Where we are. Where we're going.

SOC-2 Type II report + ISO 27001 alignment: satisfies enterprise procurement requirements

ServiceNow: auto-create incidents, sync resolution status, attach full audit trail

CrowdStrike: device isolation on confirmed threat, compliance gating before access grants

AWS IAM: scoped role assignment, policy attachment, and access key rotation runbooks

Customer-managed encryption keys (BYOK): bring-your-own-KMS for app-level data encryption

Single-tenant deployment option: dedicated Netlify site or BYOC for customers requiring full isolation

99.9% uptime SLA with dedicated support tier for enterprise accounts

Independent pen test: third-party assessment, with the report shared under NDA for active procurement conversations once complete

Per-tenant customer SSO: each customer's IdP authenticates their own employees against AscendCore (distinct from the admin SSO live since May 2026)

Multi-tenancy Phase 3: each enterprise tenant can run AscendCore through its own Teams bot registration

BYO-LLM routing: pluggable inference for customers requiring data residency in their own AWS / Azure account

Pre-execution system-state snapshots: capture-and-rollback engine for reversible actions

Customer billing portal: Stripe-hosted checkout sessions and customer-portal links for plan changes

HITL 2.0: per-step approval gates with Slack DM and email, not just per-runbook

Configurable HITL thresholds: auto-approve low-risk, require approval for privileged actions

Docs: runbook authoring guides and a runbook DSL reference

Status page: connector-level health indicators

Runbook YAML editor: inline schema validation and autocomplete

Analytics: deflection rate and labor-cost savings

SOC-2 Type I: enrollment begins once budgeted, followed by a ~90-day audit window and then the report

AI Workflow Builder: a drag-and-drop canvas with pre-built action blocks and AI next-step suggestions, no YAML required

Real-time SIEM export to Splunk HEC and Microsoft Sentinel

Configurable audit log retention (90 days to 7 years) to meet compliance requirements

PagerDuty alert routing: auto-acknowledge low-severity, escalate high-severity

Google Workspace connector: Gmail, Drive, and Meet provisioning

Endpoint Containment and SharePoint Site Provisioning (July 3): Endpoint Containment locks a suspected-compromised user's managed devices and contains their account with one approval; SharePoint Site Provisioning creates a group-backed team site with a named owner

Agent Gateway (July 11): an approval-gated MCP server through which AI agents can propose runbook actions and nothing else. A human approves or denies each proposal, and the request, the decision, and the outcome land on the audit chain

Agent provenance (July 13): the approval card itself shows which agent made the request, not only the thread around it

Runbook Plan (August 12): offboarding requests staged by an agent or the API show a live before-and-after preview on the approval card (account status, the licenses to revoke, the manager to notify), and anything that cannot be read is marked as not previewed rather than guessed

Oversight evidence pack (August 12): one click on the Governance page compiles live audit-chain events into a CSV and a PDF showing what was proposed, who decided, and what ran, mapped to the SOC 2 controls the chain provides evidence for. A 30, 90, or 180-day window followed on September 3

Self-serve sign-up (August 17): a work email opens a 30-day sandbox pilot in your own workspace with no credit card, and Slack connects through Add to Slack

API reference (May 9): the OpenAPI reference for the Customer API at /api-docs, shown in full to signed-in customers and partners

Setup guides at /docs: customer onboarding and sandbox mode (May), ServiceNow, Jira, and Freshservice (June), and the Agent Gateway (July)

Status page (May 14): status.ascendcore.ai reports uptime for each monitored service, with 90-day history and past incidents

Customer Portal analytics (June 2): 30-day request volume, approval outcomes, average time from request to completion, and breakdowns by request type and channel, computed from the organization's own requests with no sample data

Service Account Credential Rotation (RB-016): scans Microsoft Entra ID app registrations for client secrets nearing expiry, rotates the reviewed set on approval, and seals the new value for a single audited dashboard retrieval so it never touches chat or the log; the still-valid old secret is left to lapse for a deliberate cutover. Needs an Entra app credential with the permission listed in the connect flow

Dormant Account Review (RB-017) and Unused License Reclamation (RB-024): review cards that surface the longest-inactive Okta accounts or paid Microsoft 365 seats past a configurable threshold, then suspend or reclaim the reviewed set on one approval, re-verifying each target at execution so a recently-active account is refused rather than actioned. RB-024's dormancy tier needs sign-in data (Entra ID P1) and says so when that data is unavailable

