Limitations

Supported is an honesty bar, not a marketing ceiling.

Supported profile

POSTGRES_DSN + REDIS_URL + auth + runner tokens + TLS.

Known gaps (summary)

• Agent Protocol MCP sessions are process-local (sticky routing).
• Authz is route-level (+ optional agent run grants), not per-tool ACLs outside connector policy (MCP grants + argument predicates).
• Tenancy is flat tenant_id — no org/team UI.
• Governance durability (audit/grants/pending/kill/usage) is SQL-only; Mongo returns 501 on those Admin routes.
• FinOps caps + metering + Admin Spend (/admin/spend) with alerts, export, holds, and alias routing on SQL. Overshoot possible when reservation is unset or estimates are wrong; no mid-run budget kill.
• Kubernetes/Helm: kind K0–K3 ops-proven; Compatible for production cloud until a named soak (K4). Compose proves multi-CP HA today.

Full list: docs/limitations.md