Port trust center features after main rebase

Move Emile's commitment CRUD into complianceportal management, wire console and visitor GraphQL, and drop portal magic-link sign-in in favor of OAuth /initiate while keeping documents, NDA/full-name gates, and access-request resume markers. Signed-off-by: Bryan Frimin <bryan@probo.com>
2026-07-17 17:06:33 +02:00
parent b221b17d1e
commit bc128ec516
29 changed files with 898 additions and 1023 deletions
--- a/pkg/complianceportal/management/actions.go
+++ b/pkg/complianceportal/management/actions.go
@@ -41,6 +41,20 @@ const (
 	ActionCompliancePortalReferenceUpdate     = "compliance-portal:portal-reference:update"
 	ActionCompliancePortalReferenceDelete     = "compliance-portal:portal-reference:delete"

+	// Compliance portal commitment group actions.
+	ActionCompliancePortalCommitmentGroupList       = "compliance-portal:commitment-group:list"
+	ActionCompliancePortalCommitmentGroupCreate     = "compliance-portal:commitment-group:create"
+	ActionCompliancePortalCommitmentGroupUpdate     = "compliance-portal:commitment-group:update"
+	ActionCompliancePortalCommitmentGroupUpdateRank = "compliance-portal:commitment-group:update-rank"
+	ActionCompliancePortalCommitmentGroupDelete     = "compliance-portal:commitment-group:delete"
+
+	// Compliance portal commitment actions.
+	ActionCompliancePortalCommitmentList       = "compliance-portal:commitment:list"
+	ActionCompliancePortalCommitmentCreate     = "compliance-portal:commitment:create"
+	ActionCompliancePortalCommitmentUpdate     = "compliance-portal:commitment:update"
+	ActionCompliancePortalCommitmentUpdateRank = "compliance-portal:commitment:update-rank"
+	ActionCompliancePortalCommitmentDelete     = "compliance-portal:commitment:delete"
+
 	// Compliance portal file actions.
 	ActionCompliancePortalFileGet        = "compliance-portal:portal-file:get"
 	ActionCompliancePortalFileList       = "compliance-portal:portal-file:list"
--- a/pkg/complianceportal/management/commitment_group_service.go
+++ b/pkg/complianceportal/management/commitment_group_service.go
@@ -18,7 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 // SOFTWARE.

-package probo
+package management

 import (
 	"context"
@@ -33,10 +33,6 @@ import (
 )

 type (
-	CompliancePortalCommitmentGroupService struct {
-		svc *Service
-	}
-
 	CreateCompliancePortalCommitmentGroupRequest struct {
 		TrustCenterID gid.GID
 		Title         string
@@ -71,7 +67,7 @@ func (r *UpdateCompliancePortalCommitmentGroupRequest) Validate() error {
 	return v.Error()
 }

-func (s CompliancePortalCommitmentGroupService) ListForTrustCenterID(
+func (s *Service) ListCommitmentGroups(
 	ctx context.Context,
 	scope coredata.Scoper,
 	trustCenterID gid.GID,
@@ -79,14 +75,17 @@ func (s CompliancePortalCommitmentGroupService) ListForTrustCenterID(
 ) (*page.Page[*coredata.CompliancePortalCommitmentGroup, coredata.CompliancePortalCommitmentGroupOrderField], error) {
 	var groups coredata.CompliancePortalCommitmentGroups

-	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		err := groups.LoadByTrustCenterID(ctx, conn, scope, trustCenterID, cursor)
-		if err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment groups: %w", err)
-		}
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := groups.LoadByTrustCenterID(ctx, conn, scope, trustCenterID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment groups: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -94,23 +93,26 @@ func (s CompliancePortalCommitmentGroupService) ListForTrustCenterID(
 	return page.NewPage(groups, cursor), nil
 }

-func (s CompliancePortalCommitmentGroupService) CountForTrustCenterID(
+func (s *Service) CountCommitmentGroups(
 	ctx context.Context,
 	scope coredata.Scoper,
 	trustCenterID gid.GID,
 ) (int, error) {
 	var count int

-	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) (err error) {
-		groups := coredata.CompliancePortalCommitmentGroups{}
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) (err error) {
+			groups := coredata.CompliancePortalCommitmentGroups{}

-		count, err = groups.CountByTrustCenterID(ctx, conn, scope, trustCenterID)
-		if err != nil {
-			return fmt.Errorf("cannot count compliance portal commitment groups: %w", err)
-		}
+			count, err = groups.CountByTrustCenterID(ctx, conn, scope, trustCenterID)
+			if err != nil {
+				return fmt.Errorf("cannot count compliance portal commitment groups: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return 0, err
 	}
@@ -118,21 +120,24 @@ func (s CompliancePortalCommitmentGroupService) CountForTrustCenterID(
 	return count, nil
 }

-func (s CompliancePortalCommitmentGroupService) Get(
+func (s *Service) GetCommitmentGroup(
 	ctx context.Context,
 	scope coredata.Scoper,
 	groupID gid.GID,
 ) (*coredata.CompliancePortalCommitmentGroup, error) {
 	var group coredata.CompliancePortalCommitmentGroup

-	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		err := group.LoadByID(ctx, conn, scope, groupID)
-		if err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
-		}
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := group.LoadByID(ctx, conn, scope, groupID)
+			if err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -140,7 +145,7 @@ func (s CompliancePortalCommitmentGroupService) Get(
 	return &group, nil
 }

-func (s CompliancePortalCommitmentGroupService) Create(
+func (s *Service) CreateCommitmentGroup(
 	ctx context.Context,
 	scope coredata.Scoper,
 	req *CreateCompliancePortalCommitmentGroupRequest,
@@ -155,28 +160,31 @@ func (s CompliancePortalCommitmentGroupService) Create(

 	var group *coredata.CompliancePortalCommitmentGroup

-	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
-		trustCenter := &coredata.TrustCenter{}
-		if err := trustCenter.LoadByID(ctx, tx, scope, req.TrustCenterID); err != nil {
-			return fmt.Errorf("cannot load trust center: %w", err)
-		}
+	err := s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			trustCenter := &coredata.TrustCenter{}
+			if err := trustCenter.LoadByID(ctx, tx, scope, req.TrustCenterID); err != nil {
+				return fmt.Errorf("cannot load trust center: %w", err)
+			}

