Sixteen modules ship across the nine capability families today. This guide states, for each module, what it does, how it works, the proof points and its current maturity — GA, beta, preview or in progress — in the same words the product pages use.
The families
Management & Delivery
Provisioning, landing zones, blueprints and day-2 operations — delivery with governance built in.
Whalenomics · FinOps
Budgets, forecasts, chargeback and continuous optimization — spend decomposed to workload, department or tenant.
Security & Identity
One identity fabric (SAML/OIDC), least-privilege access, continuous scanning — uniform posture everywhere.
Governance & Audit
Policy as configuration; controls monitored continuously; the auditor's report generated on demand.
Whale AI — incl. offline
AI for operations, documentation and compliance — your choice of model, able to run fully inside the perimeter.
Migration & Discovery
Inventory, dependency mapping and rehearsed waves with rollback — for entry, movement between estates, and exit.
Observability & ITSM
Health, events and service operations — integrated with ServiceNow, Jira and existing tooling.
Tenancy & Monetization
Native multi-tenancy, catalogs, marketplace, per-tenant metering and billing feeds.
Sovereign Operations
In-country deployment, segregation, air-gapped classes and offline-tolerant edge.
Cloud Connectors — Generally available
Cloud Connectors are how an estate joins the platform: read-only, least-privilege credentials for each public cloud, and an Edge Agent for private and virtualised estates that connects outbound over HTTPS so credentials never leave your site. Six public clouds are live today; hybrid and sovereign stacks connect through the same agent.
- 6
- Public clouds live — AWS, Azure, GCP, Oracle, Alibaba, Huawei
- Read-only
- IAM role, app registration or service account — never write access by default
- Outbound only
- Edge Agent uses HTTPS out; no inbound firewall rules
Capabilities
Least-privilege cloud access
AWS connects with an IAM role and external ID, Azure with an Entra app registration holding the Reader role, GCP with a Viewer service account, Oracle with an API signing key, Alibaba and Huawei with read-only access keys. Write actions are granted separately, per policy.
Edge Agent for private estates
A small agent per site inventories VMware, Hyper-V, Nutanix and OpenShift through their own APIs and reports over outbound-only HTTPS. Hybrid and sovereign stacks — Azure Stack, Huawei Cloud Stack, Alibaba Apsara Stack — attach the same way.
Connector health
Every connector shows last sync, scope and errors; a failing credential raises an ITSM incident rather than silently going stale.
Business and ITSM connectors
ServiceNow and Jira integrations for tickets, plus CRM/ERP connectors for ownership and cost context; some business connectors are still in beta.
How it works
- 1
Create credentials in the cloud
Follow the guided steps for each provider — the console shows the exact role, policy or key to create, scoped to read.
- 2
Register the connector
Paste the role ARN, app credentials or key into the connector form; the platform validates access and runs a first discovery.
- 3
Watch it stay healthy
Sync status, scope changes and expiring secrets are surfaced on the health page and as incidents, so nothing quietly drops out of the inventory.
Business Connectors — Generally available · some in beta
Business Connectors join the cloud estate to the systems the business already runs on. Tickets, changes and approvals sync two-way with ServiceNow and Jira; CRM and ERP connectors bring ownership and cost context in, so every resource has an owner and every bill a cost centre.
- 75
- Connectors — 15 CRM, 30 ERP and 30 ITSM systems
- Two-way
- Ticket and change sync with ServiceNow and Jira
- CRM · ERP
- Ownership and cost-centre context on every resource
Capabilities
ITSM sync
Incidents, changes and approvals raised in the platform appear in ServiceNow or Jira and stay in step both ways — status, comments and resolution.
Ownership from CRM and ERP
Business units, cost centres and owners are pulled from the systems of record, so inventory, chargeback and alerts route to the right people.
Approvals where they live today
Service Catalog requests can follow the approval flow already configured in your ITSM tool rather than a new one.
Connector health
Each connector shows last sync and errors; connectors still in beta are labelled as such in the console.
How it works
- 1
Choose the system
Pick ServiceNow, Jira or a CRM/ERP connector from the marketplace.
- 2
Authorise and map
Grant scoped API access and map fields — assignment groups, projects, cost centres.
- 3
Sync
Records flow both ways and stay in step; failures raise an incident instead of silently stopping.
