--- title: "Governance Platform v1.2.1 Release Notes" description: "Customer-facing release status for the Governance Platform v1.2.1 patch release." source: "Guardian Platform" --- Governance Platform v1.2.1 is a stable patch release for the v1.2 customer release line. It publishes refreshed runtime images, Helm charts, release manifest metadata, and customer package artifacts from validated release source refs. It restores declarations for indicator evaluations, tightens project and organization access checks, and adds bulk indicator application and a rebuilt plugin configurations view to Governance Studio. This release includes **breaking API changes** and a **database migration that cannot be reversed**. Read [Breaking Changes](#breaking-changes) and [Before Installing](#before-installing) before upgrading. ## Included Runtime Components - Governance Studio - Governance Service - Auth Service - Integrity Service - EQTY PDFGen - Gateway stack: LLM Gateway, Control Plane, and Console (opt-in) - Governance Platform deployment charts ## Breaking Changes These changes affect clients that call the platform APIs directly and operators who consume Auth Service tokens or service logs. Governance Studio is already updated for all of them. ### Governance Service API - **Indicators are applied through one batch endpoint.** The previous route is removed, with no alias: | Before | After | | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | | `POST /api/v2/projects/{projectId}/indicators/{indicatorId}/applications` | `POST /api/v2/projects/{projectId}/indicator-applications` | | Body `{"appliedPolicyControlId" \| "appliedPolicyControlIds", "status"}` | Body `{"applications": [{"indicatorId", "appliedPolicyControlId"}], "status"}` | `applications` is required and accepts 1 to 500 pairs. `indicatorId` accepts a UUID, `urn:uuid:`, or `slug:` value, and `status` defaults to `active`. The batch is atomic: if any pair is already applied, the request returns `409`, naming the indicator and control, and nothing is applied. The `apply_indicators` permission and the `201` response are unchanged. - **The organization project list is filtered per caller.** `GET /api/v1/organizations/{orgId}/projects` returns every project only to an owner of that organization. Other members receive only the projects they are assigned to, and a member with no assignments receives `200` with an empty list. - **Organization activity logs are scoped to the caller's projects.** `GET /api/v1/organizations/{orgId}/activity-logs` now admits members whose `view_project_data` comes from a project assignment, and limits them to their projects. Only an owner of that organization sees every entry; an owner of a different organization no longer does. - **Names are compared with whitespace collapsed.** Creating a project, creating a policy, or applying a policy treats names that differ only in spacing, including tabs, line breaks, and non-breaking spaces, as the same name. ### Auth Service API and Tokens - **Organization owners cannot hold project roles.** Owners already have every project permission in their organization. | Request | New behavior | | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | `POST` or `PUT /api/v1/organizations/{organizationId}/projects/{projectId}/members/{userId}` for an organization owner | `409 Organization owners cannot hold project roles` | | `POST /api/v1/organizations/{organizationId}/members` or `PATCH .../members/{userId}` combining `organization_owner` with a project role | `400` | | Granting `organization_owner` through either member endpoint | Removes the member's project assignments in that organization | Creating a project no longer makes its creator a `project_owner`. Existing owner project roles are removed during the upgrade (see [Database Migrations](#database-migrations)). - **Permission checks use current memberships.** For signed-in users, the `/api/v1/rbac/check/permission/...` and `/api/v1/rbac/permission/{permission}/projects` routes read roles from the user's current organization and project memberships instead of the roles in their token. A role that exists only in the identity provider token, and was never recorded as a membership, no longer grants access. API keys are unchanged. - **Project permissions no longer apply to an organization with the same id.** `GET /api/v1/rbac/user/permissions` adds `organizationPermissions` and `projectPermissions` maps alongside the existing `permissions` field. Requests that succeeded only because a project role was matched against the organization with the same numeric id are now denied. - **`GET /api/v1/rbac/user/permissions` returns `500` when a lookup fails** instead of `200` with the missing permissions omitted. - **Permission metadata keys are lowercase.** `GET /api/v1/rbac/metadata/permissions` returns `name`, `description`, and `category` instead of `Name`, `Description`, and `Category`. - **The `platform_access` token claim is removed.** Tokens no longer carry `https://governance.eqtylab.io/platform_access`. Service account tokens carry `is_service_account` and `service_name` instead. - **Service accounts cannot be imported as members.** `POST /api/v1/external-users/import` returns `400` for a service account. - **Path identifiers resolve by membership.** Auth Service routes accept the same identifiers as Governance Service (see [Access and API Keys](#access-and-api-keys)). A project UUID or `slug:` in an organization where the caller has no role returns `404` rather than `403`, as does an unknown or another user's `did:key`. - **User signing keys cannot use the platform key name.