Build a roadmap

Harbor Roadmap, Q4 2026 to Q3 2027

Q4 2026 (now)

Q1 2027

Q2 2027

Q3 2027

Later (Q4 2027 onward, gated): Procurement paid launch, only if the Q1 pricing gate is passed. Most procurement ARR lands in FY28.

---

The Case

The headline: 112% is not reachable in FY27

NRR is 104%. Reaching 112% by Q3 2027 means about $6.9M of additional net expansion ARR on our $86M base. My estimates for what this plan delivers inside the window:

• Multi-entity: $1.2–1.9M. The ceiling is $2.9M if all 52 subsidiaries join. Nine of 14 customers have committed in writing, which is not the same as signed.
• Virtual cards and spend controls: $0.4–0.7M. Interchange is 1.1%, so $410M of subscription spend is worth $4.5M at full capture. I assume 10–15% capture in-year. The $410M is extrapolated from 60 accounts.
• Intacct churn reduction: $0.4–0.9M. This assumes Intacct-using ARR is roughly 17% of the base (~$15M) and that the 6-point churn gap is caused by the CSV workflow, not by the customers themselves.
• Procurement: near zero.

That totals $2.0–3.5M, which takes NRR to roughly 106–108%. Procurement is the only item big enough to close the gap, and it cannot deliver inside FY27. Tom's note says procurement can add $6M in its first year. $6M is about 80% of the theoretical ceiling (1,100 customers × 70 requesters × $96 a year ≈ $7.4M), and only 2 of 6 design partners said they would pay. Even if the first-year number holds, the timing means it lands in FY28.

The board needs this correction before the offsite ends. Tom should brief the chair before the board sees a revised NRR path. I suggest we present 106–108% for FY27 with a path to 112% in FY28 and set out what would have to be true to close the gap.

Why this order

1. Protect the base first. The v2 migration is the only hard deadline. Every card authorisation depends on it. Cards is planned with about two weeks of slack: migration complete by 15 Feb, 4 weeks of certification, cut-over by mid-March. The Cards squad is ring-fenced until cut-over, and I want a go/no-go on 15 Feb.
2. Put the cheap, high-demand items first. SSO/SCIM is 5 squad-weeks and unlocks $1.2M of pipeline and 11 security reviews. Multi-entity is the largest in-year expansion lever and has written demand. Intacct is 9 squad-weeks against a 13% churn rate on 17% of customers.
3. Use squads that exist. Expenses can build the mobile rewrite with its own capacity by Q2. That ships before the framework's late-2027 end of support without waiting for a new squad.
4. Gate procurement. The build is 30 squad-weeks of Approvals & Policy work on a product where only a third of design partners have said they would pay. We build it, but the pricing decision comes at the end of Q1.

What I changed from Tom's draft, and why

What we're not doing

• Procurement at full scope before the Q1 pricing gate. If fewer than three of six design partners commit to a paid pilot at $8 per user, we cut scope and move capacity to other work.
• Dynamics as a committed FY27 item. It fits in spare capacity. It does not get priority over anything else.
• Mobile in a new squad. Expenses owns it.
• Platform-led procurement work. Platform has about 16 spare squad-weeks in Q1–Q2 and could absorb procurement sub-components at 1.5× cost if the gate passes. We don't plan that yet.
• Any NRR commitment above 108% for FY27 in board materials.

Risks that could change the plan

1. The v2 migration slips past the certification window. This is the existential risk. If migration is not code-complete by about 22 February, we miss 31 March. Mitigations: ring-fence Cards from January, book a certification slot with the processor now, and agree a contingency with the processor in writing.
2. New squads ramp slower than planned. Each month of delay pushes multi-entity onboarding, procurement and Dynamics later. Procurement is most exposed because Approvals & Policy is already at zero slack.
3. Procurement demand is weaker than the evidence suggests. Two of six design partners would pay, and four already use a dedicated tool. The Q1 gate exists for this reason.
4. Virtual card and interchange sizing is soft. The $410M is extrapolated from 60 accounts. Capture is an assumption.
5. Intacct churn may not be caused by the CSV workflow. If the churn gap is about customer type rather than integration, the retention benefit is smaller.
6. Multi-entity commitments are not contracts. Nine written commitments are real signals, but pricing for subsidiaries still needs to be set and sold.
7. Mobile slips past Q3. Expenses has about 5 spare squad-weeks in Q2 and Q3 for launch fixes. A slip beyond Q3 puts us close to the framework's end of support.