Partner Connectors — Available
Partner Connectors connect the platform to the resellers, MSPs and SI partners who sell and operate it. Through the white-label Partner Portal, partners register deals, manage licences, provision end-customer tenants and receive consolidated billing — while every end-customer runs on the same governed platform.
- Partner Portal
- Deal registration, licensing and tenant provisioning
- White-label
- A branded experience for MSP and SI partners
- Consolidated
- One billing view across a partner's end-customers
Capabilities
Deal registration and licensing
License Service Providers and resellers register opportunities and manage licences in the Partner Portal, so channel sales and entitlements stay in one place.
End-customer management
MSP and SI partners provision and manage end-customer tenants from one view; each tenant is isolated and governed.
Consolidated billing
Usage across a partner's end-customers rolls up to consolidated billing, ready for the partner's own invoicing.
White-label experience
Partners present the platform under their own brand to the customers they serve.
How it works
- 1
Onboard the partner
The partner registers in the Partner Portal and is assigned a tier and licence pool.
- 2
Provision end-customers
The partner creates end-customer tenants and connects their estates.
- 3
Operate and bill
The partner runs its customers from one view and receives consolidated billing.
Service Catalog — Generally available
The Service Catalog lets teams request approved cloud resources without touching cloud consoles. AWS provisioning is live for EC2, S3, RDS, VPC and EFS, with Azure and GCP catalog items, approval workflows, governance guardrails and Whale AI sizing advice built into the request — so self-service and control stop being a trade-off.
- AWS live
- EC2 · S3 · RDS · VPC · EFS provisioned from the catalog
- Guardrails
- Approved sizes, regions and tags enforced before submit
- Whale AI
- Sizing recommendations inside the request form
Capabilities
Governed self-service
Teams pick from catalog items you approve — with sizes, regions, tags and naming already constrained — instead of being handed console access.
Approval workflows
Route requests by cost, environment or resource type to the right approver; low-risk items can auto-approve, everything is recorded.
Whale AI sizing
The request form asks Whale AI for a right-sized recommendation grounded in your inventory and cost history, before a single instance is oversized.
Audit trail
Who requested, who approved, what was provisioned and where — every catalog action lands in the platform audit log and the ITSM change record.
How it works
- 1
Publish catalog items
Define the resources teams may request and the guardrails that apply to each.
- 2
Request and approve
A developer selects an item, gets a sizing suggestion, submits; the approval policy decides who signs off.
- 3
Provision and track
The platform provisions with its own credentials, tags the resource, and adds it to inventory and cost tracking automatically.
Landing Zone Builder — Beta
Landing Zone Builder is a visual designer for compliant cloud foundations — AWS Control Tower, Azure Cloud Landing Zone and GCP foundations — that generates the multi-account baseline as Terraform HCL with guardrails, tags and account structure built in. Design the foundation as a diagram; get the code that stands it up.
- AWS · Azure · GCP
- Control Tower, CLZ and GCP foundation patterns
- Baseline HCL
- Multi-account, versioned, reviewable
- Guardrails
- Policy, tagging and network controls from day one
Capabilities
Visual foundation design
Lay out organisations, accounts, networks and shared services on a canvas that mirrors each provider's reference architecture.
Guardrails as configuration
Choose the controls — SCPs and policies, tagging standards, network baselines — and they are generated into the code, not documented beside it.
Generated multi-account baseline
The output is Terraform for the whole foundation, ready for review and your pipeline.
Industry patterns
Banking, telco, healthcare and government starting points that reflect segregation and residency requirements.
How it works
- 1
Design
Pick the provider pattern and draw the account and network structure.
- 2
Select guardrails
Turn on the controls the estate must have; the designer validates the combination.
- 3
Generate
Export the baseline HCL and apply it through your pipeline.
Whalenomics — Whale AI use cases live · full backend in progress
Whalenomics is the FinOps family: budgets, forecasts, chargeback and continuous optimisation, with spend decomposed to workload, department or tenant. Today the Whale AI FinOps use cases — cost narratives, anomaly explanations, rightsizing and commitment advice — run on live billing data from AWS, Azure and GCP; the full Whalenomics backend for budgets and chargeback is in progress.
