Product release notes

These notes cover material customer-visible product changes. They are separate from the documentation changelog, which records edits to this portal. Security-only fixes may be summarized without exploit detail.

September 2026

Decision and review fidelity

• Approval routing now uses one ordered rule shape with explicit fall-through; retired else branches and stop-on-match controls are no longer presented.
• Access-review coverage distinguishes holders reached directly, through fallback and event-only populations so a green number cannot hide missing cadence.
• Reviewer labels, leaver-cascade rows and decision sentences were corrected to use current policy and live data rather than stored display text.

Connector and provisioning reliability

• Generic REST gained explicit entitlement create/update/delete capability where the configured engine supports it.
• Provisioning claims, audit events and reconciliation keys were tightened so retries converge on the same operation instead of creating a second ambiguous path.
• Entra, LDAP, Salesforce and custom-API mapping claims were rechecked against their implemented capabilities.

Lifecycle and setup

• The setup journey moved to a six-phase model with an explicit review before activation.
• Joiner/mover/leaver treatment now exposes membership sets, rejoiner handling, retention choices and provisioning holds at their decision points.

August 2026

Reporting opens as a live view

Reports now open as reader-scoped, paginated and sortable rows. The same configured-view evaluator feeds on-screen results and exports, including masking and export caps. The universal configuration rail and general summary mode remain named follow-ups.

NHI lifecycle drivers

The generic NHI tier ladder was replaced by an asserted lifecycle driver. Explicit and inherited drivers may influence driver-specific findings; suggestions and unknown values remain visible and cannot silently suppress work.

Safety and hybrid delivery

• Circuit-breaker trips are recorded per system and provisioning caps can limit operation classes over a window.
• Tier-3 WebSocket notification reduces task latency while long-poll remains the fallback. The product does not claim exactly-once delivery or transparent agent failover.

For the complete limitations register, see What we don't claim.