Build a roadmap

Harbor FY27 roadmap — planning-offsite proposal

Q4 2026–Q3 2027

Objective: Raise NRR from 104% to 112% through expansion in existing customers. Protect card continuity first, then deliver the best-supported expansion opportunities. Treat procurement as a gated investment—not a committed $6M forecast.

1. Roadmap

Planning assumptions

• Each existing squad has 11 squad-weeks per quarter, after support and on-call.
• Neither new squad is required to deliver this plan. Hiring is upside, not committed capacity.
• Numbers below are squad-weeks. Adoption work and reserves are timeboxed allocations, not additional feature estimates.
• Procurement production work proceeds only if the commercial gate below passes. Otherwise, its allocations go to expansion activation and remain available for replanning.

Delivery gates

Processor gate — non-negotiable - Allocate identifiable, independently executable migration work to Platform in Q4. - Complete migration code by early/mid-February, then freeze Harbor-side changes for the processor’s four-week certification. - Target cutover in mid-March, leaving contingency before 31 March. - If certification or implementation slips, pause card feature work and reallocate capacity immediately.

Procurement gate — decision by the end of Q4 Approve production funding only with: - Signed paid-pilot commitments at a validated price and requestor count—not general expressions of interest. - Evidence that customers with dedicated procurement tools will switch, or a clearly defined segment that does not require displacement. - A bottom-up expansion pipeline and pilot success criteria covering adoption, willingness to pay and implementation effort.

If the gate passes, the plan supplies the full estimate without hiring: 28 Approvals & Policy weeks + 3 Platform weeks at 1.5× = 30 equivalent weeks, plus 6 Integrations weeks. Target a Q3 launch, not a Q2 launch. If it fails or arrives late, do not start the full build; return to the exec team with revised scope and timing.

Outcome scorecard

Finance, Product and CS should maintain a monthly, existing-customer expansion bridge:

Do not count pipeline, enabled subsidiaries or estimated spend as realized NRR.

---

2. The case for this plan

Why this order

First, protect the business we already have. Every card authorization depends on the retiring processor API, and interchange represents 58% of revenue. The migration is not an ordinary roadmap item. Tom’s allocation of 11 Cards weeks in Q4 leaves seven weeks in Q1, followed by four calendar weeks of certification. That is too little schedule margin once effective capacity and the certification freeze are considered.

Moving three Platform weeks into Q4 migration work produces two equivalent Cards weeks. Cards then has five implementation weeks remaining in Q1. This buys a realistic certification window and a cutover buffer. We should not schedule virtual cards into that buffer.

Next, pursue expansion with the strongest customer evidence. Multi-entity has nine written commitments among 14 requesting customers. The identified opportunity is $2.9M ARR across 52 subsidiaries, although that is a ceiling—not a forecast. We should validate pricing, rollout requirements and which subsidiaries are covered by the nine commitments before booking expected revenue.

Virtual cards address a substantial identified spend pool. At 1.1% net interchange, capturing all $410M of estimated software spend would generate approximately $4.5M annually. Capturing 25–50% would generate roughly $1.1M–$2.3M, before considering rollout timing. These are scenarios, not forecasts: the spend estimate is extrapolated, and invoice spend may not be readily cardable.

Virtual cards precede real-time controls because they offer a direct, measurable spend-capture opportunity. Controls follow to broaden CFO confidence and adoption. If customer testing shows controls are a prerequisite for moving software spend, we should reverse their order.

Retention and security are part of the expansion strategy. Intacct serves 17% of customers; its CSV cohort has materially higher gross revenue churn than the NetSuite cohort. That does not prove integration causes the difference, but it supports prioritizing Intacct over Dynamics. SSO/SCIM is relatively small and addresses security reviews at 11 existing accounts, as well as new-logo pipeline. Receipt matching similarly offers a bounded investment against a known support burden.

What changed from Tom’s draft

1. Removed assumed hiring capacity. Last year’s squads took five to eight months to reach a first full sprint and delivered roughly half capacity in their first quarter. Full-capacity squads in Q1 and Q2 are not a dependable planning assumption.

1. Made multi-entity delivery feasible. Its Platform estimate is 12 weeks, so it cannot fit wholly into an 11-week Q4. With migration assistance included, Platform delivers eight weeks in Q4 and four in Q1.

1. Gated procurement and moved any launch to Q3. Two of six design partners expressing willingness to pay is insufficient evidence for a full production commitment, particularly when four already have procurement tools.

At the proposed price, an average customer has about 70 requestors and generates $6,720 annually. Reaching $6M requires approximately 893 average-sized customers—81% of our current base. Larger customers or different packaging could change that calculation, but the prototype evidence does not support Tom’s forecast. A first-year ARR claim also should not be treated as revenue available by Q3.