** Creating a user key whose normalized name matches the platform signing key returns `403`. ### Governance Service Writes - **Writes check permissions live.** Create, update, and delete requests to Governance Service bypass the Auth Service permission cache, so a revoked role blocks writes immediately rather than after `AUTH_CACHE_TTL`. A refusal from Integrity Service now returns `403 Insufficient permissions` instead of `500`. ### Operations - **Auth Service no longer falls back to another key provider.** An unknown key management provider, or one that fails to initialize, stops Auth Service at startup instead of falling back to Azure Key Vault or to mock keys. The selected provider's required settings are checked at startup. Confirm your key management configuration before upgrading. - **Integrity Service writes structured logs to stdout.** Logs are JSON lines on stdout when stdout is not a terminal, instead of text on stderr. `RUST_LOG` replaces the configured log levels when set. Update log collection that reads Integrity Service stderr or parses its text format. ## Changes Since v1.2.0 These changes are grouped by area. ### Governance Studio - Apply several indicators to a control, or one indicator to controls across several policies, in one step, with a confirmation screen that reports any pairs that could not be applied. - The gateway plugin configurations tab is rebuilt: a summary of the active configuration, hooks listed in execution order, a details panel for each plugin that can be linked to directly, idle and disabled entries, rollback candidates in the history table, and the reason an agent's membership was denied. - User names across Studio link to the member's page, including invitations, agent registration and authorization, credential issuers, and configuration history. - Activity logs filter by user rather than display name, so members who share a name can be told apart, and filtered views can be linked with `?user=` and `?project=`. Member activity logs show project names. - Agent badges are searchable by label and plugin, with a more compact badge and a wider badge dialog. - Breadcrumbs for an archived applied policy lead to the archived policies view, and evaluation logs for an archived policy show the archived banner. - Service accounts are no longer offered in the add member dialog. - Agent project associations can be created without an expiration date. - After you change your own roles, Studio refreshes your permissions and project list without a page reload. - Long policy names no longer break page layout, and policies whose names contain tabs, line breaks, or repeated spaces can be archived or deleted by typing the name. ### Access and API Keys - `GET /api/v1/api-keys/{keyId}/usage` returns the requests recorded for an API key, newest first, with `limit` (default 50, maximum 200), `offset`, and `since` parameters. It is available to the key's owner through a signed-in session. - Auth Service routes accept integer ids or UUIDs for organizations, integer ids, UUIDs, or `slug:` values for projects, UUIDs or `did:key` values for users, and key names or `did:key` values for keys. - Adds the `revoke_agents` and `restore_agents` permissions, granted to organization owners. API keys cannot carry these scopes. - Organization owners' API keys that are scoped to permissions but not bound to a project reach every project in the organization. - `GET /api/v1/organizations/{orgId}/members/{userId}/activity-logs` lists a member's activity, addressed by user UUID or `did:key`. A UUID also returns the history of a former member. ### Signing - **Version-bound signing.** Clients can fetch the current signing key reference from `GET /api/v1/protected/signing-key` or `GET /api/v1/protected/platform/signing-key` and pass it as `signingKeyReference` when signing; the request returns `409` if the key has rotated in between. - **Version-bound PDF signing.** Set `eqty-pdfgen.config.signingBound: true` to have EQTY PDFGen fetch its certificate from Auth Service and bind each PDF signature to that key version. EQTY PDFGen now verifies every signature against its certificate before embedding it, and fails the render on a mismatch. - Setting `eqty-pdfgen.config.timestampUrl` to an empty value signs PDFs without an RFC 3161 timestamp, for environments without outbound access. ### Gateway Stack - Project membership credentials without an expiration date are accepted, and LLM Gateway prefers a non-expiring credential when choosing the one that authorizes a request. Previously such credentials were treated as invalid. - Credentials issued with the EQTY identity, component, and state attestation contexts verify offline. - The gateway stack was not enabled in the staging validation for this release, so these changes are not covered by its validation evidence. ### Integrity Service - Project membership credentials can be issued without an expiration date by omitting `expiryDate`. - Logs can be exported over OTLP by setting `OTEL_EXPORTER_OTLP_ENDPOINT` or `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT`. ### Fixes - Indicator evaluations create their declarations and evidence attachments again. In v1.2.0, the governance worker was denied permission to create declarations, so evaluations were recorded without declarations on the control timeline. Declarations missing from evaluations run on v1.2.0 are