-		group = &coredata.CompliancePortalCommitmentGroup{
-			ID:             groupID,
-			OrganizationID: trustCenter.OrganizationID,
-			TrustCenterID:  req.TrustCenterID,
-			Title:          req.Title,
-			Description:    req.Description,
-			CreatedAt:      now,
-			UpdatedAt:      now,
-		}
+			group = &coredata.CompliancePortalCommitmentGroup{
+				ID:             groupID,
+				OrganizationID: trustCenter.OrganizationID,
+				TrustCenterID:  req.TrustCenterID,
+				Title:          req.Title,
+				Description:    req.Description,
+				CreatedAt:      now,
+				UpdatedAt:      now,
+			}

-		if err := group.Insert(ctx, tx, scope); err != nil {
-			return fmt.Errorf("cannot insert compliance portal commitment group: %w", err)
-		}
+			if err := group.Insert(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot insert compliance portal commitment group: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -184,7 +192,7 @@ func (s CompliancePortalCommitmentGroupService) Create(
 	return group, nil
 }

-func (s CompliancePortalCommitmentGroupService) Update(
+func (s *Service) UpdateCommitmentGroup(
 	ctx context.Context,
 	scope coredata.Scoper,
 	req *UpdateCompliancePortalCommitmentGroupRequest,
@@ -197,36 +205,39 @@ func (s CompliancePortalCommitmentGroupService) Update(

 	var group *coredata.CompliancePortalCommitmentGroup

-	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
-		group = &coredata.CompliancePortalCommitmentGroup{}
+	err := s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			group = &coredata.CompliancePortalCommitmentGroup{}

-		if err := group.LoadByID(ctx, tx, scope, req.ID); err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
-		}
-
-		if req.Title != nil {
-			group.Title = *req.Title
-		}
-
-		if req.Description != nil {
-			group.Description = *req.Description
-		}
-
-		group.UpdatedAt = now
-
-		if req.Rank != nil {
-			group.Rank = *req.Rank
-			if err := group.UpdateRank(ctx, tx, scope); err != nil {
-				return fmt.Errorf("cannot update rank: %w", err)
+			if err := group.LoadByID(ctx, tx, scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
 			}
-		}

-		if err := group.Update(ctx, tx, scope); err != nil {
-			return fmt.Errorf("cannot update compliance portal commitment group: %w", err)
-		}
+			if req.Title != nil {
+				group.Title = *req.Title
+			}

-		return nil
-	})
+			if req.Description != nil {
+				group.Description = *req.Description
+			}
+
+			group.UpdatedAt = now
+
+			if req.Rank != nil {
+				group.Rank = *req.Rank
+				if err := group.UpdateRank(ctx, tx, scope); err != nil {
+					return fmt.Errorf("cannot update rank: %w", err)
+				}
+			}
+
+			if err := group.Update(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot update compliance portal commitment group: %w", err)
+			}
+
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -234,24 +245,27 @@ func (s CompliancePortalCommitmentGroupService) Update(
 	return group, nil
 }

-func (s CompliancePortalCommitmentGroupService) Delete(
+func (s *Service) DeleteCommitmentGroup(
 	ctx context.Context,
 	scope coredata.Scoper,
 	groupID gid.GID,
 ) error {
-	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
-		group := &coredata.CompliancePortalCommitmentGroup{}
+	err := s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			group := &coredata.CompliancePortalCommitmentGroup{}

-		if err := group.LoadByID(ctx, tx, scope, groupID); err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
-		}
+			if err := group.LoadByID(ctx, tx, scope, groupID); err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
+			}

-		if err := group.Delete(ctx, tx, scope); err != nil {
-			return fmt.Errorf("cannot delete compliance portal commitment group: %w", err)
-		}
+			if err := group.Delete(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot delete compliance portal commitment group: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)

 	return err
 }
--- a/pkg/complianceportal/management/commitment_service.go
+++ b/pkg/complianceportal/management/commitment_service.go
@@ -18,7 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 // SOFTWARE.

-package probo
+package management

 import (
 	"context"
@@ -33,10 +33,6 @@ import (
 )

 type (
-	CompliancePortalCommitmentService struct {
-		svc *Service
-	}
-
 	CreateCompliancePortalCommitmentRequest struct {
 		GroupID     gid.GID
 		Icon        coredata.CompliancePortalCommitmentIcon
@@ -83,7 +79,7 @@ func (r *UpdateCompliancePortalCommitmentRequest) Validate() error {
 	return v.Error()
 }

-func (s CompliancePortalCommitmentService) ListForGroupID(
+func (s *Service) ListCommitments(
 	ctx context.Context,
 	scope coredata.Scoper,
 	groupID gid.GID,
@@ -91,14 +87,17 @@ func (s CompliancePortalCommitmentService) ListForGroupID(
 ) (*page.Page[*coredata.CompliancePortalCommitment, coredata.CompliancePortalCommitmentOrderField], error) {
 	var commitments coredata.CompliancePortalCommitments

-	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		err := commitments.LoadByGroupID(ctx, conn, scope, groupID, cursor)
-		if err != nil {
-			return fmt.Errorf("cannot load compliance portal commitments: %w", err)
-		}
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := commitments.LoadByGroupID(ctx, conn, scope, groupID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load compliance portal commitments: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -106,23 +105,26 @@ func (s CompliancePortalCommitmentService) ListForGroupID(
 	return page.NewPage(commitments, cursor), nil
 }

-func (s CompliancePortalCommitmentService) CountForGroupID(
+func (s *Service) CountCommitments(
 	ctx context.Context,
 	scope coredata.Scoper,
 	groupID gid.GID,
 ) (int, error) {
 	var count int

-	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) (err error) {
-		commitments := coredata.CompliancePortalCommitments{}
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) (err error) {
+			commitments := coredata.CompliancePortalCommitments{}

-		count, err = commitments.CountByGroupID(ctx, conn, scope, groupID)
-		if err != nil {
-			return fmt.Errorf("cannot count compliance portal commitments: %w", err)
-		}
+			count, err = commitments.CountByGroupID(ctx, conn, scope, groupID)
+			if err != nil {
+				return fmt.Errorf("cannot count compliance portal commitments: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return 0, err
 	}
@@ -130,21 +132,24 @@ func (s CompliancePortalCommitmentService) CountForGroupID(
 	return count, nil
 }