1. Funded the mobile rewrite with the existing Expenses squad. It is necessary lifecycle work, not the leading NRR investment. Scheduling its 22 weeks across Q2 and Q3 meets the known support horizon without depending on a new squad.

1. Added explicit activation capacity. Shipping is not expansion. Subsidiary onboarding, integration migration and card-spend conversion require attention after launch.

What we are not doing

• Dynamics this year: only 3% of customers use it, versus 17% on Intacct; its new-logo evidence is also weaker.
• An unconditional procurement build or $6M revenue commitment.
• A Q2 procurement launch funded by unstaffed squads.
• New mobile feature scope beyond the rewrite.
• Filling every reserve with another launch. Remaining capacity is deliberately available for activation, technical uncertainty and measured opportunities.

Risks that could change the plan

Processor execution: Cross-squad assistance must be genuinely separable work. If it is not, the CTO must secure qualified help or displace other work immediately. Certification failure overrides all discretionary card work.

Commercial conversion: Written multi-entity intent is not a contract; estimated software spend is not captured spend. CS and Finance must validate both before treating them as the expansion bridge.

Procurement: Passing the commercial gate earns production funding, not a $6M forecast. Implementation complexity or weak paid-pilot adoption could still stop or narrow the investment.

Retention assumptions: Intacct’s churn association may reflect customer mix rather than integration quality. Measure adoption and renewal outcomes rather than assuming the six-point difference is recoverable.

NRR sufficiency: Moving from 104% to 112% represents roughly $6.9M of additional annualized cohort revenue against an $86M reference base, subject to Finance’s actual cohort calculation. The evidence does not yet prove this roadmap closes that gap. Before the offsite, Finance and CS should build a customer-level bridge covering expansion, contraction, churn and timing, without double-counting opportunities.

Hiring and technical estimates: Earlier hiring can accelerate a validated bottleneck. Estimate changes or a nearer mobile-support deadline can force reprioritization. Neither should quietly expand the committed scope.

Part 1: Roadmap, Q4 2026 to Q3 2027

Planning basis: Five existing squads at 11 squad-weeks a quarter (55 a quarter). The two new squads are counted as zero in the commitments (see the case). Lending between squads is costed at 1.5×. Figures in brackets are squad-weeks of the named squad.

Q4 2026: Protect the card rail, start entities

Q1 2027: Cut over, ship entities, start controls

Q2 2027: Virtual cards, procurement beta

Q3 2027: Launch and land

About 60 of 220 squad-weeks are deliberately uncommitted, mostly in Q3.

---

Part 2: The case (≈1,150 words)

The short version

The order is set by one thing we can't negotiate and by the evidence for everything else. The processor retires v1 on 31 March, every authorisation runs through it, and interchange is 58% of revenue. Cards does nothing else until cutover. After that, work is ordered by evidence and cost per squad-week.

The plan gets our exit run-rate to roughly 109–111% NRR, not reliably 112%. We should tell the board that now rather than in Q3.

Why this order

1. v2 first, with real slack. Tom's draft has Cards doing 18 weeks at 11 a quarter, so build finishes around late February. Four weeks of certification then ends around 25 March, about a week before a deadline that would stop all card authorisation. My plan ring-fences Cards in Q4 and has Integrations, which does API work daily, lend 6 weeks (≈4 Cards-weeks). Code is complete in late January, certification runs in February, and we keep about five weeks of slack.

2. Multi-entity next. It has the best evidence we hold. Nine of 14 requesting customers said in writing they'd add subsidiaries, which means ~33 of the 52 subsidiaries, or ~$1.9M ARR. Customer Success's $2.9M assumes all 52 join. The cost is 22 weeks, and it is a direct "more entities" lever.

3. Intacct, then SSO. 17% of customers (~187) use Intacct via CSV and churn at 13% against 7% on NetSuite. If the integration closes that gap, it retains ~$0.9M a year for 9 weeks of work. That assumes average ARR of $78k and that the gap is causal, which is unproven. Intacct also appears in 31% of lost deals. SSO and SCIM costs 5 weeks and covers $1.2M of pipeline plus 11 existing accounts' security reviews. Dynamics is 12 weeks for 3% of customers and 8% of lost deals, and it serves new-logo growth, so it is stretch.

4. Controls before virtual cards. Both need v2 live, so both follow cutover. 31 CFOs asked for real-time controls against 26 for virtual cards. The 4 Approvals & Policy weeks for controls fit in Q1, before procurement takes that squad's capacity. Virtual cards is the only card item we can size: $410M × 10–25% capture × 1.1% ≈ $0.5–1.1M. The $410M is extrapolated from our 60 largest accounts, so it is probably high. This is a judgment call. Swapping the order is cheap, but the Approvals & Policy slot would collide with the procurement build.

