Known limits and roadmap

Every safety claim on the other pages in this section is a commitment. This page is about the commitments we haven’t kept yet and the ones we deliberately will not make. It is the most important page for anyone making a procurement decision, because what isn’t built is usually more informative than what is. We update this page as limits are resolved or new ones emerge. If the date on a roadmap item has passed without a corresponding update, assume it’s delayed and ask us — don’t assume silently that it shipped.

​

Roadmap items (in flight or next up)

​

AI context scrubbing

What’s missing. When a procedure substitutes {{password}} or {{api_token}} into a prompt sent for inference, that plaintext enters the model context for that call. The context safeguards catch known inadvertent patterns, but a deliberate procedure substitution is, today, not scrubbed. Why it matters. The substituted value can leave the device and reach the selected provider. Provider data-handling terms do not replace keeping credentials out of model context. What’s being built. A procedure-runtime indirection layer that substitutes a reference into the prompt and resolves the reference at the tool-call boundary, so the model sees {{credentialRef:core-admin}} and the tool call receives the unwrapped secret — the same pattern used today for interactive tool calls. Interim guidance. For procedures that authenticate to external APIs via substituted secrets, authenticate at the tool-call layer (the credentialRef mechanism) instead of via prompt substitution wherever possible. This is already the default for the built-in SSH, RDP, connector, and MCP tools.

​

Decryption audit

What’s missing. Every decrypt call carries a purpose: DecryptPurpose parameter, and the Go sidecar already applies additional authenticated data (AAD) binding decrypts to record and purpose. The structured emission of (purpose, recordId, userId, timestamp) events into a per-organization audit log is the next iteration. Why it matters. Until this lands, decrypt events are observable at the AWS CloudTrail layer (KMS:Decrypt calls against the org CMK) but not at the application layer. CloudTrail answers “did a decrypt happen” but not “which record, for which purpose”. What’s being built. A dedicated DynamoDB audit table with per-decrypt events, partitioned by organization and queryable by record, user, and time. Retention configured at the organization level. Interim guidance. Use the application history for the relevant run and ask Altostrat for retained infrastructure evidence when necessary. Customers do not directly access Altostrat’s AWS CloudTrail. A tool audit event is not a record of every field decrypted.

​

Organization-wide audit explorer

Available now. Organization admins can inspect, verify, and export durable desktop audit streams. Worker Activity has a separate event chain and verification surface. These are covered in Audit and telemetry. Remaining boundary. These views do not combine every infrastructure, identity, endpoint, or external-system event into one complete record. Hash-chain verification establishes integrity of the recorded sequence, not the correctness or completeness of actions outside that sequence.

​

Device-side plaintext minimization

What’s missing. Today, the decrypted plaintext of a record (Key Chain entry, connector auth, procedure body) is materialized in the Electron renderer process when the record is loaded for display or editing. Plaintext is then observable in the React state tree for the life of the component. Why it matters. An endpoint-level attacker who executes code in the renderer process has the same observation window as “everything you currently have open.” Today that window is “whenever you’ve viewed the record this session”; after the refactor it will be “only at the exact moment of use.” What’s being built. A decrypt-on-demand refactor where plaintext is unwrapped at the point of use (the moment a terminal authenticates, the moment a connector request signs, the moment a procedure runs) and discarded immediately after. The DecryptPurpose parameter is the infrastructure for this; the next step is moving every consumer off load-time decryption. Interim guidance. Lock the desktop session when walking away. EDR and signed-process policies are the right device-level controls.

​

Control-plane residency versus inference region

Current boundary. AI settings now provide a Bedrock region selector for supported inference, vision, OCR, and transcription paths. Region availability differs by model: when Claude is unavailable in Cape Town, Studio routes Claude chat, titles, summaries, and vision through Frankfurt while keeping supported OCR and voice work in Cape Town. What the selector does not do. Changing inference region does not move the organization’s control-plane records, identity, billing, or encryption resources into a customer-selected region, and Studio does not currently provide a per-customer self-hosted deployment. OpenAI and Org Brain. OpenAI chat is outside the Bedrock region selector. Org Brain answer synthesis uses its separately disclosed policy, which can permit global OpenAI processing with US Bedrock fallback. Cloud indexing and workers do not inherit a desktop region choice. Interim guidance. Treat model-processing region and application-data residency as separate procurement questions. Ask Altostrat for the current region matrix before approval; do not infer control-plane residency from the AI setting.