-func (s CompliancePortalCommitmentService) Get(
+func (s *Service) GetCommitment(
 	ctx context.Context,
 	scope coredata.Scoper,
 	commitmentID gid.GID,
 ) (*coredata.CompliancePortalCommitment, error) {
 	var commitment coredata.CompliancePortalCommitment

-	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		err := commitment.LoadByID(ctx, conn, scope, commitmentID)
-		if err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment: %w", err)
-		}
+	err := s.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := commitment.LoadByID(ctx, conn, scope, commitmentID)
+			if err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -152,7 +157,7 @@ func (s CompliancePortalCommitmentService) Get(
 	return &commitment, nil
 }

-func (s CompliancePortalCommitmentService) Create(
+func (s *Service) CreateCommitment(
 	ctx context.Context,
 	scope coredata.Scoper,
 	req *CreateCompliancePortalCommitmentRequest,
@@ -167,31 +172,34 @@ func (s CompliancePortalCommitmentService) Create(

 	var commitment *coredata.CompliancePortalCommitment

-	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
-		group := &coredata.CompliancePortalCommitmentGroup{}
-		if err := group.LoadByID(ctx, tx, scope, req.GroupID); err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
-		}
+	err := s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			group := &coredata.CompliancePortalCommitmentGroup{}
+			if err := group.LoadByID(ctx, tx, scope, req.GroupID); err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment group: %w", err)
+			}

-		commitment = &coredata.CompliancePortalCommitment{
-			ID:             commitmentID,
-			OrganizationID: group.OrganizationID,
-			TrustCenterID:  group.TrustCenterID,
-			GroupID:        req.GroupID,
-			Icon:           req.Icon,
-			Eyebrow:        req.Eyebrow,
-			Title:          req.Title,
-			Description:    req.Description,
-			CreatedAt:      now,
-			UpdatedAt:      now,
-		}
+			commitment = &coredata.CompliancePortalCommitment{
+				ID:             commitmentID,
+				OrganizationID: group.OrganizationID,
+				TrustCenterID:  group.TrustCenterID,
+				GroupID:        req.GroupID,
+				Icon:           req.Icon,
+				Eyebrow:        req.Eyebrow,
+				Title:          req.Title,
+				Description:    req.Description,
+				CreatedAt:      now,
+				UpdatedAt:      now,
+			}

-		if err := commitment.Insert(ctx, tx, scope); err != nil {
-			return fmt.Errorf("cannot insert compliance portal commitment: %w", err)
-		}
+			if err := commitment.Insert(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot insert compliance portal commitment: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -199,7 +207,7 @@ func (s CompliancePortalCommitmentService) Create(
 	return commitment, nil
 }

-func (s CompliancePortalCommitmentService) Update(
+func (s *Service) UpdateCommitment(
 	ctx context.Context,
 	scope coredata.Scoper,
 	req *UpdateCompliancePortalCommitmentRequest,
@@ -212,44 +220,47 @@ func (s CompliancePortalCommitmentService) Update(

 	var commitment *coredata.CompliancePortalCommitment

-	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
-		commitment = &coredata.CompliancePortalCommitment{}
+	err := s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			commitment = &coredata.CompliancePortalCommitment{}

-		if err := commitment.LoadByID(ctx, tx, scope, req.ID); err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment: %w", err)
-		}
-
-		if req.Icon != nil {
-			commitment.Icon = *req.Icon
-		}
-
-		if req.Eyebrow != nil {
-			commitment.Eyebrow = *req.Eyebrow
-		}
-
-		if req.Title != nil {
-			commitment.Title = *req.Title
-		}
-
-		if req.Description != nil {
-			commitment.Description = *req.Description
-		}
-
-		commitment.UpdatedAt = now
-
-		if req.Rank != nil {
-			commitment.Rank = *req.Rank
-			if err := commitment.UpdateRank(ctx, tx, scope); err != nil {
-				return fmt.Errorf("cannot update rank: %w", err)
+			if err := commitment.LoadByID(ctx, tx, scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment: %w", err)
 			}
-		}

-		if err := commitment.Update(ctx, tx, scope); err != nil {
-			return fmt.Errorf("cannot update compliance portal commitment: %w", err)
-		}
+			if req.Icon != nil {
+				commitment.Icon = *req.Icon
+			}

-		return nil
-	})
+			if req.Eyebrow != nil {
+				commitment.Eyebrow = *req.Eyebrow
+			}
+
+			if req.Title != nil {
+				commitment.Title = *req.Title
+			}
+
+			if req.Description != nil {
+				commitment.Description = *req.Description
+			}
+
+			commitment.UpdatedAt = now
+
+			if req.Rank != nil {
+				commitment.Rank = *req.Rank
+				if err := commitment.UpdateRank(ctx, tx, scope); err != nil {
+					return fmt.Errorf("cannot update rank: %w", err)
+				}
+			}
+
+			if err := commitment.Update(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot update compliance portal commitment: %w", err)
+			}
+
+			return nil
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -257,24 +268,27 @@ func (s CompliancePortalCommitmentService) Update(
 	return commitment, nil
 }

-func (s CompliancePortalCommitmentService) Delete(
+func (s *Service) DeleteCommitment(
 	ctx context.Context,
 	scope coredata.Scoper,
 	commitmentID gid.GID,
 ) error {
-	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
-		commitment := &coredata.CompliancePortalCommitment{}
+	err := s.pg.WithTx(
+		ctx,
+		func(ctx context.Context, tx pg.Tx) error {
+			commitment := &coredata.CompliancePortalCommitment{}

-		if err := commitment.LoadByID(ctx, tx, scope, commitmentID); err != nil {
-			return fmt.Errorf("cannot load compliance portal commitment: %w", err)
-		}
+			if err := commitment.LoadByID(ctx, tx, scope, commitmentID); err != nil {
+				return fmt.Errorf("cannot load compliance portal commitment: %w", err)
+			}

-		if err := commitment.Delete(ctx, tx, scope); err != nil {
-			return fmt.Errorf("cannot delete compliance portal commitment: %w", err)
-		}
+			if err := commitment.Delete(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot delete compliance portal commitment: %w", err)
+			}

-		return nil
-	})
+			return nil
+		},
+	)

 	return err
 }
--- a/pkg/complianceportal/management/policies.go
+++ b/pkg/complianceportal/management/policies.go
@@ -21,14 +21,6 @@ import (

 var organizationCondition = policy.Equals("principal.organization_id", "resource.organization_id")