Contractor Onboarding (RB-022): provisions a time-boxed Okta account and arms its end date so a recurring sweep suspends sign-in automatically and reversibly; if the automatic suspension cannot be scheduled the card says the account is live and needs manual suspension, rather than claiming success

DNS Record Change (RB-027): applies A, AAAA, CNAME, and TXT changes against a configured Cloudflare zone with the exact from-to transition shown; the zone is re-read at execution and a record that drifted since the proposal is refused rather than applied blind

Conditional Access Policy Review (RB-030): reads every Entra ID conditional-access policy, flags common gaps on one card, and records the reviewed findings on the audit chain as approver-attributed access-review evidence. It reads and records only: it creates, changes, or deletes no policy, so remediation stays a deliberate manual step

Suspicious Sign-In Investigation (RB-032): pulls recent sign-in activity for a user into one card and offers an approval-gated containment action (revoke sessions, suspend sign-in, reset MFA); the Okta tier works whenever Okta is connected, the Entra ID tier needs sign-in data (P1, or P2 for risk signals), and even a dismissed investigation records the full report on the audit chain

Microsoft Teams Provisioning (RB-034): creates the Microsoft 365 group with a named owner and activates the team on it, retrying directory replication lag; if the group lands but activation needs another pass the card says exactly that. Needs a tenant with Teams and Microsoft 365 licensing and the Microsoft permissions listed in the connect flow

Jira Project Access Grant (RB-036): resolves the user, project, and role, routes the grant to an approver (project lead where configured), and adds the user to the project role on approval, recorded in the audit chain. Runs against a configured Atlassian credential for the org's instance

Requester confirm step: every slash command can render an ephemeral Send/Cancel preview of the exact approval card before it posts to the admin channel, so a mis-resolved target is caught by the requester, not the approver. The card posted on Send is exactly the one previewed

Faster approval acknowledgement in Slack: approvals respond immediately and long-running runbooks finish in the background, removing the 'app isn't responding' warning and interaction retries on runbooks that take longer than three seconds

Exactly-once approvals: concurrent approvals and webhook retries resolve to exactly one execution

Microsoft Teams natural language extended to multi-argument runbooks (group membership, SSO assignment, privilege elevation, software decommission) through a parameter-carrying propose-confirm card

Unit-test suite grows to 1,387 (Vitest), up from 672 at the close of Phase 2; production deploys stay gated on the full suite passing

Compromised Account Response (RB-018): one approval revokes every active session, invalidates the password, resets MFA factors, and revokes the Microsoft Entra ID counterpart's sessions; reports the containment incomplete if any step fails

Temporary Privilege Elevation (RB-014): time-boxed membership in a privileged group with automatic removal at expiry by a recurring sweep, recorded as a system-actor audit event; refuses standing members so a grant can never become a delayed revocation

Distribution List Creation (RB-023): create a mail-enabled Microsoft 365 group and seed its members, with an execute-time name re-check that refuses same-named duplicates

Slack Channel Provisioning (RB-035): create a channel, set its purpose, and invite the requester, leaving any existing channel untouched

Four new audit verb namespaces (account_compromise, privilege_elevation, dl_creation, slack_channel) for clean compliance-evidence separation, including a dedicated system-actor lane for automatic expiry events

Device Enrollment Assignment (RB-021): approve a user into the Intune enrollment group from Slack or Teams; existing managed devices reported for context

Guest Account Cleanup (RB-019): approval-gated removal of external guest accounts with an execute-time safety gate that refuses member accounts; 30-day restorable

SSO App Assignment (RB-015): direct Okta user-to-app grant with exact-label resolution at execution and idempotent re-runs

Three new audit verb namespaces (device_enrollment, guest_cleanup, sso_app) for clean compliance-evidence separation

RB-004 VPN Access Grant: Slack + Teams approval flow → Entra security group add → optional Intune device sync (per-device, isolated failures); 19 unit tests

RB-010 Software Decommission: Slack + Teams approval flow → M365 license revoke + seat-pool delta + Intune device-discovery audit trail; 23 unit tests

RB-012 Confluence Space Provisioning: Slack + Teams approval flow → propose-time key-collision detection → Atlassian Confluence Cloud REST API v2 create; 25 unit tests

