta): admin approve/deny from Slack, Teams, or dashboard, with an Okta temp password set on approval

Account unlock (Entra ID): Graph API enableAccount call, resolves in under 90 seconds end-to-end

Account offboarding (Okta): user deactivation + group removal, HITL-gated with full audit trail

Microsoft Teams bot: registered in Azure (Bot Framework), JWT-verified, Adaptive Card HITL with approve/deny

All four automations available from Slack slash commands and Teams bot chat, with an identical approval flow in both

Source tracking: every request tagged as 'slack' or 'teams' through the full pipeline, visible in dashboard and audit log

Admin dashboard: live approval queue with confidence scoring, completed history, 5-scenario interactive walkthrough

Guided onboarding wizards: step-by-step credential setup for Okta, Entra ID, M365, Teams, Jira, and Duo Security

Lead capture and demo access flow: prospects get dashboard access in under 5 minutes

Claude Haiku classifier for identity requests; skips intent detection for plain email inputs

Teams Adaptive Card submit routing: fixed Action.Submit to route through handleInvoke, not handleMessage

Serverless function lifecycle extended via next/server after() to keep async Slack and Teams work alive post-response