-// FullAccessPolicy grants organization owners and admins complete access to
-// every compliance portal capability, including custom domains, portal
-// configuration, access grants, files, references, frameworks, external URLs
-// and mailing lists.
-//
-// The managed probopage subdomain is a system-owned resource and can never be
-// deleted, so an explicit deny (which takes precedence over any allow) blocks
-// deletion of managed domains for every role.
 var FullAccessPolicy = policy.NewPolicy(
 	"compliance-portal:full-access",
 	"Compliance Portal Full Access",
@@ -40,8 +32,6 @@ var FullAccessPolicy = policy.NewPolicy(
 		When(policy.Equals("resource.managed", "true")),
 ).WithDescription("Full compliance portal access for organization owners and admins")

-// ViewerPolicy grants organization viewers read-only access to the compliance
-// portal.
 var ViewerPolicy = policy.NewPolicy(
 	"compliance-portal:viewer",
 	"Compliance Portal Viewer",
@@ -52,11 +42,11 @@ var ViewerPolicy = policy.NewPolicy(
 		ActionCompliancePortalDocumentAccessList,
 		ActionCompliancePortalFileGet, ActionCompliancePortalFileList, ActionCompliancePortalFileGetFileUrl,
 		ActionCompliancePortalReferenceList, ActionCompliancePortalReferenceGetLogoUrl,
+		ActionCompliancePortalCommitmentGroupList, ActionCompliancePortalCommitmentList,
 		ActionComplianceFrameworkList,
 	).WithSID("compliance-portal-read-access").When(organizationCondition),
 ).WithDescription("Read-only compliance portal access for organization viewers")

-// PolicySet returns the PolicySet for the compliance portal service.
 func PolicySet() *iam.PolicySet {
 	return iam.NewPolicySet().
 		AddRolePolicy("OWNER", FullAccessPolicy).
--- a/pkg/server/api/complianceportal/v1/trust_center_resolvers.go
+++ b/pkg/server/api/complianceportal/v1/trust_center_resolvers.go
@@ -180,6 +180,25 @@ func (r *complianceFrameworkResolver) Framework(ctx context.Context, obj *types.
 	return types.NewFramework(framework), nil
 }

+// Commitments is the resolver for the commitments field.
+func (r *compliancePortalCommitmentGroupResolver) Commitments(ctx context.Context, obj *types.CompliancePortalCommitmentGroup, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.CompliancePortalCommitmentConnection, error) {
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	trustService := r.trust
+	pageOrderBy := page.OrderBy[coredata.CompliancePortalCommitmentOrderField]{
+		Field:     coredata.CompliancePortalCommitmentOrderFieldRank,
+		Direction: page.OrderDirectionAsc,
+	}
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	commitmentPage, err := trustService.ListCommitmentsForGroupID(ctx, scope, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list public compliance portal commitments", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewCompliancePortalCommitmentConnection(commitmentPage), nil
+}
+
 // Alias is the resolver for the alias field.
 func (r *documentResolver) Alias(ctx context.Context, obj *types.Document) (*string, error) {
 	return r.ResourceAliasResolver(ctx, obj.ID)
@@ -750,7 +769,7 @@ func (r *trustCenterResolver) ViewerSubscription(ctx context.Context, obj *types
 }

 // Documents is the resolver for the documents field.
-func (r *trustCenterResolver) Documents(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.DocumentConnection, error) {
+func (r *trustCenterResolver) Documents(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, filter *types.TrustCenterVisibilityFilter) (*types.DocumentConnection, error) {
 	trustCenter := complianceportal.CompliancePageFromContext(ctx)
 	scope := coredata.NewScopeFromObjectID(obj.ID)
 	trustService := r.trust
@@ -760,7 +779,12 @@ func (r *trustCenterResolver) Documents(ctx context.Context, obj *types.TrustCen
 	}
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

-	documentPage, err := trustService.ListDocumentsForOrganizationID(ctx, scope, trustCenter.OrganizationID, cursor)
+	documentFilter := coredata.NewDocumentTrustCenterFilter()
+	if filter != nil && filter.Visibility != nil {
+		documentFilter = documentFilter.WithTrustCenterVisibilities(*filter.Visibility)
+	}
+
+	documentPage, err := trustService.ListDocumentsForOrganizationID(ctx, scope, trustCenter.OrganizationID, cursor, documentFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list public documents", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -770,7 +794,7 @@ func (r *trustCenterResolver) Documents(ctx context.Context, obj *types.TrustCen
 }

 // Audits is the resolver for the audits field.
-func (r *trustCenterResolver) Audits(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.AuditConnection, error) {
+func (r *trustCenterResolver) Audits(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, filter *types.TrustCenterVisibilityFilter) (*types.AuditConnection, error) {
 	trustCenter := complianceportal.CompliancePageFromContext(ctx)
 	scope := coredata.NewScopeFromObjectID(obj.ID)
 	trustService := r.trust
@@ -780,7 +804,12 @@ func (r *trustCenterResolver) Audits(ctx context.Context, obj *types.TrustCenter
 	}
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

-	auditPage, err := trustService.ListAuditsForOrganizationID(ctx, scope, trustCenter.OrganizationID, cursor)
+	auditFilter := coredata.NewAuditTrustCenterFilter()
+	if filter != nil && filter.Visibility != nil {
+		auditFilter = auditFilter.WithTrustCenterVisibilities(*filter.Visibility)
+	}
+
+	auditPage, err := trustService.ListAuditsForOrganizationID(ctx, scope, trustCenter.OrganizationID, cursor, auditFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list public audits", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -878,8 +907,27 @@ func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCe
 	return types.NewTrustCenterReferenceConnection(referencePage), nil
 }

