§53 Composable Capability Matrix

Canonical machine-readable source: `internal/capability/matrix.json, embedded in the binary and served verbatim at GET /.well-known/api-capabilities. This table is generated from it by make capability-doc. **Drift … is a release blocker** — enforced by make capability-drift (JSON↔registry↔manifests↔routes) and make capability-doc-check` (this table↔JSON).

Totals: 104 capabilities — 20 GA, 84 Beta, 0 Planned.

GA

Capability key	Name	API	UI	Air-gap	Multi-region	SLO class	Data class	Availability
`control_plane.byo_data_lake`	Customer-owned lake federation	/v1/lake/query (federated source)	/byo-data-lake	✓	✓	batch	confidential	GA
`control_plane.channel_ssh`	SSH management channel	/v1/channel_ssh	/channel-ssh	✓	✓	interactive	confidential	GA
`control_plane.estate_agent`	Optional managed agent	/v1/estate_agent	/estate-agent	✓	✓	interactive	confidential	GA
`control_plane.estate_pam`	Vaulted credential custody + brokering	/v1/estate/credentials	/estate-pam	✓	✓	interactive	restricted	GA
`control_plane.estate_policy`	Estate-wide policy targeting + reconciliation	/v1/estate/packs/{plan,apply}	/estate-policy	✓	✓	interactive	confidential	GA
`control_plane.marketplace`	Third-party plugin install	/v1/marketplace/catalog (install)	/marketplace	✓	✓	n/a	internal	GA
`control_plane.os_pack_linux`	Linux native-security management pack	/v1/os_pack_linux	/os-pack-linux	✓	✓	interactive	confidential	GA
`control_plane.os_pack_windows`	Windows native-security management pack	/v1/os_pack_windows	/os-pack-windows	✓	✓	interactive	confidential	GA
`control_plane.oss_packs`	Open-source tool management packs	/v1/oss_packs	/oss-packs	✓	✓	interactive	confidential	GA
`control_plane.playbook_packs`	Signed marketplace content packs	/v1/soar/playbooks	/playbook-packs	✓	✓	batch	confidential	GA
`control_plane.shell`	Dashboard shell + user mgmt	/v1/{tenants,policies,policy,logs,me} ; /scim/v2	/shell	✓	✓	interactive	internal	GA
`control_plane.thirdparty_connectors`	Certified third-party product connectors	/v1/thirdparty_connectors	/thirdparty-connectors	✓	✓	interactive	internal	GA
`platform.capability_discovery`	`/.well-known/api-capabilities` and friends	/.well-known/api-capabilities	/capability-discovery	✓	✓	interactive	internal	GA
`platform.continuity_escrow`	Vendor-continuity escrow agreement marker (continuity path itself is un-gated)	/v1/licensing/status (continuity claim)	/continuity-escrow	✓	✓	interactive	internal	GA
`platform.customer_auditor_role`	Time-boxed read-only auditor role + evidence locker	/v1/audit/evidence-locker	/customer-auditor-role	✓	✓	n/a	internal	GA
`platform.marketplace_listing`	Public catalog & self-service install path	/v1/marketplace/catalog	/marketplace-listing	✓	✓	n/a	internal	GA
`platform.public_roadmap`	Public roadmap + sunset surfacing	/v1/roadmap	/public-roadmap	✓	✓	n/a	internal	GA
`platform.sla_reporting`	Signed monthly SLA reports per tenant	/v1/sla/reports	/sla-reporting	✓	✓	n/a	internal	GA
`platform.status_page_automation`	Auto-published per-module + per-suite status	/v1/status ; /v1/status/subscriptions	/status-page-automation	✓	✓	n/a	internal	GA
`platform.trust_portal_automation`	Auto-fed public trust portal + private NDA mode	/v1/trust/portal ; /v1/trust/portal/private	/trust-portal-automation	✓	✓	n/a	internal	GA

Beta (shipped core+tests; pre-production hardening / in-memory state)