not backfilled; rerun the affected evaluations to produce them. - With a preconfigured Keycloak governance worker client secret, the governance worker is now linked to its identity and receives its DID key. - Microsoft Entra ID worker requests no longer create duplicate users. - Project agent pages in Governance Studio no longer fail for agents without badges. - Credentials issued by Integrity Service with sub-second timestamps verify in the gateway stack. - Plugin versions no longer display with a doubled `v` prefix. - A failed permission lookup is no longer cached as lost access. - Governance Service logs client errors and Integrity Service refusals as warnings rather than errors. ### Security - Updates `anyio` in the EQTY PDFGen image to 4.14.2 for CVE-2026-63374. - Governance Studio opens only `http` and `https` citation links. - EQTY PDFGen restricts its signing digest to SHA-256. ### Charts and Release Manifest - Bumps runtime and umbrella Helm charts to `1.2.1` and pins component source refs, image tags, and image digests in the release manifest. - Runtime charts accept `image.digest` to pin an image by digest, including the gateway stack images. - `global.utilityImages.busybox` sets the image used by the Auth Service, Governance Service, and Integrity Service dependency wait containers. - `governance-service.localStorageCA` adds a private CA for local object storage to Governance Service's trusted certificates. - Integrity Service supports filesystem blob storage with `integrity-service.config.integrityAppBlobStoreType: local_fs` and `integrityAppBlobStoreLocalPath`, backed by `integrity-service.persistence.integrity.existingClaim`. - All new values are off by default. With unchanged values, v1.2.1 renders the same resources as v1.2.0. ### Installation Tooling - Deployment guides, examples, and `govctl` are updated for Cloudsmith distribution. `govctl init` defaults to `--artifact-source cloudsmith`, which keeps the chart's image tags and digests with `IfNotPresent` pulls. Pass `--artifact-source github` to install from GitHub Container Registry as before. ## Customer Artifacts - Release manifest - Packaged Helm charts and chart digests - Connected installation package with its checksum - Optional air-gap package when enabled for the release - Generated OpenAPI reference - Generated Helm values reference ## Before Installing Confirm that the release manifest has `validation.evidence.status` set to `approved`, and use only the chart versions and runtime image tags recorded in that manifest. Do not mix v1.2.1 images or charts with earlier v1.2 artifacts. Update any direct API integration, token consumer, or log pipeline for the [breaking changes](#breaking-changes) above before upgrading. If you set `global.imageRepositoryPrefixOverride` and enable the gateway stack, the Control Plane registry wait container now pulls `docker.io/library/postgres:17.6` rather than a prefixed copy. In an air-gapped environment, set `gateway-stack.controlPlane.waitForRegistryViews.image.repository` or `global.imageRegistryOverride` to your mirrored image. ### Database Migrations This release migrates the Auth Service, Governance Service, and Integrity Service databases. - **Auth Service removes project roles held by organization owners.** Project assignments held by an owner of the same organization are deleted, and project roles are removed from owners' organization memberships. The down migration does not restore them. Record any owner project assignments you need before upgrading. - **Governance Service indexes the activity log.** The index is built without `CONCURRENTLY` and blocks writes to the activity log until it completes, which depends on the size of the table. - Auth Service adds two tables that this release does not use, and replaces an index on API key usage. - Integrity Service allows project membership credentials without an expiration date. Its down migration refuses to run once such a credential exists. Plan the upgrade as follows: 1. **Back up all platform databases.** Rolling back to v1.2.0 requires restoring this backup. 2. **Schedule a maintenance window** sized to the Governance Service activity log table, during which platform writes are blocked. 3. **Confirm your key management configuration**, because Auth Service no longer starts with a missing or invalid provider. 4. **Upgrade the `governance-platform` chart to `1.2.1`** as described in [Upgrade](../deployment/upgrade.mdx), using the chart versions and image tags recorded in the release manifest. ## Release Readiness This release is customer-facing. The deployment repository published the `platform/v1.2.1` GitHub Release, and the release manifest records approved manual validation evidence. That validation covered a staging upgrade from v1.2.0 with Keycloak and external PostgreSQL. The gateway stack was not enabled in staging and is not covered by it. ## Related - [Governance Platform v1.2](../release-overview.mdx) — the current release line and its documentation areas - [Release Manifest](../deployment/release-manifest.mdx) — the chart versions, image tags, and digests a release pins - [Upgrade](../deployment/upgrade.mdx) — moving an environment to this release - [Rollback](../deployment/rollback.mdx) — returning to the previous release if the upgrade is not accepted - [Known Issues](../deployment/known-issues.mdx) — release advisories to review before installing - [Governance Platform v1.2.0 Release Notes](./v1-2-0.mdx) — the release before this one