+// CommitmentGroups is the resolver for the commitmentGroups field.
+func (r *trustCenterResolver) CommitmentGroups(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.CompliancePortalCommitmentGroupConnection, error) {
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	trustService := r.trust
+	pageOrderBy := page.OrderBy[coredata.CompliancePortalCommitmentGroupOrderField]{
+		Field:     coredata.CompliancePortalCommitmentGroupOrderFieldRank,
+		Direction: page.OrderDirectionAsc,
+	}
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	groupPage, err := trustService.ListCommitmentGroupsForPortalID(ctx, scope, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list public compliance portal commitment groups", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewCompliancePortalCommitmentGroupConnection(groupPage), nil
+}
+
 // TrustCenterFiles is the resolver for the trustCenterFiles field.
-func (r *trustCenterResolver) TrustCenterFiles(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TrustCenterFileConnection, error) {
+func (r *trustCenterResolver) TrustCenterFiles(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, filter *types.TrustCenterVisibilityFilter) (*types.TrustCenterFileConnection, error) {
 	trustCenter := complianceportal.CompliancePageFromContext(ctx)
 	scope := coredata.NewScopeFromObjectID(obj.ID)
 	trustService := r.trust
@@ -889,14 +937,19 @@ func (r *trustCenterResolver) TrustCenterFiles(ctx context.Context, obj *types.T
 	}
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)

-	filter := coredata.NewTrustCenterFileFilter(
-		coredata.WithTrustCenterFileVisibilities(
-			coredata.TrustCenterVisibilityPublic,
-			coredata.TrustCenterVisibilityPrivate,
-		),
+	visibilities := []coredata.TrustCenterVisibility{
+		coredata.TrustCenterVisibilityPublic,
+		coredata.TrustCenterVisibilityPrivate,
+	}
+	if filter != nil && filter.Visibility != nil {
+		visibilities = []coredata.TrustCenterVisibility{*filter.Visibility}
+	}
+
+	fileFilter := coredata.NewTrustCenterFileFilter(
+		coredata.WithTrustCenterFileVisibilities(visibilities...),
 	)

-	trustCenterFilePage, err := trustService.ListPortalFilesForOrganizationID(ctx, scope, trustCenter.OrganizationID, cursor, filter)
+	trustCenterFilePage, err := trustService.ListPortalFilesForOrganizationID(ctx, scope, trustCenter.OrganizationID, cursor, fileFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list public trust center files", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -1087,6 +1140,11 @@ func (r *Resolver) ComplianceFramework() schema.ComplianceFrameworkResolver {
 	return &complianceFrameworkResolver{r}
 }

+// CompliancePortalCommitmentGroup returns schema.CompliancePortalCommitmentGroupResolver implementation.
+func (r *Resolver) CompliancePortalCommitmentGroup() schema.CompliancePortalCommitmentGroupResolver {
+	return &compliancePortalCommitmentGroupResolver{r}
+}
+
 // Document returns schema.DocumentResolver implementation.
 func (r *Resolver) Document() schema.DocumentResolver { return &documentResolver{r} }

@@ -1112,13 +1170,14 @@ func (r *Resolver) TrustCenterReference() schema.TrustCenterReferenceResolver {
 }

 type (
-	auditResolver                  struct{ *Resolver }
-	auditReportResolver            struct{ *Resolver }
-	complianceFrameworkResolver    struct{ *Resolver }
-	documentResolver               struct{ *Resolver }
-	frameworkResolver              struct{ *Resolver }
-	subprocessorConnectionResolver struct{ *Resolver }
-	trustCenterResolver            struct{ *Resolver }
-	trustCenterFileResolver        struct{ *Resolver }
-	trustCenterReferenceResolver   struct{ *Resolver }
+	auditResolver                           struct{ *Resolver }
+	auditReportResolver                     struct{ *Resolver }
+	complianceFrameworkResolver             struct{ *Resolver }
+	compliancePortalCommitmentGroupResolver struct{ *Resolver }
+	documentResolver                        struct{ *Resolver }
+	frameworkResolver                       struct{ *Resolver }
+	subprocessorConnectionResolver          struct{ *Resolver }
+	trustCenterResolver                     struct{ *Resolver }
+	trustCenterFileResolver                 struct{ *Resolver }
+	trustCenterReferenceResolver            struct{ *Resolver }
 )
--- a/pkg/server/api/console/v1/graphql/trust_center.graphql
+++ b/pkg/server/api/console/v1/graphql/trust_center.graphql
@@ -106,6 +106,88 @@ enum TrustCenterReferenceOrderField
        )
 }

+enum CompliancePortalCommitmentGroupOrderField
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentGroupOrderField"
+    ) {
+    RANK
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentGroupOrderFieldRank"
+        )
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentGroupOrderFieldCreatedAt"
+        )
+    UPDATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentGroupOrderFieldUpdatedAt"
+        )
+}
+
+enum CompliancePortalCommitmentOrderField
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentOrderField"
+    ) {
+    RANK
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentOrderFieldRank"
+        )
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentOrderFieldCreatedAt"
+        )
+    UPDATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentOrderFieldUpdatedAt"
+        )
+}
+
+enum CompliancePortalCommitmentIcon
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIcon"
+    ) {
+    LOCK_KEY
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconLockKey")
+    EYE_SLASH
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconEyeSlash")
+    FINGERPRINT
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconFingerprint")
+    SHIELD_WARNING
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconShieldWarning")
+    SHIELD_CHECK
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconShieldCheck")
+    SIREN
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconSiren")
+    KEY
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconKey")
+    LOCK
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconLock")
+    CLOUD
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconCloud")
+    DATABASE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconDatabase")
+    GLOBE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconGlobe")
+    EYE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconEye")
+    USERS
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconUsers")
+    CERTIFICATE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconCertificate")
+    GAVEL
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconGavel")
+    HEARTBEAT
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconHeartbeat")
+    BELL
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconBell")
+    BUG
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconBug")
+    CODE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconCode")
+    SERVER
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.CompliancePortalCommitmentIconServer")
+}
+
 enum ComplianceCustomLinkOrderField
    @goModel(
        model: "go.probo.inc/probo/pkg/coredata.ComplianceCustomLinkOrderField"
@@ -218,6 +300,22 @@ input TrustCenterReferenceOrder
    field: TrustCenterReferenceOrderField!
 }

+input CompliancePortalCommitmentGroupOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.CompliancePortalCommitmentGroupOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: CompliancePortalCommitmentGroupOrderField!
+}
+
+input CompliancePortalCommitmentOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.CompliancePortalCommitmentOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: CompliancePortalCommitmentOrderField!
+}
+
 input TrustCenterFileOrder
    @goModel(
        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.TrustCenterFileOrderBy"
@@ -277,6 +375,14 @@ type TrustCenter implements Node
        orderBy: TrustCenterReferenceOrder
    ): TrustCenterReferenceConnection! @goField(forceResolver: true)