​

Encrypted organizational metadata

What’s missing. Hostnames, display names, folder structure, and ownership rows are intentionally plaintext server-side (see vault and keys). They can be sensitive operational metadata even though they are outside the encrypted-secret set. What’s the plan. A searchable-encryption design to selectively encrypt categories of metadata where the search/sort cost is acceptable. This is research-grade work, not a near-term roadmap item — listed here for transparency, not as a commitment. Interim guidance. Treat display names and folder labels as information that does not need to embed sensitive content. Do not use a memory as a secret store; its visibility and cloud-processing path are separate from Key Chain encryption.

​

Customer telemetry controls

Current boundary. Sentry error and crash reporting is active with client-side scrubbing and deduplication; Sentry Session Replay is disabled. Amplitude product analytics and masked Session Replay are enabled outside local development at the configured release sample rate. The packaged default replay sample rate is currently 100%, with terminals and marked sensitive regions blocked and form input masked. What’s missing. The current desktop app does not expose a general customer-facing organization switch for Sentry or Amplitude collection. Interim guidance. Review Audit and telemetry before rollout and contact Altostrat if telemetry or interaction replay conflicts with policy. Masking reduces exposure but is not equivalent to disabling capture.

​

Org Brain and worker availability

Org Brain search, answer synthesis, worker triggers, worker grading, dream cycles, and durable desktop audit are delivered capabilities. They still require the applicable billing, organization settings, consent, permissions, and supported client version. The following boundaries remain:

• Private transcript search: an owner-only saved call transcript is not automatically searchable through Org Brain; the customer-facing source setting and rollout remain separate.
• Source coverage: enabling Org Brain does not import every file, conversation, terminal replay, or historical item. Check supported feeders and consent in the Org Brain guide.
• Communication: Native Slack questions, approvals, and supported outcomes are available where configured. Native Teams approval routing remains unavailable; separately configured Graph connector operations have their own account and scope requirements. Customer replies and email through help-desk/mail connectors are distinct from Studio’s SES member notifications.
• Email intake and cloud browser: Native inbound email is restricted to enabled non-production deployments, and worker browser jobs are staging-only. Use supported webhook or schedule intake and connector/API operations for production workflows. SES notification delivery also has a separate production-access dependency.
• Procedure stages: running a procedure interactively is supported; procedure-as-worker-stage rollout depends on procedure sharing and remains separate.
• Budgets: worker usage is customer-billed. Concurrent/in-flight runs can overshoot the shared pool; a configured cap is not a guarantee of exact final spend. See Usage and billing.
• Knowledge quality: citations and outcome scores do not prove correctness. Review dream-cycle proposals, inspect automatically published facts, and retract incorrect claims. Check live sources before consequential actions.

​

Managed Remote Desktop

The managed endpoint feature remains an availability-gated preview. Windows input/control and remaining platform acceptance are not general-availability promises. Managed AI tool exposure is separate from the established RDP Computer Use workflow. See Managed Remote Desktop for the current boundary.

​

Out of scope (by design)

These are limits we do not intend to resolve — not because they are unimportant, but because the fix would break something else or because the responsibility belongs elsewhere.

​

The update-channel trust question

Studio self-updates through electron-updater. Code signing and SHA-512 verification protect the update channel, but the channel itself is a channel. An organization that does not want self-update can disable it at the OS deployment level (MDM policy, group policy) and manage Studio updates through normal software distribution. This is supported; it is not the default because the cost-benefit for most users favors timely security updates.

​

How to read this page

Don’t treat roadmap items as commitments with dates. They are priorities. They move. When one lands, it leaves this page. When a new limit emerges, it lands here. Weight the out-of-scope items heavily. They will not change. If an out-of-scope limit is incompatible with your environment, the rest of Studio’s safety story does not compensate. Be suspicious of any vendor who has no page like this one. Every security architecture has limits. A vendor who does not describe theirs has not done the work or is not being honest about it.

​

Related