Capability key	Name	API	UI	Air-gap	Multi-region	SLO class	Data class	Availability
`control_plane.access_certification`	Access-certification / recertification campaigns	/v1/iga/certify	/access-certification	✓	✓	n/a	internal	Beta
`control_plane.agentic_soc`	Triage / investigation / response agents	/v1/soc/agents/{investigate,execute,killswitch,scorecards}	/agentic-soc	✓	✓	n/a	internal	Beta
`control_plane.ai_spm`	Tenant AI security posture	/v1/ai/models	—	✓	✓	n/a	internal	Beta
`control_plane.aiops`	Tenant-facing AIOps	/v1/aiops/health (+scan/anomalies)	—	✓	✓	n/a	internal	Beta
`control_plane.app_dependency_map`	Application dependency mapping (flow clustering + tiers)	/v1/workloads/adm/clusters ; /v1/workloads/adm/dependencies	/d/workloads	✓	✓	batch	confidential	Beta
`control_plane.attack_coverage_map`	ATT&CK coverage heatmap	/v1/detections/coverage	/attack-coverage-map	✓	✓	n/a	internal	Beta
`control_plane.attack_path`	Exposure attack-path analysis	/v1/ctem/attack-path	/attack-path	✓	✓	n/a	internal	Beta
`control_plane.autonomous_playbooks`	Confidence-thresholded autonomous runs	/v1/soc/agents/execute (confidence-thresholded autonomous)	/autonomous-playbooks	✓	✓	batch	internal	Beta
`control_plane.case_management`	Cases, evidence custody, war rooms	/v1/soar/cases	/case-management	✓	✓	interactive	confidential	Beta
`control_plane.channel_api`	Third-party API management channel	/v1/channel_api	/channel-api	✓	✓	interactive	confidential	Beta
`control_plane.channel_bmc`	Redfish / IPMI out-of-band hardware channel	/v1/estate/sessions (protocol=bmc) ; /v1/estate/fanout	—	✓	✓	interactive	confidential	Beta
`control_plane.channel_netconf`	NETCONF / RESTCONF / gNMI network-device channel	/v1/estate/sessions (protocol=netconf) ; /v1/estate/fanout	—	✓	✓	interactive	confidential	Beta
`control_plane.channel_rdp`	Brokered interactive RDP channel	/v1/channel_rdp	/channel-rdp	✓	✓	interactive	confidential	Beta
`control_plane.channel_snmp`	SNMPv3 read/trap channel	/v1/estate/sessions (protocol=snmp) ; /v1/estate/fanout	—	✓	✓	interactive	confidential	Beta
`control_plane.channel_winrm`	WinRM / PowerShell Remoting channel	/v1/channel_winrm	/channel-winrm	✓	✓	interactive	confidential	Beta
`control_plane.cloud_enforcement`	Agentless cloud enforcement (AWS SG / Azure NSG / GCP firewall)	/v1/workloads/cloud/accounts ; /v1/workloads/cloud/sync	/d/workload-ops	✓	✓	interactive	confidential	Beta
`control_plane.collective_defense`	PET-based cross-tenant indicator sharing	/v1/collective/iocs (+optin/status)	—	✓	✓	n/a	internal	Beta
`control_plane.comanaged_soc`	Vendor-analyst access plane	/v1/msp/soc	—	✓	✓	n/a	internal	Beta
`control_plane.competitor_migration`	PANW / FTNT / CHKP importers	/v1/migrate/import (+jobs/sources)	—	✓	✓	n/a	internal	Beta
`control_plane.config_drift`	Golden-config drift detection	/v1/config-drift/check (+baselines/drifts)	—	✓	✓	n/a	internal	Beta
`control_plane.container_segmentation`	Container segmentation (policy to Kubernetes NetworkPolicy)	/v1/workloads/k8s/compile ; /v1/workloads/k8s/apply	/d/workload-ops	✓	✓	interactive	confidential	Beta
`control_plane.correlation`	Unified incident graph	/v1/correlation/incidents (+run/live)	—	✓	✓	n/a	internal	Beta
`control_plane.deception`	Deception grid	/v1/deception/honeytokens (+trip/trips)	—	✓	✓	n/a	internal	Beta
`control_plane.detection_hub`	Detection-as-code lifecycle + Sigma	/v1/detections	/detection-hub	✓	✓	n/a	internal	Beta
`control_plane.detonation`	Detonation / sandbox service	/v1/detonation/submit (pluggable sandbox; UAT simulation)	—	✓	✓	n/a	internal	Beta
`control_plane.device_blueprints`	Device Blueprints (API ingestion + versioned admin pages)	/v1/integrations/blueprints/import	/d/device-console	✓	✓	interactive	confidential	Beta
`control_plane.dlp`	Data-loss-prevention + egress governance	/v1/dlp/rules, /v1/dlp/scan	—	✓	✓	n/a	internal	Beta
