Under the hood
HIPAA/ZDR compliance checks now default to blocking, not allowing, when the compliance cache is empty
What
Three compliance-gated capabilities change their behavior for when compliance status hasn't been cached yet (a cache miss):
Projectstool access now defaults to holding (pausing pending confirmation) instead of allowingTeam onboardingnow defaults to holding instead of allowingPeer messagingnow defaults to denying outright instead of allowing
Why
This makes these compliance-sensitive features fail closed rather than open when the system doesn't yet know an organization's HIPAA or zero-data-retention (ZDR) compliance status, reducing the risk of allowing something that should have been blocked while status is still unknown.