- 12
- Whale AI FinOps use cases live today
- AWS · Azure · GCP
- Pricing maps and billing ingestion
- Per tenant
- Chargeback and metering model (in progress)
Capabilities
Cost visibility with ownership
Billing records are joined to the inventory, so every dollar resolves to a workload, an owner and a tag — the basis for showback and chargeback.
Anomalies and explanations
Whale AI flags unusual spend and explains it in plain language against the inventory: what changed, where, and who owns it.
Rightsizing and commitments
Idle and oversized resources, storage tiers and commitment coverage are surfaced with the saving and the action — from the inventory, not a separate tool.
Budgets, forecasts, chargeback
Budgets per unit with forecasts and alerts, and chargeback into your ERP or an operator's BSS — the Whalenomics backend currently in progress.
How it works
- 1
Ingest and join
Billing exports from each cloud are normalised and joined to inventory and tags.
- 2
Explain
Whale AI answers 'why did this rise' with the resources behind the number.
- 3
Decide and allocate
Rightsize, commit, and allocate cost to the unit that owns it; budgets and forecasts follow.
Identity & Access — Generally available
Identity & Access is the platform's identity fabric: federate the identity providers you already run — Entra ID, Okta, Auth0, AWS Identity Center, Google IAM, OneLogin, on-prem Active Directory and the cloud IAMs — provision users automatically over SCIM, and apply one role model across every connected cloud. Enterprise adds Whale IAM-PAM for privileged sessions.
- 9+
- Identity providers over SAML 2.0 and OIDC
- SCIM 2.0
- Automatic user and group provisioning
- One RBAC
- Roles mapped from IdP groups, enforced on every cloud
Capabilities
Single sign-on
SAML 2.0 and OIDC federation with Microsoft Entra ID, Okta, Auth0, AWS Identity Center, Google IAM, OneLogin and on-premises AD, with step-by-step setup guides for each.
Auto-provisioning
SCIM 2.0 creates, updates and deactivates users as your directory changes, and maps IdP groups to platform roles — joiners and leavers are handled where HR already handles them.
Role-based access, cross-cloud
Roles such as viewer, operator and approver apply across AWS, Azure, GCP and on-prem estates at once, with scope by account, workload or tenant.
Privileged access (Enterprise & up)
Whale IAM-PAM brokers privileged sessions with approval gates and recording; the Government Edition makes PAM and MFA mandatory on every role.
How it works
- 1
Federate
Register BlueWhale Stack as an application in your IdP and exchange SAML or OIDC metadata — a few minutes per provider.
- 2
Map groups to roles
Choose which directory groups become which platform roles, and the scopes those roles cover.
- 3
Provision automatically
Turn on SCIM so accounts and roles follow the directory; access reviews and the audit trail come for free.
Security — Generally available
Security gives every connected estate the same posture. Cloud security posture management (CSPM, powered by Prowler) and vulnerability management scan clouds and private estates continuously, check them against CIS, NIST, ISO 27001 and HIPAA baselines, and route each finding to its owner through ITSM.
- Continuous
- Posture and vulnerability scanning, not quarterly reviews
- 4 baselines
- CIS · NIST · ISO 27001 · HIPAA
- Every estate
- Public cloud, private cloud and edge, one posture
Capabilities
Posture scanning (CSPM)
Prowler-based checks run across every connected cloud account, surfacing misconfigurations in identity, network, storage and logging.
Vulnerability management
Vulnerabilities are collected per workload and ranked by severity and exposure, so teams fix what matters first.
Baselines and policy
Findings map to CIS, NIST, ISO 27001 and HIPAA controls, with policy-as-code guardrails to stop the same issue recurring.
Owner routing
Each finding is raised to the resource owner as an ITSM ticket and tracked to closure.
How it works
- 1
Connect
Estates joined through Cloud Connectors are scanned automatically — no extra agents in the cloud.
- 2
Scan and score
Posture and vulnerability checks run continuously and roll up into a compliance score per estate.
- 3
Remediate
Findings route to owners through ITSM; guardrails prevent recurrence.
Cloud Audit & Evidence — Included in Enterprise & up
Cloud Audit & Evidence scores your AWS, Azure, Google Cloud and Oracle accounts against 11 built-in frameworks — the CIS benchmarks, PCI DSS v4.0, SOC 2, ISO/IEC 27001:2022, HIPAA, NIST SP 800-53, FedRAMP Moderate and GDPR — every time a scan runs. Failing checks become findings with an owner, manual controls count once attested, and the audit-ready export comes from the same record.
