diff --git a/docs/production-readiness-roadmap.md b/docs/production-readiness-roadmap.md
index 72a87ba..56a7a80 100644
--- a/docs/production-readiness-roadmap.md
+++ b/docs/production-readiness-roadmap.md
@@ -152,13 +152,13 @@ it.
 
 Goal: finish the authorization and remote-input audit before deployment.
 
-- `[ ]` Complete remote authorization matrix coverage.
+- `[~]` Complete remote authorization matrix coverage.
   Acceptance criteria:
   - `[ ]` Denied and allowed paths are tested for CAS, KV, DB, document,
     pubsub, pipe, SSH proxy/admin shell, SSH cert metadata, and revocations.
-  - `[ ]` Every remote mutating or service-opening operation has an explicit
+  - `[x]` Every remote mutating or service-opening operation has an explicit
     resource capability check before mutation or host access.
-  - `[ ]` The matrix fails tests when a new remote operation lacks a guard.
+  - `[x]` The matrix fails tests when a new remote operation lacks a guard.
 
 - `[ ]` Add adversarial identity and bearer tests.
   Acceptance criteria: