M2 Completion Summary — Platform and Client Admin

What's done (from POC)

• Organisation KYB flow, Velocity Registrar API integration, branding/Ts&Cs/Privacy Policy admin config, user CRUD, and role-based access control were all demonstrated in today's POC and are the best-covered area of the whole platform.

What's outstanding

• Logo/hero image upload (currently URL-only).
• In-app MFA management, password self-service UI, and account lockout/expiry — currently delegated entirely to Auth0 with no in-app screens.
• User documentation/help system — not started; tooling choice (Zendesk vs. custom) unconfirmed.
• Passkey support — was "desirable" in the original requirements, silently absent from the SOW; needs a decision either way.

Recommendation

This milestone is low-risk relative to the rest of the plan — treat it as "harden and finish" rather than "build new," and use the saved effort here as schedule buffer for M5–M7 where nothing has been built yet.