OIDC SSO admin login (Microsoft Entra + Okta): sign-in through your identity provider, limited to an approved list of admin emails, alongside the existing sign-in

Mandatory SSO for admins: when enabled, password login is server-side disabled and the login UI hides the credentials form. IdP becomes the sole admin sign-in path, matching the procurement-grade pattern used by enterprise SaaS for MFA delegation

Stripe billing foundation: subscriptions synced from Stripe with signature-verified billing events, and plan tiers that set API limits and features

Plan-tier enforcement: graduated API rate limits per tier (free 60/min, pro 600/min, enterprise 6000/min); admin-set per-key overrides honored verbatim; backward-compat invariant tested (free-tier behavior IDENTICAL to before)

Microsoft Intune integration foundation: device configurations, managed devices, mobile apps, and device sync, using the same Microsoft connection as Entra ID

Atlassian Confluence Cloud connector: space lookup and creation, sharing the Jira connection when both live on one Atlassian site

All 13 runbook /runbooks detail pages now show 'live' status (was 10 live + 3 templates at start of Phase 2)

Billing and webhook subscription storage brought up to date in production

672 unit tests passing (was 493 at start of Phase 2; +179 across the 8 sessions)

Every Phase 2 change purely additive or 100% backward-compatible, with zero regression in existing functionality

Group membership runbook (RB-013): Entra security group add/remove, executed exactly once, with full HITL parity in Slack and Teams

New employee provisioning enhanced: optional group assignments at propose time, deferred when user not yet in Entra

Public /runbooks library: 13 documented runbooks with SEO-optimized detail pages and YAML previews

SHA-256 audit chain: chain verification and CSV export, 98 unit tests

Audit chain coverage: every approve and deny from Slack and Teams is recorded on the audit chain

Tamper-evident audit chain live in production (US East 2), with hash markers viewable in /dashboard/audit

/dashboard/audit live chain reader: paginated load-more, hash-prefix column for verification, demo-aware (fictitious Acme rows for prospect demos)

Multi-tenancy Phase 1+2: credentials encrypted per organization and used only for that organization's Slack, Teams, Okta and Entra requests

Dual-mode dashboard security: demo visitors see fictitious data on the same pages, and real data is never served to a demo session

Trust Center / /security page: implementation-accurate Live / In Progress / Roadmap split with sub-processor list and CISO FAQ

Idle-timeout (5 min, server-enforced) + closed-tab session termination, for SOC-2 CC6.1 alignment

Read-side RBAC isolation: demo / non-owner sessions never see real production telemetry

Rate limiting and exactly-once actions: no double-execution under retry, no abuse via public endpoints

AscendCore, Inc. C-Corp filed (Stripe Atlas, May 2026): forward-looking entity references in /privacy and /dpa now have entity backing

Datadog integration live in production: alert intake and monitor muting

Automated test suite: 305 unit tests across the audit chain, multi-tenancy, intent classification, runbooks and parsing

Entra ID user lookup resolves users by email alias when the sign-in name differs (B2B member accounts, plus-addressing). Found in our own smoke testing.

Slack/Teams group-name parser strips surrounding quotes: `/group-add user@x.com "My Group"` now works as users naturally type it

MFA reset (Okta): intent classified by AI, HITL-gated, factor cleared and re-enrollment sent on approval

Password reset (Okta): admin approve/deny from Slack, Teams, or dashboard, with an Okta temp password set on approval

Account unlock (Entra ID): re-enables the account on approval, resolves in under 90 seconds end-to-end

Account offboarding (Okta): user deactivation + group removal, HITL-gated with full audit trail

Microsoft Teams bot: registered in Azure (Bot Framework), JWT-verified, Adaptive Card HITL with approve/deny

All four automations available from Slack slash commands and Teams bot chat, with an identical approval flow in both

Source tracking: every request tagged as 'slack' or 'teams' through the full pipeline, visible in dashboard and audit log

Admin dashboard: live approval queue with confidence scoring, completed history, 5-scenario interactive walkthrough

Guided onboarding wizards: step-by-step credential setup for Okta, Entra ID, M365, Teams, Jira, and Duo Security

Lead capture and demo access flow: prospects get dashboard access in under 5 minutes

AI intent classification for identity requests

Teams approval cards: fixed approve and deny buttons so every submit is handled as an approval

Slack and Teams requests that finish in the background now always complete