- 11 frameworks
- CIS · PCI DSS · SOC 2 · ISO 27001 · HIPAA · NIST · FedRAMP · GDPR
- Scored per scan
- Passing ÷ (passing + failing) — the formula is on the screen
- Audit-ready
- Findings and evidence exported for the auditor, CSV included
Capabilities
Built-in frameworks
CIS AWS v2.0.0, CIS Azure v2.0.0, CIS Google Cloud v1.3.0 and CIS Oracle Cloud, PCI DSS v4.0, SOC 2, ISO/IEC 27001:2022, HIPAA Security Rule, NIST SP 800-53 Rev. 5, FedRAMP Moderate and GDPR — each with its controls and how many are automated.
Scans that score every control
Run a scan and each automated check — a multi-region CloudTrail trail, no world ingress to admin or database ports — is evaluated against the live accounts. Scores recompute as passing ÷ (passing + failing).
Findings with owners
Every failing check is a finding with severity, resource, account, the frameworks it affects, status, assignee and last seen — filtered by severity, framework, provider, account, assignee or overdue.
Attestation and audit-ready export
Manual controls are attested with evidence and count once attested. Findings export to CSV with your filters applied, and the report the auditor asks for is generated from the same record.
How it works
- 1
Scan
Run a scan across the connected AWS, Azure, Google Cloud and Oracle accounts; every automated check is evaluated against live configuration.
- 2
Score
Each framework is scored as passing ÷ (passing + failing); manual controls count once attested, and a framework shows “not assessed” until its first scan.
- 3
Fix & export
Assign findings, track them to closed, and export findings and audit-ready reports for the period the auditor asks about.
Whale AI — Generally available
Whale AI is an intelligence layer woven into every module rather than a chatbot beside them: 50+ production use cases across cost, security, ITSM, operations, migration and governance, each grounded in your live inventory, billing, tickets and findings. It runs in three tiers — Spark, Tide and Abyss — with your choice of model, including fully offline inside the perimeter for sovereign estates.
- 50+
- Use cases, each with declared data dependencies
- Spark · Tide · Abyss
- Three tiers routed by task complexity
- Offline
- In-region and air-gapped models for sovereign deployments
Capabilities
Grounded, not generative guesswork
Every use case declares the providers it reads — inventory, cost, tickets, findings — and cites them in the answer; numbers come from the platform, not the model.
Tiered intelligence
Spark answers interactive questions in under three seconds; Tide reasons over migration plans and IaC; Abyss runs multi-step agents for the hardest cross-module work.
In the flow of work
An assistant drawer in every module, streamed answers, exports to PDF and Excel, and prompt caching so repeat questions are instant.
Inside the perimeter
Bring your model or run ours in-region; sovereign deployments run Whale AI fully offline with zero external data exposure.
How it works
- 1
Ask, in context
From any screen, ask about what you are looking at — a workload, a bill, an incident.
- 2
Ground
The use case gathers the live facts it declares, scoped to your permissions.
- 3
Answer with citations
The right tier reasons over the facts and streams an answer with the evidence behind it.
Inventory & Discovery — Generally available
Inventory & Discovery builds one live map of every resource you run — across AWS, Azure, Google Cloud, Oracle, Alibaba and Huawei, and on-premises VMware, Hyper-V, Nutanix and OpenShift estates connected through the Edge Agent. Resources are grouped by workload with their dependencies, so platform, security and finance teams work from the same picture instead of six consoles and a spreadsheet.
- 6 + on-prem
- Public clouds plus private estates in one inventory
- Workload
- Grouping with dependency mapping, not raw resource lists
- PDF · XLSX · CSV
- Exports for audits, CMDB and finance
Capabilities
Continuous discovery
Connectors sync each account on a schedule and on change events; the Edge Agent inventories hypervisors over outbound-only HTTPS. New resources appear without anyone registering them.
Workload grouping and dependencies
Resources are normalised into one model and grouped into workloads (VPC → subnet → compute → database), so an application is a unit you can search, cost and migrate — not a list of instance IDs.
Live lifecycle actions
Start, stop, tag, resize or retire from the inventory itself, with role-based approval where policy requires it and every action written to the audit log.
