Documentation changelog

Material changes to this concept reference. This is the documentation changelog, not a substitute for customer release communications.

6 November 2026 — product changes of 5 November

• Evidence and signed exports: audit events, lifecycle events, certification decisions and privileged grants are no longer capped in an evidence pack; every pack carries a readable report.pdf and a CSV per section with names, both signed; a section that fails is marked failed; the risk snapshot leaves out people who left.
• Reporting: conditions pick their value from real options; "Identities without a manager" lists people only; grant reports skip grants on retired accounts that are not in the target; Privileged access names the account; the Lifecycle / JML report carries the Lifecycle page's numbers; PDFs and the Excel export have one branded layout.
• Safety limits: a reset or discard keeps the sync paused unless you tick the box; a held run that repeats a settled difference is filed as a repeat.
• Failed jobs queue: an administrator can cancel a stuck pending retry with a reason.
• JML flows: a right carried across a move lapses at its deadline (or is kept, per dimension); a failed move closes once reconciliation covers the person.
• Governing AI agents: AI-platform service accounts become service account identities; Claude agent tools, MCP servers and skills are their own permission kinds, with a finding for an MCP server nobody listed; a personal Claude key that looks like automation is flagged.
• Data authority: the API identity source is stale only when it never pushed.

5 November 2026 — product changes of 4 November

The inbox has two tabs, To decide and Work to do, and Work to do groups its items per system and cause with actions that apply to the whole group (how it fits together, approvals); Claude and OpenAI organisations can be connected read-only, with Claude managed agents discovered as agents, and the agent register has a Connect an AI platform button (governing AI agents); a leaver's identity page shows the leaver grace and when it ends (JML flows).

4 November 2026 — hosting, backup and status page

• Hosting and regions: the off-region database copy is a daily encrypted copy since 22 October 2026 (it was weekly and by hand), and a full rebuild in the other region from it was drilled on 23 October. The rollback was drilled on staging; a production rollback run is still open.
• What we don't claim and operating rhythm: the public status page is live since 16 October 2026; it publishes no uptime figure.

4 November 2026 — product changes of 3 November

Home now shows the administrator failed writes grouped per system and error class (failed jobs queue), the security team who is elevated right now and any session past its end (privileged access), the auditor the readiness of each evidence pack (evidence and signed exports), and the end user what they hold and what is often requested in their department (access requests); the two governance numbers get a 30-day trend (operating rhythm).

3 November 2026 — product changes of 2 November

A leaver without an account on a system is no longer warned about a missing account there, and no account is planned for them (one person, many accounts, JML flows).

2 November 2026 — product changes of 30 October to 1 November

Workflows gained forms with their own questions and file questions, Choose a path, In parallel, For each, steps that change an existing record, task questions, reminders and escalation, a choice per step between system rights and the starter's rights, stop rules and three more starters (workflows); changing a live role now waits for its owner's approval, an Extend proposal says how its members hold the access and zero-gain proposals are labelled Clean-up, and a proposed retirement plan is an inbox task (roles); a tier-3 agent refuses every tunnelled call until RV_AGENT_TUNNEL_ALLOWLIST is set (tier-3 hybrid); who decides exception requests is set per finding kind, and a person requests an exception from My requests (separation of duties); a group that grants a platform role is provisioned only when its approver could make the change in Platform access, and My requests has a For me tab (access requests); a later chain step waits for the earlier one (approver chains); the security team lists every identity and a system owner lists the system's accounts and waiting writes (what you see); claims are passed on to a chosen person and management-group rules are edited in the console (NHI and ownership); the strictest status wins when a leave starts (JML flows); a SCIM read that ends early is partial (SCIM); "Not attested yet" for agents (AI agent governance); the sponsor submits the intake (external onboarding); a new review rule starts as a draft (certification); Connected assistants in the profile menu (MCP server); list columns and sort are saved to the account (reporting).

30 October 2026 — product changes of 29 October

Every employee can claim a non-human identity from a new Claim an account page; an IAM administrator or the current owner still approves (NHI and ownership); the compliance officer creates, starts and signs off review campaigns, and anyone without that right sees New campaign disabled with the reason (certification); the data-set list shows the shortest fixed and after-activation retention apart (external onboarding); the sign-in code an assistant uses works once, and a replay revokes what the first use gave (MCP server).

29 October 2026 — product changes of 28 October

The person a Platform Advisor finding is routed to can snooze it from the Inbox, and the finding for a leaver whose account is still enabled can now disable that account (Platform Advisor); anyone who may request access can ask for a JIT elevation, also without an administrative account on the system yet (privileged access); the business admin reassigns items in a campaign (certification); a manager can remind people in their own team about waiting decisions (approvals workbench); re-running the ungoverned-access analysis is offered only to who may run it (roles); an administrator sees File shares before the preview is switched on (unstructured-data visibility); mail delivery in smtp mode needs a host and delivery health names the platform relay (notifications and webhooks); the retention of sync run logs has its own screen (imports and schedules).

28 October 2026 — product changes of 27 October

Changed, mostly who may do what: a privileged right nobody owns says so before it is requested, an administrator elevating directly sees the approval chain, the security team and auditors read the JIT oversight tabs, and the security team reviews an ended or expired break-glass activation (privileged access); an entitlement's owner switches it requestable or not (access requests); the assignee of an access-request decision can hand it to a named person (approvals workbench); the business admin reminds, escalates and cancels campaigns and applies a cadence (certification), proposes retiring a role, and a self-approved retirement plan is marked as such (roles), and decides record-process intake (record processes); the security team sets the cap on a separation-of-duties exception, and a finding kind without its own policy has a default approval step (SoD and risk); the helpdesk runs reconciliation for one person (reconciliation); an agent's owner edits its purpose (AI agent governance); an application's owner decides its onboarding requests (NHI and ownership) and exports its access (reporting); an organisation's onboarding profile can be changed (external onboarding); a dates-only HR feed's employment row follows the feed's department and other contexts, so a move raises a mover event (JML flows).

27 October 2026 — product changes of 26 October

New: a Workflows page replaces Automation, with triggers on a person's dates and per person, Wait, Task (in the Inbox), Request access and Call a system steps, a test run that writes nothing and three starter workflows; the script library is gone (workflows, starter packs and lifecycle mails, imports and schedules, workbench lenses). New: break-glass profiles carry an access mode and Coverage flags a mode mismatch (privileged access); an ownership certification asks who takes over a non-human identity before its owner leaves (NHI and ownership); the leaver grace is proposed from history, and a leaver's new policy matches are held (JML flows); requestability proposals can be dismissed and brought back (approvals workbench); the request catalogue shows each right's type, description and details (access requests). Changed: a capped evidence-pack section is declared (evidence and signing); an emergency lockout writes accounts together and names the ones it could not restrict (reconciliation); the request-time SSRF check covers SMB and a customer-hosted HashiCorp Vault, and the agent pins every host a connector's configuration names (tier-3 hybrid); AD writes find a leaver moved to the leaver OU (LDAP and AD); writes use the authentication kind chosen for them, and the mTLS option is gone (onboarding walkthrough); snoozed and dismissed Advisor findings can be reopened (advisor).

26 October 2026 — product changes of 23 to 26 October

Changed: onboarding only reads, in three screens (Connect, Review, First sync), and a target system goes live with its writes off; writes are turned on per operation with Set up writes on the system's Writes tab (onboarding walkthrough, quickstart, implementation guide, provisioning mappings, what we don't claim). Removed: workflow packages, the nine starter templates, IVIP mode, sequences and schema mappings; the lifecycle mails are notification rules and the Library is Starter packs (starter packs and lifecycle mails, unstructured-data visibility). Changed: a privileged right without an owner is held from the catalogue, and Approvals proposes requestability and chains (access requests, approvals workbench); a tripped breaker no longer makes Platform health critical (platform health); percentage breakers need 10 rows, and caps are proposed from observed volume (safety limits); the old identity status names match nobody (JML flows, external onboarding); "Sync now" has no synchronous form (imports and schedules); the HMAC agent update is removed (tier-3 hybrid). New: a person's app passwords and tokens, revoked at the source on request or on leave (one person, many accounts, Salesforce, ServiceNow); API keys expire, have an owner and are recertified (API access); shared account types and global account rules (account types, account rules); review cadence suggestions and review patterns (access reviews); source-priority proposals (data authority, data model); proposals from history for the mover mode and HR status values (JML flows); one JIT request flow (privileged access); the Work and Setup menu (what you see); the Retirement page and one Roles list (roles and role mining); the Reconciliation tabs (reconciliation); the process audience (record processes); 78 Advisor checks (Platform Advisor).

23 October 2026 — product changes of 22 October

Changed: batch approval and review mode are one "review first" setting per system and per kind of change. Adding and removing access, moving, creating, enabling, disabling and deleting an account, and attribute updates can each be held on the system's Review tab; an attribute update is held with its values instead of refused (what we don't claim, access requests, reconciliation, LDAP and Active Directory, quickstart). New: the AI-agent register's posture row, platform and finding filters, and a finding for agents that share one AWS role or Google Cloud service account (AI agent governance); 74 Advisor checks (Platform Advisor).