Decisions needed at the offsite

1. Approve the revised FY27 NRR range (106–108%) and agree how Tom briefs the board.
2. Confirm the 15 February v2 checkpoint and the Cards ring-fence.
3. Approve the procurement build with the Q1 pricing gate and a pre-agreed cut scope.
4. Move mobile into Expenses and release squad B to Integrations.

Harbor FY27 roadmap — Q4 2026 to Q3 2027

Planning basis: Each existing squad has about 11 roadmap squad-weeks per quarter. Figures below are the candidate-work estimates; capacity not assigned to a feature is deliberately held for launch, customer activation, fixes and contingency. New squads are not counted at full capacity until their ramp is proven.

New Squads A and B: Plan for onboarding and ramp, not full feature capacity. When productive, use them for bounded rollout, quality or activation work. No committed launch depends on their availability.

Case for the plan

Why this order

The board’s priority is to move NRR from 104% to 112% by the end of Q3, primarily through expansion in existing customers. The plan therefore favors credible opportunities to retain customers or deepen their use of Harbor, while keeping some room for new-logo needs.

First, v2 is a hard dependency and a hard deadline. All authorisations still run through v1, which retires on 31 March. The 18 Cards squad-weeks consume 11 weeks in Q4 and seven in Q1. That leaves time to finish implementation before the processor’s four-week certification and to keep the required freeze during testing. Virtual cards and real-time controls must wait until certification is complete.

Next, multi-entity has concrete expansion evidence: 14 of the 60 largest customers asked, and nine have said in writing that they would add subsidiaries. The $2.9M ARR estimate assumes all 52 subsidiaries join, so it is an upside case, not a commitment. Completing the Platform and Approvals & Policy work across Q4 and Q1 creates a path to test that demand with real rollouts.

Virtual cards are the first post-migration Cards feature because 26 large customers asked for them and Finance estimates $410M of annual subscription spend is currently elsewhere. At Harbor’s 1.1% net interchange, full capture would represent about $4.5M in annual interchange revenue, but that is a ceiling, not a forecast: the spend estimate is extrapolated, and adoption and capture are unknown. Real-time controls follow, with coordinated work across Cards and Approvals & Policy. The 31 CFO requests are strong demand evidence, but the plan avoids trying to fit both features into Cards’ 11-week quarterly capacity.

Intacct comes before Dynamics. Intacct is used by 17% of customers through CSV, and those customers have higher observed gross revenue churn than customers on NetSuite. That comparison is correlational, but it supports addressing a retention risk. Dynamics has lower existing use (3%) and a more limited new-logo case, but the 8% of lost deals citing it justifies completing the 12-week integration after Intacct.

SSO/SCIM is a relatively small, five-week Platform investment tied to five enterprise deals representing $1.2M of pipeline and 11 existing security reviews. It supports commercial outcomes without displacing the larger expansion bets.

What changed from Tom’s draft

• Removed procurement from committed build and launch. Six design partners are not enough evidence for the board’s $6M first-year ARR claim: only two said they would pay, and four already use another tool. At the proposed price, an average 700-employee customer would generate about $6,720 ARR if 10% of employees were buyers. Reaching $6M would require roughly 893 such customer equivalents. We should validate willingness to switch and pricing before committing 30 Approvals & Policy and six Integrations squad-weeks.
• Corrected the hiring assumption. Prior squads took five to eight months from approval to a first full sprint and delivered about half capacity in their first quarter. The plan does not count either new squad at full capacity in Q1 or Q2, or make a feature dependent on them.
• Made the v2 critical path explicit. The migration spans Q4 and Q1, with implementation targeted ahead of March certification. Tom’s draft did not protect that freeze clearly enough.
• Sequenced Cards work to fit capacity. Virtual cards and real-time controls require 18 Cards squad-weeks together, more than one quarter’s 11-week capacity. They are sequenced across Q2 and Q3.
• Started the mobile rewrite with the existing Expenses squad. The work is 22 weeks, so starting in Q1 targets completion in Q2 without relying on an unproven new squad.

What we are not doing

We are not committing to build procurement, starting a mobile rewrite with a new squad at assumed full capacity, or taking on another major integration or platform feature in Q3 without evidence from the launches above. New-logo work remains in the plan, but expansion and retention come first.

