diff --git a/README.md b/README.md
index abe1c0c..654d498 100644
--- a/README.md
+++ b/README.md
@@ -32,3 +32,5 @@ Not an ideal process, so we should improve.
 - [x] test ci permissions with a real terraform apply (not in ci)
 - [ ] can we make a lower-weight runner? ubuntu-latest is heavy and still requires ~1m for providers
 - [ ] For new domain should provide a default set of content in the bucket? or does that cost more for the extra creates, for a local project we may not care
+- [ ] in ci our terraform plan steps should output a file, which could get manually reviewed (add to PR as comment)
+- [ ] create workflow for drift detection