Specialists
scopedrift reads what a client runs, what regulates it, and the documents you upload, then composes the reviewer roles that project needs: a Salesforce admin, a cloud architect, a security reviewer, the right compliance reviewer. Each one asks its own discovery questions and reviews every requirements document from its angle, and you see exactly what each one found.
Industry, tech stack, core applications, regulations, and the documents you upload: standards, specifications, vendor contracts.
scopedrift proposes the reviewer roles the client needs, each with a checklist, the questions it asks stakeholders, and what it treats as a blocker. Every checklist line says where it came from.
Nothing is active until an admin says so. Edit any line, fork a specialist, write your own, or adopt a reference checklist for a well-known framework.
Specialists join a project when their triggers match, ask their own follow-ups in discovery, and review every synthesis and requirements document.
Illustrative. Your bench comes from your client's profile and documents, not from a fixed catalog.
Financial services
Healthcare
Public sector
An illustrative review of a fictional client's discovery. Every finding names its evidence and what it affects, and the reviewer records what it checked and found clean.
PCI DSS Reviewer
BlockingIllustrative sample, fictional clientCard numbers taken by phone and emailed to billing
Support reads primary account numbers over the phone and sends them by email, which puts full card numbers on a messaging channel and in mailboxes.
Affects: The support and billing processes enter PCI scope; the payment requirements need a phone-payment path that never exposes the card number.
Ask the stakeholder: when a customer pays by phone, could support enter the card into a payment page instead of writing it down? (blocking)
Third parties that touch card data are not listed
One gateway is named, but no other processor or support tool is listed with its attestation. General practice for card-handling systems; nothing in the material confirms or denies other parties.
Affects: The vendor inventory for the self-assessment cannot be completed.
Ask the stakeholder: which vendors or tools will ever see a card number, even in support?
Prepared to support your compliance owner's review. Not a legal or regulatory determination.
Discovery
Follow-up questions carry the specialist that asked them, for example "Follow-up from the PCI DSS Reviewer".
Synthesis
Gaps and next questions are badged with the specialist whose checklist they belong to.
Requirements
A Specialist Review section at the end of every BRD version, in every export format, with findings, evidence and what each one affects.
Dev hand-off
The signed export bundle carries the review as JSON and markdown, so a coding agent sees the same findings your team does.
Project chat
Ask what a specialist flagged and get the finding, not a guess.
Intake and meetings
Concept briefs carry specialist badges on constraints and risks; the live meeting assistant can suggest a specialist's question when the conversation makes it relevant.
Compliance specialists carry this line on every finding, in every export: Prepared to support your compliance owner's review. Not a legal or regulatory determination.
| Plan | Bench per organization | Auto on a project | Write your own | Add without review |
|---|---|---|---|---|
| Free | 2 | 1 | No | No |
| Solo | 4 | 3 | No | No |
| Team | 8 | 5 | Yes | No |
| Agency | 15 | 8 | Yes | Yes |
| Enterprise | Unlimited | Unlimited | Yes | Yes |
Reference checklists for HIPAA, SOC 2, WCAG 2.2, PCI DSS, AWS and Azure Well-Architected, OWASP ASVS and GDPR are included on every plan.