Risks that could change the plan

• Processor timing: Any migration slip puts card authorisations at risk. Track delivery and certification weekly; protect the Q1 card schedule and do not pull dependent features forward.
• Expansion may not materialize: Multi-entity interest and card requests do not guarantee adoption or spend migration. Track subsidiary activation, card spend moved, and controls usage—not just releases.
• Commercial estimates are uncertain: The $2.9M multi-entity estimate and $4.5M card-spend ceiling are not forecasts. Procurement’s $6M claim is especially unsupported by current evidence.
• Mobile has little slack: The 22-week rewrite fills two quarters of Expenses capacity. Scope growth, delivery delays or an earlier-than-expected framework deadline would require replanning.
• Hiring, integration and cross-squad delivery may slip: Ramp timing is uncertain; the Intacct churn difference may not be caused by the integration; and spend controls depend on coordinated Cards and Approvals & Policy work.

This roadmap gives Harbor credible bets aligned to the NRR goal, but it does not establish that the 112% target is guaranteed. We should review expansion and retention indicators at each quarterly planning checkpoint and change the plan if customer evidence or delivery risk materially shifts.

Harbor Roadmap, Q4 2026 to Q3 2027

Pre-read for the planning offsite. Prepared from Tom's draft.

Part 1: The roadmap

Planning assumptions - Each existing squad has 11 squad-weeks of roadmap capacity a quarter. Work done in another squad's area costs 1.5×. - The two new squads are planned at the dates our history supports, not the approved dates. Last year's squads took 5 to 8 months from approval to their first full sprint. - Squad A: 0 weeks in Q1, about 5 in Q2 (half capacity), about 11 in Q3. - Squad B: 0 weeks in Q2, about 5 in Q3. - Nothing committed depends on either new squad. - The fiscal year runs Q4 2026 (Oct to Dec) through Q3 2027 (Jul to Sep).

Squad plan by quarter (squad-weeks in brackets)

Items, outcomes and key dates

NRR bridge: what this plan plausibly delivers by end of Q3 2027

Moving NRR from 104% to 112% needs about $6.9M of additional net expansion (8 points of $86M).

---

Part 2: The case for it

The short version

Tom's draft has the right ingredients. It does, however, have three problems:

1. No buffer on the processor deadline. The migration has no room to slip against a date that could stop every card authorisation.
2. Key work sits on squads we won't have. Procurement and the mobile rewrite depend on new squads that history says won't exist at full capacity until Q3 at the earliest.
3. Procurement can't carry the goal. It is expected to deliver the NRR target, but the evidence doesn't support $6M and the timing puts almost none of it inside the measurement window.

This plan protects the deadline first. It then sequences the levers with the strongest evidence so they land early enough to count. Even so, product alone likely gets us to 107% to 110%, not 112%. The exec team should know that now, not in Q3.

Why this order

1. The processor migration comes first, with buffer.

Every authorisation runs through v1, so a missed cutover puts most of our revenue at risk. On Tom's draft: - Cards alone finishes the 18 weeks around late February. - The 4-week certification then ends in the last days of March. - That leaves under a week of slack, with December holidays not counted and no room for a failed certification.

Lending 5 Platform weeks in Q4 changes this: - Code complete moves to about 31 January. - Cutover lands around 1 March. - We have roughly four weeks of buffer.

This also means virtual cards can't "start in Q1" as the draft says. During certification nothing on our card stack can change. Cards will do design and sandbox work in Q1 and start production work after cutover.

2. Multi-entity and virtual cards next, because they have the best evidence and they land in time.

NRR is measured at the end of Q3, so anything launching after about June barely counts. Our two strongest levers are: - Multi-entity: 9 customers have committed in writing to add subsidiaries, which is about $1.5M to $2.9M. - Virtual cards: a $4.5M ceiling. 26 of our 60 largest customers asked for them.

Multi-entity ships in February. Virtual cards ship in May. Real-time spend controls follow in July because they share the Cards squad. They matter to 31 CFOs, but we haven't sized them.

3. Retention work runs in parallel, because it is cheap.

• Intacct: 9 weeks of work. It addresses a segment churning at nearly twice our NetSuite rate and appears in 31% of lost deals. The integration only reduces churn if customers actually move off CSV, so I added a Q1 migration push with CS.
• SSO and SCIM: 5 weeks of work. It protects 11 accounts and unblocks $1.2M of pipeline.