22 October 2026 — product changes of 20 and 21 October

New: an owner reads a holder's access, not the person, and lifecycle views follow the reader's scope (what you see); break-glass outcomes per entitlement and no review of your own activation (privileged access); end dates in the tenant's time zone, past windows refused, a reason on every rejection (access requests); the AWS kill-switch attaches your managed deny-all policy, the external ID is generated by RapidValue, and a connection test says when the kill is not granted (AI agent governance); shadow agents revoked at the source on an opted-in system and read on a tier-3 agent (shadow AI agents); a people file (CSV) as an authoritative source of people (imports and schedules); connector onboarding from an assistant reviewed at checkpoints (onboarding walkthrough); "No login yet" on a decider without a login (access reviews and approvals); policy conditions on an org dimension match the context membership (employments and multi-affiliation); two new Advisor checks, 73 in total (Platform Advisor).

21 October 2026 — AI agents, product changes of 20 and 21 October

New: the MCP gateway's decisions, runtime terms, requests to the owner, missions, agent chains, the catalog of approved MCP servers and the hold on changed tool definitions, described as running on staging (deciding every agent call); shadow AI agents found in Entra and Google Workspace consents (shadow AI agents); Agentforce, ServiceNow AI agents, AgentCore and Agentspace discovered, permissions on the platform, the access review of an agent's grants, the five ways to end access and the per-agent EU AI Act pack (AI agent governance); agent and integration-credential reads (Salesforce, ServiceNow); RapidValue's own MCP server on one page, with its 24 tools, the four gates and connector onboarding reviewed at the credentials and activation checkpoints (RapidValue's MCP server).

20 October 2026 — product changes of 19 October

New: Ed25519 signatures with a published key per tenant and purpose, hourly chain-head anchors in a write-once store, and older HMAC/ECDSA packs that keep verifying (evidence and signing); every person's assistant registered as a governed AI agent, assistants allowed by their client metadata URL, and MCP protocol 2026-07-28 beside the earlier handshake (API access governance); the NHI chain view and its evidence section, per agent or tenant-wide, and the rotation-overdue finding (NHI and ownership, AI agent governance).

19 October 2026 — product changes of 16 to 19 October

New: one review per grant and reviewer when a campaign and a rule overlap, and NHI attestation routed to the owner first (access reviews, AI agent governance, NHI and ownership); mailed approval links that stop when the feature is switched off (access reviews and approvals); the SSO button first on the organisation's own address (single sign-on); the access reviewer role (tenant isolation); administrators staffing every protected group, and sessions revoked when a protected role is lost (privileged access); hidden identity fields masked on the server, and the org chart and global search following the list scope (what you see); the removal share on batch approval (safety limits); the missing Graph permission named on a 403 (Entra connector); a leaver's leftover grant rows (JML flows); the tenant-wide account naming default (account types); what a person's assistant can read, request and decide (API access governance); request-time SSRF checks for in-process connectors (tier-3 hybrid).

16 October 2026 — product changes of 13 to 16 October

New: the identity-provider step-up round trip and the repeat of the refused action (privileged access); the platform relay as a bounded, opt-in exception to the secret rule (tier-3 hybrid); the Entra kill revoking agent-user sessions (AI agent governance); the rule-engine card, sweep list and named erroring connectors (platform health); proposal cards that say what a role adds (roles and role mining); the entitlement and its type as status levels (JML flows); the OU placement row and its expression (LDAP connector); unanchored chain forks reported as unproven (evidence and signing).

13 October 2026 — recent product changes

New: second-factor freshness for break-glass, privileged elevation and AD-writing approvals (privileged access), the breaker ledger for certification-deadline and sunset removals (safety limits), "Sync now" as a request, chunked big syncs and agent read ceilings (imports and schedules).

12 October 2026 — claims checked against code

A second pass checked the claims the full review had left open. Corrections: reconciliation (the drift kinds: a disabled account is no kind of its own, and three kinds wait for a human), unstructured visibility (reader reviews are not built yet), cert flows (the seeded event rules), account types (scope defaults are the Entra template's), the glossary, and a handful of numbers that could not be proven were softened.

