docs: More TODO docs

README.md

@@ -39,6 +39,11 @@ Compared to lldap, llldap:
 
 We may explore in the future:
 
+- domain mapping (eg. .org/.fr/.onion)
+- optional complete logging of all activity
+- 2-factor auth
+- Shamir's secret sharing social account recovery
+- Permission to create invites on an account
 - i18n domains (punycode)
 - i18n user identifiers (TODO: check compatibility with other tools)
 - RTL languages

docs/groups.md

@@ -0,0 +1,8 @@
+# Groups
+
+> [!WARNING]
+> This is a design document and does not necessarily reflect the current state
+> of the implementation.
+
+WIP: A group is only valid on a single domain, except for global service groups (eg. `admins`). A group
+has permissions to perform some actions on a domain.