Capability changelog

Released 2026-08-06 · All plans; teammates and client users need Business, Enterprise or Platinum · owner: Governance Product

Current limitation: Account owner, company admin, client member and token client portal views are implemented. Token portal clients can respond to findings and evidence requests (with a link to a file) and reply to message threads; acknowledging a finding and sharing a document that was not requested are not available. Client collaboration sends no notifications and has no concurrency control. Production-like identity proof is pending.

Released 2026-08-06 · All plans · owner: AI Safety

Current limitation: Ask is extractive: it returns excerpts from published framework obligations and the findings and risks the user may view, with up to six citations, and abstains when nothing matches. No language model is used for these answers. Drafts are generic templates labelled Draft. The built-in evaluation is a fixed self-check, not a test run; production evaluation and user outcome evidence remain pending. Other AI Assistant tools (gap analysis, remediation suggestions, finding drafts, summaries) are not part of the copilot: they use OpenAI only when the deployment configures a key, are not cited, and gap analysis is unavailable without one.

Released 2026-08-05 · All plans · owner: Product and Security

Current limitation: Requires sign-in, a project and scan permission; there is no anonymous scan. Only shared report links can be opened without signing in, and they expire after 30 days. Public pages only: target-site authenticated scanning is refused. Scans are rate-limited per client address (12 per 10 minutes). Production-like rate-limit, retention and cross-tenant exercises remain pending.

Released 2026-08-05 · All plans · owner: Regulatory Content

Current limitation: Releases are authored, reviewed and published by AIGovernr administrators; customers read published releases only. Coverage is mapped published obligations divided by total published obligations: it measures content mapping, not a customer's controls or evidence, and is not certification or legal validation.