+    commitmentGroups(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: CompliancePortalCommitmentGroupOrder
+    ): CompliancePortalCommitmentGroupConnection! @goField(forceResolver: true)
+
    complianceFrameworks(
        first: Int
        after: CursorKey
@@ -400,6 +506,66 @@ type TrustCenterReferenceEdge {
    node: TrustCenterReference!
 }

+type CompliancePortalCommitmentGroup implements Node {
+    id: ID!
+    title: String!
+    description: String!
+    rank: Int!
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    commitments(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: CompliancePortalCommitmentOrder
+    ): CompliancePortalCommitmentConnection! @goField(forceResolver: true)
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type CompliancePortalCommitmentGroupConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.CompliancePortalCommitmentGroupConnection"
+    ) {
+    totalCount: Int! @goField(forceResolver: true)
+    edges: [CompliancePortalCommitmentGroupEdge!]!
+    pageInfo: PageInfo!
+}
+
+type CompliancePortalCommitmentGroupEdge {
+    cursor: CursorKey!
+    node: CompliancePortalCommitmentGroup!
+}
+
+type CompliancePortalCommitment implements Node {
+    id: ID!
+    icon: CompliancePortalCommitmentIcon!
+    eyebrow: String!
+    title: String!
+    description: String!
+    rank: Int!
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type CompliancePortalCommitmentConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.CompliancePortalCommitmentConnection"
+    ) {
+    totalCount: Int! @goField(forceResolver: true)
+    edges: [CompliancePortalCommitmentEdge!]!
+    pageInfo: PageInfo!
+}
+
+type CompliancePortalCommitmentEdge {
+    cursor: CursorKey!
+    node: CompliancePortalCommitment!
+}
+
 type ComplianceFramework implements Node
    @goModel(
        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ComplianceFramework"
@@ -526,6 +692,24 @@ extend type Mutation {
    deleteTrustCenterReference(
        input: DeleteTrustCenterReferenceInput!
    ): DeleteTrustCenterReferencePayload!
+    createCompliancePortalCommitmentGroup(
+        input: CreateCompliancePortalCommitmentGroupInput!
+    ): CreateCompliancePortalCommitmentGroupPayload!
+    updateCompliancePortalCommitmentGroup(
+        input: UpdateCompliancePortalCommitmentGroupInput!
+    ): UpdateCompliancePortalCommitmentGroupPayload!
+    deleteCompliancePortalCommitmentGroup(
+        input: DeleteCompliancePortalCommitmentGroupInput!
+    ): DeleteCompliancePortalCommitmentGroupPayload!
+    createCompliancePortalCommitment(
+        input: CreateCompliancePortalCommitmentInput!
+    ): CreateCompliancePortalCommitmentPayload!
+    updateCompliancePortalCommitment(
+        input: UpdateCompliancePortalCommitmentInput!
+    ): UpdateCompliancePortalCommitmentPayload!
+    deleteCompliancePortalCommitment(
+        input: DeleteCompliancePortalCommitmentInput!
+    ): DeleteCompliancePortalCommitmentPayload!
    createComplianceFramework(
        input: CreateComplianceFrameworkInput!
    ): CreateComplianceFrameworkPayload!
@@ -630,6 +814,44 @@ input DeleteTrustCenterReferenceInput {
    id: ID!
 }

+input CreateCompliancePortalCommitmentGroupInput {
+    trustCenterId: ID!
+    title: String!
+    description: String!
+}
+
+input UpdateCompliancePortalCommitmentGroupInput {
+    id: ID!
+    title: String
+    description: String
+    rank: Int
+}
+
+input DeleteCompliancePortalCommitmentGroupInput {
+    id: ID!
+}
+
+input CreateCompliancePortalCommitmentInput {
+    groupId: ID!
+    icon: CompliancePortalCommitmentIcon!
+    eyebrow: String!
+    title: String!
+    description: String!
+}
+
+input UpdateCompliancePortalCommitmentInput {
+    id: ID!
+    icon: CompliancePortalCommitmentIcon
+    eyebrow: String
+    title: String
+    description: String
+    rank: Int
+}
+
+input DeleteCompliancePortalCommitmentInput {
+    id: ID!
+}
+
 input CreateComplianceFrameworkInput {
    trustCenterId: ID!
    frameworkId: ID!
@@ -729,6 +951,30 @@ type DeleteTrustCenterReferencePayload {
    deletedTrustCenterReferenceId: ID!
 }

+type CreateCompliancePortalCommitmentGroupPayload {
+    compliancePortalCommitmentGroupEdge: CompliancePortalCommitmentGroupEdge!
+}
+
+type UpdateCompliancePortalCommitmentGroupPayload {
+    compliancePortalCommitmentGroup: CompliancePortalCommitmentGroup!
+}
+
+type DeleteCompliancePortalCommitmentGroupPayload {
+    deletedCompliancePortalCommitmentGroupId: ID!
+}
+
+type CreateCompliancePortalCommitmentPayload {
+    compliancePortalCommitmentEdge: CompliancePortalCommitmentEdge!
+}
+
+type UpdateCompliancePortalCommitmentPayload {
+    compliancePortalCommitment: CompliancePortalCommitment!
+}
+
+type DeleteCompliancePortalCommitmentPayload {
+    deletedCompliancePortalCommitmentId: ID!
+}
+
 type CreateComplianceFrameworkPayload {
    complianceFrameworkEdge: ComplianceFrameworkEdge!
 }
--- a/pkg/server/api/console/v1/trust_center_resolvers.go
+++ b/pkg/server/api/console/v1/trust_center_resolvers.go
@@ -52,6 +52,78 @@ func (r *complianceFrameworkResolver) Framework(ctx context.Context, obj *types.
 	return types.NewFramework(framework), nil
 }