Reports and feeds
Export the estate as PDF, Excel or CSV, and feed the same inventory to Whalenomics (cost), Cloud Audit & Evidence (controls) and the Migration Engine (waves).
How it works
- 1
Connect
Add cloud accounts with read-only credentials and register Edge Agents for on-prem sites. The first discovery typically completes within minutes of a connector going green.
- 2
Normalise
Every provider's resource types are mapped to one schema with tags, owners, regions and relationships — the shared model every other family reads.
- 3
Work from one map
Search, filter by provider or workload, act on resources, and export — the inventory is the system of record for the estate.
Migration Engine — Assessment live · execution hooks in progress
The Migration Engine industrialises entry, movement and exit: on-premises workloads discovered by the Edge Agent are auto-classified, scored with a 6R assessment for cost, effort and blockers, and planned into rehearsable waves with rollback and Whale AI guidance. Assessment and wave planning are live; execution hooks are in progress.
- 6R
- Rehost · replatform · refactor · repurchase · retire · retain, scored
- Waves
- Dependency-aware planning with rollback
- Exit-ready
- The same engine rehearses regulator-mandated exit plans
Capabilities
Auto-classification
Discovered workloads are classified by type, dependencies and data gravity, so the assessment starts from facts rather than interviews.
6R assessment
Each workload gets a recommended strategy with estimated target cost, effort and blockers — and the evidence behind the score.
Wave planning with rollback
Waves are cut along dependency boundaries, rehearsed, and carry a rollback plan; Whale AI drafts the sequence and flags risks.
Execution hooks (in progress)
Handoff to tooling for the move itself, with status flowing back into the wave board and ITSM changes.
How it works
- 1
Discover
Edge Agents inventory the source estate and map dependencies.
- 2
Assess
6R scoring with cost, effort and blockers per workload.
- 3
Plan waves
Sequence, rehearse, approve; execute with rollback when the hooks land.
Observe — Generally available
Observe bundles production-grade observability into the platform — logs, metrics and traces in one place, SLOs with burn-rate alerting, synthetics, usage metering and notification channels — so teams get full observability of the estate without procuring and stitching a separate monitoring contract.
- Logs · metrics · traces
- One data model, one query surface
- SLOs
- Error budgets with burn-rate alerts
- Bundled
- Included in Standard & up — no separate contract
Capabilities
Unified telemetry
Ingest logs, metrics and traces from cloud services and agents into one store, correlated with the inventory so a signal always resolves to a workload and an owner.
SLOs and burn-rate alerts
Define availability and latency objectives per service; alerts fire on error-budget burn rate, not raw thresholds, which cuts noise and pages the right team.
Synthetics and metering
Probe endpoints from your regions, and meter usage per tenant or business unit — the same numbers Whalenomics and Tenancy use for billing.
Notification channels
Route alerts to email, chat and on-call tools, and open ITSM incidents automatically for SLO breaches.
How it works
- 1
Ingest
Cloud-native telemetry via provider APIs; agents and OpenTelemetry for applications; the Edge Agent for on-prem.
- 2
Define objectives
Set SLOs per service with the platform suggesting baselines from observed behaviour.
- 3
Alert and act
Burn-rate alerts route to channels and ITSM; dashboards and traces are one click from the incident.
Whale ITSM — Generally available
Whale ITSM is service management built for cloud operations: incidents with P0–P4 SLAs and breach detection, change and problem management, a knowledge base, a CMDB fed by the live inventory and kanban boards — with tickets raised directly from cloud events and two-way integration with ServiceNow and Jira where those remain the system of record.
- 5 ticket types
- Incidents, changes, releases, requests and problems — P0–P4 SLAs and approvals
- Auto-created
- Findings, alerts and deploys open the right ticket for the right team
- 30+ bridges
- Two-way with ServiceNow, Jira or another desk as system of record
Capabilities
Incidents from the estate
A failed connector, an SLO burn, a policy violation or a cost anomaly opens an incident with the affected workload attached — no copying from one tool to another.
Change and problem management
Changes carry the approval trail from the Service Catalog; problems link recurring incidents to a root cause and a fix.
CMDB without manual upkeep
Configuration items are the inventory — when a resource changes, its CI changes; relationships come from dependency mapping.
Integrations
Push and sync tickets with ServiceNow and Jira, keep your existing queues and on-call, and use the platform as the source of cloud context.
