# Roadmap

## Phase 1

- Build the core registration and login flow.
- Add groups and applications tables.
- Add join tables for access control.
- Add the first admin pages.

## Phase 2

- Add CSRF protection.
- Add flash messages.
- Add form validation helpers.
- Add admin assignment screens.
- Add pagination and filtering.

## Phase 3

- Add password reset.
- Add email verification.
- Add audit logs.
- Add rate limiting.
- Add better error pages.

## Phase 4

- Add test coverage.
- Add deployment automation.
- Add backups and restore notes.
- Add documentation for maintenance.
- Add API endpoints if needed.

## Phase 5

- Add observability.
- Add structured security logging.
- Add optional MFA.
- Add permission abstractions.
- Add containerized local development.