+// Permission is the resolver for the permission field.
+func (r *compliancePortalCommitmentResolver) Permission(ctx context.Context, obj *types.CompliancePortalCommitment, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *compliancePortalCommitmentConnectionResolver) TotalCount(ctx context.Context, obj *types.CompliancePortalCommitmentConnection) (int, error) {
+	scope, err := r.authorize(ctx, obj.ParentID, management.ActionCompliancePortalCommitmentList)
+	if err != nil {
+		return 0, err
+	}
+
+	count, err := r.management.CountCommitments(ctx, scope, obj.ParentID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot count compliance portal commitments", log.Error(err))
+		return 0, gqlutils.Internal(ctx)
+	}
+
+	return count, nil
+}
+
+// Commitments is the resolver for the commitments field.
+func (r *compliancePortalCommitmentGroupResolver) Commitments(ctx context.Context, obj *types.CompliancePortalCommitmentGroup, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.CompliancePortalCommitmentOrderField]) (*types.CompliancePortalCommitmentConnection, error) {
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalCommitmentList)
+	if err != nil {
+		return nil, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.CompliancePortalCommitmentOrderField]{
+		Field:     coredata.CompliancePortalCommitmentOrderFieldRank,
+		Direction: page.OrderDirectionAsc,
+	}
+
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.CompliancePortalCommitmentOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	result, err := r.management.ListCommitments(ctx, scope, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list compliance portal commitments", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewCompliancePortalCommitmentConnection(result, obj.ID), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *compliancePortalCommitmentGroupResolver) Permission(ctx context.Context, obj *types.CompliancePortalCommitmentGroup, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *compliancePortalCommitmentGroupConnectionResolver) TotalCount(ctx context.Context, obj *types.CompliancePortalCommitmentGroupConnection) (int, error) {
+	scope, err := r.authorize(ctx, obj.ParentID, management.ActionCompliancePortalCommitmentGroupList)
+	if err != nil {
+		return 0, err
+	}
+
+	count, err := r.management.CountCommitmentGroups(ctx, scope, obj.ParentID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot count compliance portal commitment groups", log.Error(err))
+		return 0, gqlutils.Internal(ctx)
+	}
+
+	return count, nil
+}
+
 // Permission is the resolver for the permission field.
 func (r *customDomainResolver) Permission(ctx context.Context, obj *types.CustomDomain, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -370,6 +442,166 @@ func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input
 	}, nil
 }

+// CreateCompliancePortalCommitmentGroup is the resolver for the createCompliancePortalCommitmentGroup field.
+func (r *mutationResolver) CreateCompliancePortalCommitmentGroup(ctx context.Context, input types.CreateCompliancePortalCommitmentGroupInput) (*types.CreateCompliancePortalCommitmentGroupPayload, error) {
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalCommitmentGroupCreate)
+	if err != nil {
+		return nil, err
+	}
+
+	group, err := r.management.CreateCommitmentGroup(
+		ctx, scope,
+		&management.CreateCompliancePortalCommitmentGroupRequest{
+			TrustCenterID: input.TrustCenterID,
+			Title:         input.Title,
+			Description:   input.Description,
+		},
+	)
+	if err != nil {
+		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
+			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot create compliance portal commitment group", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.CreateCompliancePortalCommitmentGroupPayload{
+		CompliancePortalCommitmentGroupEdge: types.NewCompliancePortalCommitmentGroupEdge(group, coredata.CompliancePortalCommitmentGroupOrderFieldRank),
+	}, nil
+}
+
+// UpdateCompliancePortalCommitmentGroup is the resolver for the updateCompliancePortalCommitmentGroup field.
+func (r *mutationResolver) UpdateCompliancePortalCommitmentGroup(ctx context.Context, input types.UpdateCompliancePortalCommitmentGroupInput) (*types.UpdateCompliancePortalCommitmentGroupPayload, error) {
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalCommitmentGroupUpdate)
+	if err != nil {
+		return nil, err
+	}
+
+	group, err := r.management.UpdateCommitmentGroup(
+		ctx, scope,
+		&management.UpdateCompliancePortalCommitmentGroupRequest{
+			ID:          input.ID,
+			Title:       input.Title,
+			Description: input.Description,
+			Rank:        input.Rank,
+		},
+	)
+	if err != nil {
+		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
+			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot update compliance portal commitment group", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.UpdateCompliancePortalCommitmentGroupPayload{
+		CompliancePortalCommitmentGroup: types.NewCompliancePortalCommitmentGroup(group),
+	}, nil
+}
+
+// DeleteCompliancePortalCommitmentGroup is the resolver for the deleteCompliancePortalCommitmentGroup field.
+func (r *mutationResolver) DeleteCompliancePortalCommitmentGroup(ctx context.Context, input types.DeleteCompliancePortalCommitmentGroupInput) (*types.DeleteCompliancePortalCommitmentGroupPayload, error) {
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalCommitmentGroupDelete)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := r.management.DeleteCommitmentGroup(ctx, scope, input.ID); err != nil {
+		r.logger.ErrorCtx(ctx, "cannot delete compliance portal commitment group", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.DeleteCompliancePortalCommitmentGroupPayload{
+		DeletedCompliancePortalCommitmentGroupID: input.ID,
+	}, nil
+}
+
+// CreateCompliancePortalCommitment is the resolver for the createCompliancePortalCommitment field.
+func (r *mutationResolver) CreateCompliancePortalCommitment(ctx context.Context, input types.CreateCompliancePortalCommitmentInput) (*types.CreateCompliancePortalCommitmentPayload, error) {
+	scope, err := r.authorize(ctx, input.GroupID, management.ActionCompliancePortalCommitmentCreate)
+	if err != nil {
+		return nil, err
+	}
+
+	commitment, err := r.management.CreateCommitment(
+		ctx, scope,
+		&management.CreateCompliancePortalCommitmentRequest{
+			GroupID:     input.GroupID,
+			Icon:        input.Icon,
+			Eyebrow:     input.Eyebrow,
+			Title:       input.Title,
+			Description: input.Description,
+		},
+	)
+	if err != nil {
+		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
+			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot create compliance portal commitment", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.CreateCompliancePortalCommitmentPayload{
+		CompliancePortalCommitmentEdge: types.NewCompliancePortalCommitmentEdge(commitment, coredata.CompliancePortalCommitmentOrderFieldRank),
+	}, nil
+}
+
+// UpdateCompliancePortalCommitment is the resolver for the updateCompliancePortalCommitment field.
+func (r *mutationResolver) UpdateCompliancePortalCommitment(ctx context.Context, input types.UpdateCompliancePortalCommitmentInput) (*types.UpdateCompliancePortalCommitmentPayload, error) {
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalCommitmentUpdate)
+	if err != nil {
+		return nil, err
+	}
+
+	commitment, err := r.management.UpdateCommitment(
+		ctx, scope,
+		&management.UpdateCompliancePortalCommitmentRequest{
+			ID:          input.ID,
+			Icon:        input.Icon,
+			Eyebrow:     input.Eyebrow,
+			Title:       input.Title,
+			Description: input.Description,
+			Rank:        input.Rank,
+		},
+	)
+	if err != nil {
+		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
+			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot update compliance portal commitment", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.UpdateCompliancePortalCommitmentPayload{
+		CompliancePortalCommitment: types.NewCompliancePortalCommitment(commitment),
+	}, nil
+}
+
+// DeleteCompliancePortalCommitment is the resolver for the deleteCompliancePortalCommitment field.
+func (r *mutationResolver) DeleteCompliancePortalCommitment(ctx context.Context, input types.DeleteCompliancePortalCommitmentInput) (*types.DeleteCompliancePortalCommitmentPayload, error) {
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalCommitmentDelete)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := r.management.DeleteCommitment(ctx, scope, input.ID); err != nil {
+		r.logger.ErrorCtx(ctx, "cannot delete compliance portal commitment", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.DeleteCompliancePortalCommitmentPayload{
+		DeletedCompliancePortalCommitmentID: input.ID,
+	}, nil
+}
+
 // CreateComplianceFramework is the resolver for the createComplianceFramework field.
 func (r *mutationResolver) CreateComplianceFramework(ctx context.Context, input types.CreateComplianceFrameworkInput) (*types.CreateComplianceFrameworkPayload, error) {
 	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionComplianceFrameworkCreate)
@@ -821,6 +1053,36 @@ func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCe
 	return types.NewTrustCenterReferenceConnection(result, obj.ID), nil
 }

