Product release notes

These notes cover material customer-visible product changes. They are separate from the documentation changelog, which records edits to this portal. Security-only fixes may be summarized without exploit detail.

October 2026

Agent updates and reads

• The connector bundle an agent downloads is now signed and verified before it is installed, and an update never installs an older version than the one running. An agent pinned with RV_AGENT_SELF_UPDATE=0 now keeps its code on every path, including a pushed update and a bundle refresh. The legacy shared-key update is off unless the operator switches it on. See Tier-3 hybrid architecture.
• An agent that is too old to report which parts of a read it could not see now holds destructive writes (revokes, account disables and deletions) to its systems as policy-blocked jobs until it is updated. Additions are not held.

Lifecycle and write safety

• A person can hold several concurrent employments, each its own employment row; policies are evaluated per row and the HR feed can deliver the rows. Joiners waiting for onboarding activation can get a staged (disabled) account on systems where that really stops access. See JML flows.
• Every write that reconciliation makes to a target is recorded as a durable write intent first, and a write whose outcome is unknown is never repeated blind. See Reconciliation.
• A suspended, offboarding or restoring tenant, an expired POC and the provisioning pause now freeze writes to connected systems through one rule; only an emergency removal under a lockout or kill switch still passes. See POC Mode.
• Initial passwords for new directory accounts are delivered by configurable notification rules per system and account type, with several recipients and timing. On an agent-connected system the agent can mail the password itself.

September 2026

Decision and review fidelity

• Approval routing now uses one ordered rule shape with explicit fall-through; retired else branches and stop-on-match controls are no longer presented.
• Access-review coverage distinguishes holders reached directly, through fallback and event-only populations so a green number cannot hide missing cadence.
• Reviewer labels, leaver-cascade rows and decision sentences were corrected to use current policy and live data rather than stored display text.

Connector and provisioning reliability

• Generic REST gained explicit entitlement create/update/delete capability where the configured engine supports it.
• Provisioning claims, audit events and reconciliation keys were tightened so retries converge on the same operation instead of creating a second ambiguous path.
• Entra, LDAP, Salesforce and custom-API mapping claims were rechecked against their implemented capabilities.

Lifecycle and setup

• The setup journey moved to a six-phase model with an explicit review before activation.
• Joiner/mover/leaver treatment now exposes membership sets, rejoiner handling, retention choices and provisioning holds at their decision points.

August 2026

Reporting opens as a live view

Reports now open as reader-scoped, paginated and sortable rows. The same configured-view evaluator feeds on-screen results and exports, including masking and export caps. The universal configuration rail and general summary mode remain named follow-ups.

NHI lifecycle drivers

The generic NHI tier ladder was replaced by an asserted lifecycle driver. Explicit and inherited drivers may influence driver-specific findings; suggestions and unknown values remain visible and cannot silently suppress work.

Safety and hybrid delivery

• Circuit-breaker trips are recorded per system and provisioning caps can limit operation classes over a window.
• Tier-3 WebSocket notification reduces task latency while long-poll remains the fallback. The product does not claim exactly-once delivery or transparent agent failover.

For the complete limitations register, see What we don't claim.