12 October 2026 — full review of the remaining pages

Every page that was last verified before 11 October was checked against the product and updated where it had drifted. The ones with the largest changes:

• Connectors: Entra (creating users, licence, app-role and directory-role writes, agent identities), LDAP and AD (certificate verification, nested groups, account creation and password delivery), SCIM, REST, ServiceNow, Salesforce and Workday.
• Requests and approvals: access requests are reconciliation-only, approver chains gained step fallbacks and four eyes, access reviews and approvals and the advisor.
• Access and identity: SSO required for the whole tenant, tenant isolation per address, webhooks and API access as shipped.
• Governance: AI agent governance across Entra, AWS, Google Cloud and GitHub, NHI and ownership, SoD and risk, roles and role mining.
• Operations: provisioning jobs, platform health, evidence and signing, Tier-3 hybrid, POC mode, the quick start, the glossary and the release notes.
• What we don't claim: LDAP/AD certificate verification and the credential register follow the same facts.

12 October 2026 — privileged access, account types and certification pages

• Privileged access: no plan gate, pre-authorised direct elevation, break-glass changes, and the report-only MFA policy for administrator roles.
• Account types: classification decides the type, per-type settings after creation, and the leaver grace per type.
• Cert flows: what a rule does not review, reviewers who cannot decide, inbox bulk decisions, mover carry-reviews and durable revokes.

12 October 2026 — lifecycle and reconciliation pages brought up to date

• JML flows: joiners who wait for an onboarding activation (staged accounts), employment rows with per-row policy evaluation and the HR employment import, and the rule that an active person's lapsed account gets no leaver grace.
• Reconciliation: the mass-revoke breaker is now a ledger per system over a rolling window, covering every destructive recon write, plus the write intent record behind every write.
• Safety limits: the reconciliation breaker card, per-system exceptions, and status-disable counting in the sync breaker.
• Not yet covered: the main employment and the fields derived from it, and the pre-hire hold, both still in review in the product.

11 October 2026 — hosting status corrected

• Hosting and regions now says what is true: production has run on Scaleway Amsterdam since 24 September 2026, the AWS runtime has been stopped, and no customer is live yet. The "compatibility lab" wording of 12 September is retired.
• Replaced the exit-criteria list with what is in place and what is not yet in place (rollback exercise, failure-mode validation, on-call, service level, the first-customer gate).
• What we don't claim: the status-page, deployment and AWS-deploy-window statements follow the same facts.

12 September 2026 — European hosting direction

• Added a status-led hosting and regions reference.
• Documented Scaleway Amsterdam as the decided primary European managed-SaaS target while keeping the compatibility lab distinct from production support.
• Kept AWS as a supported secondary provider target and marked customer-managed cloud and on-premises control planes as future enterprise options.
• Replaced broad sovereignty wording in the Tier-3 and POC references with the narrower, technically verifiable credential-custody boundary.
• Added explicit limits for legal claims, high availability and provider-specific operational runbooks.

11 September 2026 — accuracy and completeness pass

• Added practical quickstart, implementation guide and troubleshooting.
• Added Reporting as a live view, documenting the shipped reader-scoped view/export model and its deferred configuration and summary surfaces.
• Added Source provenance and data authority, explicitly separating shipped connector/mapping provenance from the unshipped universal authority matrix.
• Added the machine API reference, including scopes, pagination, identity writes, batch semantics and error behaviour.
• Corrected the distinction between an NHI lifecycle driver and an AI agent's declared autonomy tier.
• Replaced all diagram placeholders with accessible architecture diagrams.
• Added visible verification ownership, structured page metadata, sitemap, robots policy, feedback events and zero-result search reporting.

10 September 2026 — portal redesign

• Replaced the flat two-column document template with a responsive documentation shell: persistent desktop navigation, an accessible mobile drawer, page-level table of contents and previous/next navigation.
• Added full-text search across titles, summaries, headings and article content.
• Rebuilt the homepage around four reader paths rather than repeating the full catalogue twice.
• Added canonical URLs, share metadata, keyboard focus treatment, a skip link, larger interaction targets and reduced-motion support.
• Added this changelog and a per-page feedback route so corrections have a clear way back into the product repository.
• Added Safety limits, closing the largest capability gap identified in the post-freeze documentation review.

6 August 2026 — record processes and lifecycle coupling

• Added Record processes: governed create, update and retire for modelled object types.
• Added Lifecycle coupling: how business-record events result in governed proposals without writing access directly.
• Corrected connector, onboarding and provisioning claims against the shipped implementation.

2 August 2026 — trust pack and reader-led navigation

• Added Tenant isolation, Evidence and signed exports and What we don't claim.
• Reorganized the reference into six groups by reader intent.
• Rewrote the front door around evaluator, implementation, security-review and operational reading paths.