enterprise/compliance needs?

[rbtcollins]

Is this issue related to an issue?.

Apologies if I've missed it, but there doesn't seem to be any support for a range of features often needed in high governance environments.

There is 'Enterprise features
Custom authentication, ubiquitous access control, history, etc.' in the roadmap, but it isn't clear what the timeframe for that is.

The specific features I'm interested in are

a) those that prevent the (ab)use of a single compromised browser session (or laptop) from affecting a change to production, or exfiltrating a secret. For instance mandatory peer review before application, and before any dry run which might read-out secret material.

b) dealing with a fleet of similar infrastructure - we have many instances of a single basic infrastructure with some minor variance between them. This is currently managed in terraform by parameterising a root module with a unique state file + parameters that encompass the variation. Its also not clear whether this is (or isn't) on the roadmap today - it seems to be a different dimension of scale to me - one of managing complexity at a higher level than the component model; but perhaps components are the intended solution here?

Describe the outcome you'd like from us

For the governance question, just knowing if it is short-term, medium, or 'eventually' would be great!

For the other one, its more of a discussion, but discussions aren't turned on in Github, and discord isn't indexed, so no-one can learn from the discussion, so I guess we'll see if you'll take it here :).

Describe alternatives you've considered

Not having the feature isn't viable unfortunately. Maybe in a world with no threat actors.

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

No response