How it works
- 1
Classify
Set SLA classes and escalation paths per service; the estate's events map to them automatically.
- 2
Work the queue
Incidents, changes and problems in kanban or list views, each linked to the live resources involved.
- 3
Close with evidence
Every state change is recorded — the audit trail doubles as the evidence the regulator and the post-incident review both need.
Tenancy & Monetization — Preview · GA Q4 2026 (Telco & Datacenter Edition)
Tenancy & Monetization is the Digital Experience Layer for operators: native multi-tenancy with isolation and quotas, white-label portals, service catalogs and a marketplace, and per-tenant metering that feeds your own OSS/BSS and invoicing — so a telco or datacenter operator publishes governed cloud services under its own brand and bills for them. In preview now, general availability targeted for Q4 2026.
- Native
- Multi-tenancy with isolation and quotas per tenant
- White-label
- Portals, catalog and marketplace under your brand
- OSS/BSS
- Metering and billing feeds into your existing stack
Capabilities
Tenant isolation and quotas
Each tenant gets its own identity scope, resources, quotas and policies on shared operator capacity, enforced by the platform rather than by convention.
White-label experience
Portals with your logo, colours and domain; a catalog of your services and a marketplace for partners and ISVs.
Metering and billing feeds
Usage is metered per tenant and pushed to your BSS or invoicing — the operator keeps its commercial machinery and adds cloud products to it.
SLA and tenant health
Per-tenant SLA reporting and health visibility drive renewals and support, with ITSM tickets scoped to the tenant.
How it works
- 1
Model tenants
Define tenants, quotas and policies on the operator's estate.
- 2
Publish services
Build the catalog and brand the portal; open the marketplace to partners.
- 3
Meter and bill
Usage flows to OSS/BSS; SLAs and health are visible per tenant.
Sovereign Operations — Generally available — Government Edition
Sovereign Operations makes sovereignty a property of the architecture: in-country deployment with directorate-level segregation under central policy, air-gapped deployment classes with an offline update channel, FIPS-validated cryptography, always-on privileged access management, a WORM-backed audit log and offline-tolerant edge sites — with Whale AI operating entirely inside the perimeter.
- Air-gapped
- Deployment classes with offline updates and no call-home
- FIPS · PAM · WORM
- Validated crypto, always-on PAM, immutable audit
- In-region AI
- Whale AI Abyss runs on local models only
Capabilities
Segregation under central policy
Ministries, directorates or agencies operate their own estates with autonomy inside national guardrails — one policy plane, many isolated domains.
Air-gapped classes
The most sensitive estates run fully disconnected with an offline update channel; hybrid classes connect to sovereign clouds such as AWS GovCloud, Azure Government and Google Distributed Cloud.
Hardened by default
FIPS-validated cryptography, MFA mandatory on every role, PAM with session recording always on, residency enforced and evidenced.
Offline-tolerant edge
Remote sites keep operating under headquarters-grade policy when disconnected and reconcile when they reconnect.
How it works
- 1
Classify estates
Assign each estate a deployment class — in-country connected, sovereign cloud, or air-gapped.
- 2
Segregate and govern
Directorates get isolated domains; policy, identity and audit remain central.
- 3
Evidence continuously
State-audit evidence and compliance packs (FedRAMP / IRAP / StateRAMP-style) are generated from the WORM-backed trail.
Module availability by edition
| Module | Standard | Enterprise | Telco & Datacenter | Government |
|---|---|---|---|---|
| Cloud Connectors | Included | Included | Included | Included |
| Business Connectors | Included | Included | Included | Included |
| Partner Connectors | Included | Included | Included | Included |
| Service Catalog | Included | Included | Included | Included |
| Landing Zone Builder | — | Included | Included | Included |
| Whalenomics | Included | Included | Included | Included |
| Identity & Access | Included | Included | Included | Included |
| Security | Included | Included | Included | Included |
| Cloud Audit & Evidence | — | Included | Included | Included |
| Whale AI | Included | Included | Included | Included |
| Inventory & Discovery | Included | Included | Included | Included |
| Migration Engine | — | Included | Included | Included |
| Observe | Included | Included | Included | Included |
| Whale ITSM | Included | Included | Included | Included |
| Tenancy & Monetization | — | — | Included | — |
| Sovereign Operations | — | — | — | Included |