5. Procurement: build it, resize the promise. At $8 × 10% of a 700-person company's employees, a customer pays $6,720 a year. Even 100% attach across 1,100 customers is $7.4M, so $6M needs ~890 customers (81%). Two of six design partners would pay (33%), and four already own a procurement tool. At 10–33% attach, year-one ARR is $0.7–2.5M, and with GA in Q3 only a small part lands before Q3 ends. It is still worth building: it is our only new paid module, it recurs, and it matches the board's "more modules" lever. But it is not a path to 112% on its own.

The arithmetic: 8 points of NRR on $86M is ~$6.9M. Sized items total roughly $4–6M of exit run-rate: entities $1.9M, Intacct $0.9M, virtual cards $0.5–1.1M, and procurement $0.7–2.5M (mostly after Q3). Controls and SSO retention are unsized upside. Recognised NRR at Q3 will lag run-rate because late launches haven't ramped.

What I changed from Tom's draft

• New squads count as zero. Last year's three squads took 5, 6 and 8 months from approval to first full sprint, then delivered half capacity in their first quarter. From a September approval, squad A is likely in seat between February and May and squad B later. A realistic ~5 weeks in Q2 and ~11 in Q3 for A, plus ~5 in Q3 for B, is about 22 weeks, against 55 in the draft. Even at Tom's capacity, procurement (36 weeks) couldn't launch in Q2, because squad A would have 22 weeks by the end of Q2.
• Procurement moves to Approvals & Policy. They own the domain and, in the draft, have no work after Q4. Expenses and Platform lend 9 weeks each (≈6 A&P-weeks each) to get a beta by the end of Q2 and GA in Q3. New squads join as upside.
• Mobile moves to Expenses. The draft puts it on squad B, which may not exist until Q3. Expenses has ~38 uncommitted weeks, and the rewrite ships in Q3, ahead of the late-2027 framework cutoff.
• Controls before virtual cards (point 4 above).
• Intacct GA moves from Q4 to Q1 to fund the v2 help. The cost is roughly one quarter of a ~$0.9M-a-year benefit, about $0.2M.
• Q3's "everyone else: adoption" is replaced by a held reserve, because adoption isn't squad work and Q3 launches can't move FY27 NRR much.
• A procurement checkpoint is added at the end of Q1 (see risks).

What we're not doing

• Dynamics, beyond a stretch start in Q2–Q3.
• A Q2 procurement launch, or putting the $6M figure in front of the board.
• Any new Cards scope before cutover.
• A mobile rewrite staffed by a squad that doesn't exist yet.
• Planning on capacity from squads we haven't hired.

Risks that could change the plan

1. Processor timeline. If v2 isn't code-complete by 31 January, Platform joins Cards and controls and virtual cards slip a quarter. Two asks for this month: a written fallback or extension from the processor, and confirmation that feature work behind flags is allowed during the certification freeze (my assumption). Book the certification slot now.
2. Procurement demand. At the end-of-Q1 gate I propose requiring at least 10 signed paid commitments at $8 from ~30 accounts approached (≈$67k ARR). If we miss it, we cut scope and redirect Approvals & Policy and the lenders to multi-entity rollout and card-spend work. The threshold is my proposal and is open to debate.
3. The NRR target itself. Exec decision: hold 112% as a Q3 recognised-NRR target, or restate it as an exit run-rate target, which I think is achievable only with upside from controls and procurement.
4. Evidence quality. The $410M is extrapolated from our largest accounts. The Intacct churn gap is a correlation. The multi-entity sizing rests on 14 of 60 customers. Any could be off by a factor of two.
5. Lending efficiency. The 1.5× penalty is an average. Expenses and Platform have less procurement context, and if they're slower than assumed, GA slips into Q4.
6. Hiring. If squad A lands in February, procurement GA can move earlier. If squad B lands late, nothing in the plan changes.
7. Mobile date. The CTO should confirm the exact end-of-support date and whether an in-place upgrade avoids a 22-week rewrite. Q4's scoping work answers this.

Harbor FY27 roadmap — Q4 2026 to Q3 2027

Planning basis: Each existing squad has about 11 roadmap squad-weeks per quarter. Figures below are the candidate-work estimates; capacity not assigned to a feature is deliberately held for launch, customer activation, fixes and contingency. New squads are not counted at full capacity until their ramp is proven.

