What you can rely on after the sale.
Enforcement sits on the critical path of every protected call, which makes support, lifecycle and continuity part of the security argument rather than commercial small print.
This capability is a Q4 2026 roadmap extension. The sections below describe the planned shape and evidence; production availability has not yet been declared. The status above is rendered from the Product Truth Registry.
1. What this enforces
Nothing technical. This is the operational commitment around the thing that does the enforcing.
2. Where it enforces
Around the product: response and resolution targets, supported version windows, deprecation notice periods, and what happens to a deployment if the commercial relationship ends.
3. What evidence it produces
Published targets and published version lifecycles, so a buyer’s own continuity assessment can be completed without a call.
4. Why you cannot assemble this from what you already own
A security control with an unclear support lifecycle is a future migration project. Buyers in regulated industries are required to ask what happens if the vendor disappears, and ‘we would work something out’ is not an answer that passes diligence.
5. What Q4 2026 adds
Enterprise Service Management
SLAs, support tiers, LTS, compatibility, deprecation, emergency patching, upgrade policy, escrow and continuity.
6. Acceptance criteria
The specification defines this capability against the three baseline criteria that apply to every Q4 2026 extension — documentation with failure modes and a runbook, automated coverage of primary and abuse cases, and telemetry that emits evidence without exposing prohibited data. Capability-specific criteria have not been written yet, and this page will state them when they are rather than inventing them now.
- The capability is documented with configuration, failure modes, security implications and an operational runbook.
- Automated unit, integration, negative and regression tests cover the primary and abuse cases.
- Telemetry and audit evidence are emitted without exposing prohibited sensitive data.
7. What is still open
The following are genuinely undecided rather than merely undocumented, and each one changes what the capability is:
- Whether long-term support versions are defined by release or by calendar.
- Source or escrow arrangements for continuity, and on what trigger.
- The deprecation notice period, which for an in-process library needs to be longer than for a service.
Every Q4 2026 extension is also held to four platform-wide requirements, six test classes and four release gates. They are published once, on the Q4 2026 roadmap, rather than repeated on every page.