4. Procurement is real but gated, and it is not the FY27 lever.

What I changed from Tom's draft, and why

1. Migration buffer. Platform lends 5 weeks in Q4. The cost is that multi-entity moves from December to February. I think that trade is clearly right, because the downside of a missed cutover is existential.

2. New squads planned realistically. - Squads approved in September reach their first full sprint between February and May, based on last year's 5 to 8 months. - Each then runs at half capacity for a quarter. - Squad A realistically gives about 5 weeks in Q2. Squad B gives nothing before Q3. - I've kept every committed item on the existing five squads. The new squads are upside.

3. Procurement moved to Approvals & Policy and gated. - A&P owns the domain, has capacity after multi-entity, and was left without work in the draft. - Build starts in Q1. At the end of March we need signed paid-pilot commitments from about 10 customers beyond the two design partners, or we redirect A&P. - GA lands around September. If Squad A arrives on time, it accelerates the work.

4. The $6M procurement figure needs resetting with the board. - At $8 per user per month and 10% of our ~770,000 employees raising requests, the ceiling is about $7.4M a year if every customer adopts. $6M therefore implies about 81% adoption. - Only 2 of 6 design partners said they'd pay. The other four already use a dedicated tool. - At a one-in-three adoption rate, procurement is worth about $2.5M at full run-rate, reached over years, and less than $0.3M inside FY27. - I recommend Tom and the CFO correct this at the next board touchpoint, before the board starts tracking it.

5. Mobile rewrite moved to Expenses, starting in Q4. - Expenses owns the app and the draft left it idle after Q4. - The rewrite finishes by May, and the old app is retired by September. - This gives the CTO's deadline real margin. Leaving it on Squad B would risk missing it.

1. Spend controls now include the A&P work (4 weeks). The draft omitted this.

1. Dynamics moves from Q1 to May. The Intacct customer migration goes first, because Intacct matters roughly five times more by customer count and lost deals.

What we're not doing

• Not claiming procurement drives FY27 NRR. We are also not building past the March gate without paid commitments.
• Not starting virtual cards or anything else on the card stack before cutover.
• Not putting any deadline-critical or NRR-critical work on unhired squads.
• Not adding new-logo-only features beyond Intacct, Dynamics and SSO, which also serve retention. New logos come second this year, as the board set.
• Not filling the Q3 reserve on Platform and Integrations. That slack absorbs migration fallout, integration hardening and new-squad onboarding. If the migration goes cleanly, we can release it to card-spend adoption work at Q2 planning.

Risks that could change the plan

1. Certification fails or needs a second round. A re-run would consume the entire buffer. - Book the certification slot now. - Run a pre-certification dry run in January. - Ask the processor in writing for a contingency extension and an emergency-fix protocol for the freeze window. - If code complete slips past mid-February, pull more Platform capacity immediately.

2. The $410M software-spend figure is extrapolated from our 60 largest accounts. Smaller customers may put proportionally less software spend on cards. - In Q4, validate it with AP data from about 20 mid-sized customers. - If it halves, virtual cards is worth about $0.4M to $0.8M in window and spend controls rises in priority.

1. Multi-entity conversion comes in below the written commitments. CS should agree subsidiary onboarding plans with the 9 customers in Q1, before the feature ships.

1. Real-time spend controls sit on the authorisation path. A latency problem could cause false declines. Platform supports this work in Q3, and we should launch in stages.

1. Hiring slips further. This doesn't threaten committed dates, but procurement would stay in Q3 and our adoption capacity shrinks.

1. The procurement gate fails. A&P redirects to deeper spend controls and multi-entity policy features, both of which feed card spend.

1. The mobile framework end-of-support date is only "late 2027". The CTO should confirm the exact date.

Decisions we need at the offsite

1. Approve Platform's Q4 loan to Cards, accepting that multi-entity moves to February.
2. Agree the board message on procurement, and the gate criteria behind it.
3. Close the NRR gap. This plan lands about 107% to 110%. Closing the remaining $1.5M to $4M needs commercial levers the CRO and CFO own, such as CS-led card activation, packaging and pricing, and a multi-entity sales motion beyond the 9. Otherwise we tell the board now that 112% is a stretch.
4. Authorise the processor extension request.