`control_plane.drp`	Digital risk protection	/v1/drp/findings (+assets/ingest)	—	✓	✓	n/a	internal	Beta
`control_plane.endpoint_context`	Endpoint/user posture as policy selectors (NAC/EDR)	/v1/workloads/endpoints ; /v1/workloads/endpoints/summary	/d/workload-ops	✓	✓	batch	confidential	Beta
`control_plane.estate_inventory`	Discovery + live estate inventory	/v1/estate/targets ; /v1/estate/capabilities	—	✓	✓	interactive	confidential	Beta
`control_plane.estate_response`	Cross-estate fan-out response	/v1/estate/fanout ; /v1/estate/killswitch	—	✓	✓	interactive	confidential	Beta
`control_plane.exposure_mgmt`	EASM + CTEM	/v1/ctem/exposures	/exposure-mgmt	✓	✓	n/a	internal	Beta
`control_plane.federated_search`	Cross-tier + BYO-lake query plane	/v1/lake/query	/federated-search	✓	✓	batch	internal	Beta
`control_plane.fleet_mgmt`	Fleet / enforcement-point management	/v1/fleets (+members)	—	✓	✓	n/a	internal	Beta
`control_plane.flow_fabric`	East-west flow fabric (ingest, topology, coverage)	/v1/workloads/flows ; /v1/workloads/flows/topology	/d/workloads	✓	✓	batch	confidential	Beta
`control_plane.iga`	Identity governance + joiner-mover-leaver	/v1/iga/leaver	/iga	✓	✓	n/a	internal	Beta
`control_plane.inventory_enrichment`	Inventory enrichment (CMDB/IPAM/Kubernetes) + label selectors	/v1/workloads/enrichment/sources ; /v1/workloads/select	/d/workload-ops	✓	✓	batch	confidential	Beta
`control_plane.itdr`	Identity threat detection & response	/v1/itdr/signals (+scan/detections)	—	✓	✓	n/a	internal	Beta
`control_plane.msp`	Multi-customer MSP hierarchy + delegated admin	/v1/msp/managed	—	✓	✓	n/a	internal	Beta
`control_plane.ot_readonly`	Read-only OPC-UA / Modbus OT discovery	/v1/ot/safety-posture	—	✓	✓	n/a	internal	Beta
`control_plane.ot_visibility`	OT / IoT visibility	/v1/ot/assets (+zones)	—	✓	✓	n/a	internal	Beta
`control_plane.policy_intent_egress`	Policy-intent egress to NGFW/ADC/fabric (webhook + Kafka REST)	/v1/workloads/intent/publish ; /v1/workloads/intent/export	/d/workload-ops	✓	✓	batch	confidential	Beta
`control_plane.policy_twin`	Policy digital twin	/v1/policy-twin/simulate (+suites)	—	✓	✓	n/a	internal	Beta
`control_plane.posture_score`	Best-practice posture grading	/v1/posture/score (+snapshot/history)	—	✓	✓	n/a	internal	Beta
`control_plane.risk_quant`	FAIR-based risk quantification	/v1/risk/portfolio (+scenarios)	—	✓	✓	n/a	internal	Beta
`control_plane.security_data_lake`	OCSF-native lake + tiered storage	/v1/lake/ingest	/security-data-lake	✓	✓	batch	confidential	Beta
`control_plane.segmentation_enforcement`	Distributed enforcement: compile policy to native host firewall	/v1/workloads/enforcement/compile ; /v1/workloads/enforcement/apply	/d/workloads	✓	✓	interactive	confidential	Beta
`control_plane.segmentation_policy`	Microsegmentation policy discovery, authoring + publication	/v1/workloads/policy/policies ; /v1/workloads/policy/discover	/d/workloads	✓	✓	interactive	confidential	Beta
`control_plane.session_broker`	Brokered, recorded privileged sessions	/v1/estate/sessions ; /v1/estate/sessions/{id}/exec ; /recording	—	✓	✓	interactive	restricted	Beta
`control_plane.siem_hub`	Premium fan-out and transform	/v1/siem/overview (+alerts)	—	✓	✓	n/a	internal	Beta
`control_plane.soar`	Playbooks + automation	/v1/soar/playbooks/{id}/run	/soar	✓	✓	batch	confidential	Beta
`control_plane.sod`	Segregation-of-duties / toxic-combination engine	/v1/iga/sod/check	/sod	✓	✓	n/a	internal	Beta
`control_plane.software_inventory`	Workload software inventory + package CVE exposure	/v1/workloads/inventory ; /v1/workloads/vulnerabilities	/d/workloads	✓	✓	batch	confidential	Beta
`control_plane.telemetry_fabric`	Cross-module normalized events	/v1/telemetry/evaluate (+routes)	—	✓	✓	n/a	internal	Beta
`control_plane.threat_intel`	TIP: STIX/TAXII, IoC lifecycle, feeds	/v1/intel/*	/threat-intel	✓	✓	batch	confidential	Beta