+// CommitmentGroups is the resolver for the commitmentGroups field.
+func (r *trustCenterResolver) CommitmentGroups(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.CompliancePortalCommitmentGroupOrderField]) (*types.CompliancePortalCommitmentGroupConnection, error) {
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalCommitmentGroupList)
+	if err != nil {
+		return nil, err
+	}
+
+	pageOrderBy := page.OrderBy[coredata.CompliancePortalCommitmentGroupOrderField]{
+		Field:     coredata.CompliancePortalCommitmentGroupOrderFieldRank,
+		Direction: page.OrderDirectionAsc,
+	}
+
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.CompliancePortalCommitmentGroupOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	result, err := r.management.ListCommitmentGroups(ctx, scope, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list compliance portal commitment groups", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewCompliancePortalCommitmentGroupConnection(result, obj.ID), nil
+}
+
 // ComplianceFrameworks is the resolver for the complianceFrameworks field.
 func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceFrameworkOrderField]) (*types.ComplianceFrameworkConnection, error) {
 	scope, err := r.authorize(ctx, obj.ID, management.ActionComplianceFrameworkList)
@@ -1296,6 +1558,26 @@ func (r *Resolver) ComplianceFramework() schema.ComplianceFrameworkResolver {
 	return &complianceFrameworkResolver{r}
 }

+// CompliancePortalCommitment returns schema.CompliancePortalCommitmentResolver implementation.
+func (r *Resolver) CompliancePortalCommitment() schema.CompliancePortalCommitmentResolver {
+	return &compliancePortalCommitmentResolver{r}
+}
+
+// CompliancePortalCommitmentConnection returns schema.CompliancePortalCommitmentConnectionResolver implementation.
+func (r *Resolver) CompliancePortalCommitmentConnection() schema.CompliancePortalCommitmentConnectionResolver {
+	return &compliancePortalCommitmentConnectionResolver{r}
+}
+
+// CompliancePortalCommitmentGroup returns schema.CompliancePortalCommitmentGroupResolver implementation.
+func (r *Resolver) CompliancePortalCommitmentGroup() schema.CompliancePortalCommitmentGroupResolver {
+	return &compliancePortalCommitmentGroupResolver{r}
+}
+
+// CompliancePortalCommitmentGroupConnection returns schema.CompliancePortalCommitmentGroupConnectionResolver implementation.
+func (r *Resolver) CompliancePortalCommitmentGroupConnection() schema.CompliancePortalCommitmentGroupConnectionResolver {
+	return &compliancePortalCommitmentGroupConnectionResolver{r}
+}
+
 // CustomDomain returns schema.CustomDomainResolver implementation.
 func (r *Resolver) CustomDomain() schema.CustomDomainResolver { return &customDomainResolver{r} }

@@ -1338,15 +1620,19 @@ func (r *Resolver) TrustCenterReferenceConnection() schema.TrustCenterReferenceC
 }

 type (
-	complianceCustomLinkResolver                struct{ *Resolver }
-	complianceFrameworkResolver                 struct{ *Resolver }
-	customDomainResolver                        struct{ *Resolver }
-	trustCenterResolver                         struct{ *Resolver }
-	trustCenterAccessResolver                   struct{ *Resolver }
-	trustCenterDocumentAccessResolver           struct{ *Resolver }
-	trustCenterDocumentAccessConnectionResolver struct{ *Resolver }
-	trustCenterFileResolver                     struct{ *Resolver }
-	trustCenterFileConnectionResolver           struct{ *Resolver }
-	trustCenterReferenceResolver                struct{ *Resolver }
-	trustCenterReferenceConnectionResolver      struct{ *Resolver }
+	complianceCustomLinkResolver                      struct{ *Resolver }
+	complianceFrameworkResolver                       struct{ *Resolver }
+	compliancePortalCommitmentResolver                struct{ *Resolver }
+	compliancePortalCommitmentConnectionResolver      struct{ *Resolver }
+	compliancePortalCommitmentGroupResolver           struct{ *Resolver }
+	compliancePortalCommitmentGroupConnectionResolver struct{ *Resolver }
+	customDomainResolver                              struct{ *Resolver }
+	trustCenterResolver                               struct{ *Resolver }
+	trustCenterAccessResolver                         struct{ *Resolver }
+	trustCenterDocumentAccessResolver                 struct{ *Resolver }
+	trustCenterDocumentAccessConnectionResolver       struct{ *Resolver }
+	trustCenterFileResolver                           struct{ *Resolver }
+	trustCenterFileConnectionResolver                 struct{ *Resolver }
+	trustCenterReferenceResolver                      struct{ *Resolver }
+	trustCenterReferenceConnectionResolver            struct{ *Resolver }
 )