Product and architecture decisions still requiring confirmation

Brand and public web

1. Is Capablio the final legal and product spelling across domain, app, packages, and documents?
2. Is the current amber/lime identity final, or may the design system revise the palette while retaining the mark?
3. Will marketing, docs, and application live in one monorepo and deployment platform?
4. Which pages and features may be described publicly today versus marked beta/planned?

Authentication and encryption

1. Which production authentication methods are supported: Google/Microsoft OAuth, passwordless email, passkeys, SAML, OIDC?
2. Is bearer-token sign-in strictly a local/development feature?
3. Which encryption/recovery modes will be supported?
4. Can a tenant recover subject data, and under what approval/audit model?
5. What happens when a user changes device, loses a key, leaves the company, or exercises deletion rights?
6. Will customer-managed keys be a real enterprise feature or a future option?

Roles and privacy

1. Can managers see full direct-report results, selected aggregates, or only explicitly shared outcomes?
2. Which PDP fields are private, shareable, or tenant-owned?
3. Are manager ratings allowed as a single identifiable relationship group?
4. What are default anonymity thresholds by relationship type?
5. Can HR access qualitative comments, and how is re-identification risk handled?
6. Is global support ever allowed to view decrypted content?

Commercial model

1. Confirm active-subject seat definition, inactivity window, leaver/archive policy, and guest-rater pricing.
2. Confirm plan prices, annual discount, minimums, and add-ons.
3. Which enterprise controls are included versus paid add-ons?
4. What self-service upgrade/downgrade behavior is supported?

Adaptive framework

1. Which three question packs launch first?
2. What is the default anchor/rotation/PDP ratio by cadence?
3. Does a presented but unanswered question always count as exposure?
4. Which cooldown scope is default: respondent–subject–family, respondent–family, or another scope?
5. What coverage promise is shown when configuration is infeasible?
6. Who may author and publish tenant questions?
7. Which imported Thomas elements are supported in the first release?

Analytics and AI

1. Which AI functions are released: authoring assistance, comment themes, PDP coach, summaries?
2. Which model providers, data-use terms, regional controls, and opt-outs apply?
3. How are AI summaries grounded, cited, reviewed, and corrected?
4. Which organization analytics are allowed before benchmark cohorts are validated?

Platform operations

1. Required regions, residency, backup, disaster recovery, and recovery objectives?
2. Required billing provider and tax/invoice behavior?
3. Required HRIS, SSO, SCIM, collaboration, and warehouse integrations?
4. What privileged support workflow is acceptable to legal and security owners?
5. What SLOs and support tiers will be contractually offered?