`control_plane.ueba`	Behavioral analytics	/v1/ueba/entities (score+scan+anomalies)	—	✓	✓	n/a	internal	Beta
`control_plane.validation_bas`	Customer-facing continuous validation	/v1/ctem/validate	/validation-bas	✓	✓	n/a	internal	Beta
`control_plane.workload_risk`	Risk-triggered response (vulns/violations/forensics to bounded action)	/v1/workloads/risk/triggers ; /v1/workloads/risk/fires	/d/workload-ops	✓	✓	batch	confidential	Beta
`control_plane.workload_score`	Composite workload security score + persona reports	/v1/workloads/score ; /v1/workloads/reports	/d/workloads	✓	✓	batch	internal	Beta
`control_plane.workload_sensor`	Workload process/hash sensor + forensic events	/v1/workloads/processes ; /v1/workloads/forensics/events	/d/workload-ops	✓	✓	batch	confidential	Beta
`control_plane.ztp`	Zero-touch provisioning	/v1/ztp/tokens (+redeem)	—	✓	✓	n/a	internal	Beta
`platform.airgap_licensing`	Accept offline signed bundles	/v1/licensing/airgap	—	✓	✓	n/a	internal	Beta
`platform.byok_envelope`	Customer-managed key envelope on cached entitlements	/v1/lockbox/byok	—	✓	✓	n/a	internal	Beta
`platform.contract_registry`	Contract registry + impact reports	/v1/contracts	—	✓	✓	n/a	internal	Beta
`platform.customer_lockbox`	Tenant approval/deny of vendor access (Access Approval)	/v1/lockbox/requests ; /v1/lockbox/requests/{id}/decision	/customer-lockbox	✓	✓	n/a	internal	Beta
`platform.federation_openapi`	Concrete OpenAPI federation contract	/v1/federation/openapi	—	✓	✓	n/a	internal	Beta
`platform.hyok`	Hold-Your-Own-Key — vendor cannot decrypt without tenant grant	/v1/lockbox/hyok/status	/hyok	✓	✓	n/a	internal	Beta
`platform.module_hot_reload`	Module hot-reload at runtime	/v1/modules (+reload)	—	✓	✓	n/a	internal	Beta
`platform.mtls_license_profile`	mTLS profile against control plane	/v1/licensing/mtls-profile	—	✓	✓	n/a	internal	Beta
`platform.online_licensing`	Connect to `https://licensing.doublelogic.org`	/v1/licensing/online	—	✓	✓	n/a	internal	Beta
`platform.release_channels`	Per-tenant channel selection (stable / beta / canary)	/v1/release/channels (+assignment)	—	✓	✓	interactive	confidential	Beta
`platform.self_hosted_release_parity`	Same release stream for managed and air-gap	/v1/release/parity	—	✓	✓	n/a	internal	Beta
`platform.self_service_data_ops`	Tenant-driven export, erasure, portability	/v1/data-ops/jobs (+export-snapshot/purge)	—	✓	✓	n/a	internal	Beta
`platform.signed_release_pack`	Signed image + SBOM + VEX + SLSA + reproducible build	/v1/release/pack	—	✓	✓	n/a	confidential	Beta
`platform.signed_release_verification`	Boot-time runtime signature verification	/v1/release/verify	—	✓	✓	n/a	internal	Beta
`platform.sovereign_topology_api`	Region / sovereignty matrix + tenant data-path API	/v1/sovereignty/topology (+regions/residency)	—	✓	✓	n/a	internal	Beta
`platform.sre_dashboards`	Vendor-neutral SRE dashboard pack	/v1/sre/dashboards	—	✓	✓	n/a	internal	Beta
`suite.admin_shell_ui`	Micro-frontend admin shell with SSO + theming	/v1/suite/shell-config	—	✓	✓	n/a	internal	Beta
`suite.airgap_bundle_distribution`	Parent distributes airgap bundles to children	/v1/suite/airgap-bundles	—	✓	✓	n/a	internal	Beta
`suite.cross_suite_routing`	Cross-suite peer-to-peer contract routing	/v1/suite/routes	—	✓	✓	n/a	internal	Beta
`suite.federation_core`	Run a parent control plane that federates children	/v1/federation/children, /v1/federation/health	—	✓	✓	n/a	internal	Beta
`suite.shared_audit_pipeline`	Children publish to the suite audit pipeline	/v1/suite/audit-pipeline	—	✓	✓	n/a	internal	Beta
`suite.shared_licensing_client`	Children share one licensing client instance	/v1/suite/licensing-client	—	✓	✓	n/a	internal	Beta
`suite.shared_otel_collector`	Single OTel collector + dashboards	/v1/suite/otel	—	✓	✓	n/a	internal	Beta

Planned (post-GA waves — not implied as present)

Capability key	Name	API	UI	Air-gap	Multi-region	SLO class	Data class	Availability