New Squads A and B: Plan for onboarding and ramp, not full feature capacity. When productive, use them for bounded rollout, quality or activation work. No committed launch depends on their availability.

Case for the plan

Why this order

The board’s priority is to move NRR from 104% to 112% by the end of Q3, primarily through expansion in existing customers. The plan therefore favors credible opportunities to retain customers or deepen their use of Harbor, while keeping some room for new-logo needs.

First, v2 is a hard dependency and a hard deadline. All authorisations still run through v1, which retires on 31 March. The 18 Cards squad-weeks consume 11 weeks in Q4 and seven in Q1. That leaves time to finish implementation before the processor’s four-week certification and to keep the required freeze during testing. Virtual cards and real-time controls must wait until certification is complete.

Next, multi-entity has concrete expansion evidence: 14 of the 60 largest customers asked, and nine have said in writing that they would add subsidiaries. The $2.9M ARR estimate assumes all 52 subsidiaries join, so it is an upside case, not a commitment. Completing the Platform and Approvals & Policy work across Q4 and Q1 creates a path to test that demand with real rollouts.

Virtual cards are the first post-migration Cards feature because 26 large customers asked for them and Finance estimates $410M of annual subscription spend is currently elsewhere. At Harbor’s 1.1% net interchange, full capture would represent about $4.5M in annual interchange revenue, but that is a ceiling, not a forecast: the spend estimate is extrapolated, and adoption and capture are unknown. Real-time controls follow, with coordinated work across Cards and Approvals & Policy. The 31 CFO requests are strong demand evidence, but the plan avoids trying to fit both features into Cards’ 11-week quarterly capacity.

Intacct comes before Dynamics. Intacct is used by 17% of customers through CSV, and those customers have higher observed gross revenue churn than customers on NetSuite. That comparison is correlational, but it supports addressing a retention risk. Dynamics has lower existing use (3%) and a more limited new-logo case, but the 8% of lost deals citing it justifies completing the 12-week integration after Intacct.

SSO/SCIM is a relatively small, five-week Platform investment tied to five enterprise deals representing $1.2M of pipeline and 11 existing security reviews. It supports commercial outcomes without displacing the larger expansion bets.

What changed from Tom’s draft

• Removed procurement from committed build and launch. Six design partners are not enough evidence for the board’s $6M first-year ARR claim: only two said they would pay, and four already use another tool. At the proposed price, an average 700-employee customer would generate about $6,720 ARR if 10% of employees were buyers. Reaching $6M would require roughly 893 such customer equivalents. We should validate willingness to switch and pricing before committing 30 Approvals & Policy and six Integrations squad-weeks.
• Corrected the hiring assumption. Prior squads took five to eight months from approval to a first full sprint and delivered about half capacity in their first quarter. The plan does not count either new squad at full capacity in Q1 or Q2, or make a feature dependent on them.
• Made the v2 critical path explicit. The migration spans Q4 and Q1, with implementation targeted ahead of March certification. Tom’s draft did not protect that freeze clearly enough.
• Sequenced Cards work to fit capacity. Virtual cards and real-time controls require 18 Cards squad-weeks together, more than one quarter’s 11-week capacity. They are sequenced across Q2 and Q3.
• Started the mobile rewrite with the existing Expenses squad. The work is 22 weeks, so starting in Q1 targets completion in Q2 without relying on an unproven new squad.

What we are not doing

We are not committing to build procurement, starting a mobile rewrite with a new squad at assumed full capacity, or taking on another major integration or platform feature in Q3 without evidence from the launches above. New-logo work remains in the plan, but expansion and retention come first.

Risks that could change the plan

• Processor timing: Any migration slip puts card authorisations at risk. Track delivery and certification weekly; protect the Q1 card schedule and do not pull dependent features forward.
• Expansion may not materialize: Multi-entity interest and card requests do not guarantee adoption or spend migration. Track subsidiary activation, card spend moved, and controls usage—not just releases.
• Commercial estimates are uncertain: The $2.9M multi-entity estimate and $4.5M card-spend ceiling are not forecasts. Procurement’s $6M claim is especially unsupported by current evidence.
• Mobile has little slack: The 22-week rewrite fills two quarters of Expenses capacity. Scope growth, delivery delays or an earlier-than-expected framework deadline would require replanning.
• Hiring, integration and cross-squad delivery may slip: Ramp timing is uncertain; the Intacct churn difference may not be caused by the integration; and spend controls depend on coordinated Cards and Approvals & Policy work.

This roadmap gives Harbor credible bets aligned to the NRR goal, but it does not establish that the 112% target is guaranteed. We should review expansion and retention indicators at each quarterly planning checkpoint and change the plan if customer evidence or delivery risk materially shifts.