Skip to main content

Release notes

Each section is one released version, newest first. A note says what you can now do, what behaves differently, and what to do when you upgrade. Security fixes are not listed here.

0.65.0​

Changed​

  • Token exchange accepts a requested scope with a different name from the subject token's. An exchange that policy refuses is answered with access_denied, where the server used to answer invalid_scope. See Exchange a token.

0.64.1​

Changed​

  • The policyarc-server Helm chart scopes each topology spread constraint to its own release. Pods of two instances in one namespace no longer count against each other when the scheduler spreads them.
  • The SDK and the demo engine wait up to 30 seconds for a policy rule write, instead of 10. A rule that OPA refuses now comes back as the 422 response rather than as a client timeout.

0.64.0​

Added​

  • A grant can name the interface it covers, mcp for tool calls through /gateway/mcp or api for the REST gateway. Add an interfaces list to a granted_resources entry or a client_entitlements binding. A grant without the list covers both, so existing grants do not change. A call over an interface the grant does not cover is refused with interface_not_granted.
  • The Client Entitlements editor in the admin portal shows and edits each grant's interface, as MCP only, REST API only or Both.

Changed​

  • Breaking for a self-registered client that calls the REST gateway. The default entitlement for clients registered through plain dynamic registration or a client ID metadata document now covers MCP only. Claude Desktop, Cursor and other MCP clients work as before. To give such a client the REST interface, add interfaces: ["api"] to a client_id binding for it, or edit the platform default binding.
  • Creating a managed resource or installing a connector adds it to the self-registered clients' default only when it is exposed over MCP. A resource with no MCP tools needs its own grant.

Upgrade notes​

  • An existing instance keeps the baseline policy rules it was first seeded with. After the 0.64.0 image is running, reseed oauth/token.rego and oauth/client_entitlements.rego so that the interface setting is enforced. scripts/reseed_baseline_policy.sh oauth/token.rego oauth/client_entitlements.rego does this, and --dry-run shows what it would change first. A new instance seeds the new rules when it is created.

Fixed​

  • The example shape for client_entitlements in the admin portal showed "interfaces": "mcp". It now shows the list form, ["mcp"].

0.63.1​

Fixed​

  • The demo engine's intent step no longer fails on its first run against a new instance. It retries the one denial that comes from the policy engine not having loaded the new rule yet.

0.63.0​

No changes are listed for this release.

0.62.5​

No changes are listed for this release.

0.62.4​

Fixed​

  • The demo engine's dynamic registration step works against 0.62 instances again. It writes its settings to the per-control data rows that 0.62.0 introduced.

0.62.3​

Removed​

  • The compliance packs API under /admin/api/packs. Its three routes, the list, one pack and a pack's coverage, now return 404. To see what an instance enforces, call GET /admin/api/controls.

0.62.2​

No changes are listed for this release.

0.62.1​

No changes are listed for this release.

0.62.0​

Added​

  • Segments and bindings. A segment names a group of requests by facts about the client, the resource or the signed-in identity. A binding applies a control's settings to the requests its segments match. The control reference says which controls read bindings. Controls and segments explains the model.
  • Segment conditions can test list values with contains and not_contains.
  • Claims from an interactive sign-in reach policy. By default groups, roles, department, entitlements, email_verified, org, hd and amr are kept, and pbac.identity.claim-capture.allowed-claims replaces that list. Each kept claim is also an identity.<claim> fact for segments.
  • Policy sees more about a gateway call: the MCP tool name, and the managed resource's connector and upstream type.
  • A decision records the segments that governed it as matched_segments, and a gateway audit row names the control that decided it.
  • Every configurable control has a settings page in the admin portal, so most controls no longer need JSON edits. A write that breaks a control's schema is refused with 422 and the failing paths.

Changed​

  • Each control keeps its settings in a data row of its own, named pbac.operator.controls.<id>, and oauth_config no longer holds control settings. Tooling that wrote control settings into oauth_config must write the control rows instead. The control reference names each row.
  • A self-registered client's entitlement comes from the platform default bindings, which you can see and narrow, instead of from rules inside the policy. GET /admin/api/clients/effective-entitlements takes bindings into account.
  • The single-use token and token lifetime controls can apply to any client through a binding, not only to SPIFFE workloads.
  • The human approval control carries the approval routing, so a rule can name a target and an approval identity provider.
  • The admin portal's new control pages have French text beside the English.

Fixed​

  • Two admin portal pages, SPIFFE clients and IdP routing, rendered blank on an instance that had not configured them.
  • Two resource type pages in the admin portal read the new control row and saved to the old one while reporting success. They now save to the row they read.
  • The admin portal listed thirteen platform rules as the operator's own rules, each with a Delete button.

0.61.1​

No changes are listed for this release.

0.61.0​

Added​

  • French throughout the product: the admin portal, the SaaS dashboard, the sign-in pages, transactional email and the demo engine's evaluator page. The dashboard has a language picker, and ?lang=fr switches the admin portal and is remembered in a cookie.
  • Dashboard error messages are shown in the reader's language.

Fixed​

  • PBAC_ADMIN_APP_NAME and PBAC_ADMIN_LOGO_URI had no effect. They now set the admin portal's name and logo.
  • Dates in the governance report follow the reader's language.

0.60.0​

Changed​

  • Every decision an approval identity provider makes, approved, denied or refused, writes an audit row that names the client and the approver.
  • Policy routes each approval request to an approval identity provider, using the rule's approval_idp, then the reason's mapping, then the default.