# What is built

Everything on this page is built except the two features below. Each is
`toolchain.not_built_yet` where you write it.

| Feature | Status |
|---|---|
| Grants, user fields, membership roles, `Access.authenticated`, `Access.public` and `Access.system`, tenancy, `actions:`, field restrictions, the permissions report, and the refusals under "When policy says no" | Built. |
| `scopes:`, with the tokens issued to other applications (`oauth_token`, `external_token`) | Not built yet. Browser sessions and service keys work without them. |
| An acceptance for a change that widens access, and the approval review that shows the report's changes ([Review and sign-off](review-and-sign-off.md), [Acceptances](acceptances.md)) | Not built yet. Review policy changes in the permissions report's diff instead. |