# Known Limitations / Follow-up Items

**Posture:** Hardened GDP portal (floor 286). Remains a validation-candidate system artefact — not MHRA approved.

## App residual (non-human)
- Local `env=local`: malware scan soft-passes if ClamAV is not installed.
- Login MFA stays optional; **high-risk e-sign / Trade override require MFA enrolled**.
- Peripheral modules may still have soft catches; critical stock/TX paths are hardened.
- Formal automated WCAG / full browser E2E suite not embedded.

## Do next as admin
1. Profile → enrol MFA before using high-risk approvals.
2. On staging/production set `env` accordingly (malware becomes required).
3. Dispatch release: set **different** picked-by and checked-by users.
