EQTY LabDocs

Governance Platform v1.2.1 Release Notes

Customer-facing release status for the Governance Platform v1.2.1 patch release.

View as Markdown

Governance Platform v1.2.1 is a stable patch release for the v1.2 customer release line. It publishes refreshed runtime images, Helm charts, release manifest metadata, and customer package artifacts from validated release source refs. It restores declarations for indicator evaluations, tightens project and organization access checks, and adds bulk indicator application and a rebuilt plugin configurations view to Governance Studio.

This release includes breaking API changes and a database migration that cannot be reversed. Read Breaking Changes and Before Installing before upgrading.

Included Runtime Components

  • Governance Studio
  • Governance Service
  • Auth Service
  • Integrity Service
  • EQTY PDFGen
  • Gateway stack: LLM Gateway, Control Plane, and Console (opt-in)
  • Governance Platform deployment charts

Breaking Changes

These changes affect clients that call the platform APIs directly and operators who consume Auth Service tokens or service logs. Governance Studio is already updated for all of them.

Governance Service API

  • Indicators are applied through one batch endpoint. The previous route is removed, with no alias:

    BeforeAfter
    POST /api/v2/projects/{projectId}/indicators/{indicatorId}/applicationsPOST /api/v2/projects/{projectId}/indicator-applications
    Body {"appliedPolicyControlId" | "appliedPolicyControlIds", "status"}Body {"applications": [{"indicatorId", "appliedPolicyControlId"}], "status"}

    applications is required and accepts 1 to 500 pairs. indicatorId accepts a UUID, urn:uuid:, or slug: value, and status defaults to active. The batch is atomic: if any pair is already applied, the request returns 409, naming the indicator and control, and nothing is applied. The apply_indicators permission and the 201 response are unchanged.

  • The organization project list is filtered per caller. GET /api/v1/organizations/{orgId}/projects returns every project only to an owner of that organization. Other members receive only the projects they are assigned to, and a member with no assignments receives 200 with an empty list.

  • Organization activity logs are scoped to the caller’s projects. GET /api/v1/organizations/{orgId}/activity-logs now admits members whose view_project_data comes from a project assignment, and limits them to their projects. Only an owner of that organization sees every entry; an owner of a different organization no longer does.

  • Names are compared with whitespace collapsed. Creating a project, creating a policy, or applying a policy treats names that differ only in spacing, including tabs, line breaks, and non-breaking spaces, as the same name.

Auth Service API and Tokens

  • Organization owners cannot hold project roles. Owners already have every project permission in their organization.

    RequestNew behavior
    POST or PUT /api/v1/organizations/{organizationId}/projects/{projectId}/members/{userId} for an organization owner409 Organization owners cannot hold project roles
    POST /api/v1/organizations/{organizationId}/members or PATCH .../members/{userId} combining organization_owner with a project role400
    Granting organization_owner through either member endpointRemoves the member’s project assignments in that organization

    Creating a project no longer makes its creator a project_owner. Existing owner project roles are removed during the upgrade (see Database Migrations).

  • Permission checks use current memberships. For signed-in users, the /api/v1/rbac/check/permission/... and /api/v1/rbac/permission/{permission}/projects routes read roles from the user’s current organization and project memberships instead of the roles in their token. A role that exists only in the identity provider token, and was never recorded as a membership, no longer grants access. API keys are unchanged.

  • Project permissions no longer apply to an organization with the same id. GET /api/v1/rbac/user/permissions adds organizationPermissions and projectPermissions maps alongside the existing permissions field. Requests that succeeded only because a project role was matched against the organization with the same numeric id are now denied.

  • GET /api/v1/rbac/user/permissions returns 500 when a lookup fails instead of 200 with the missing permissions omitted.

  • Permission metadata keys are lowercase. GET /api/v1/rbac/metadata/permissions returns name, description, and category instead of Name, Description, and Category.

  • The platform_access token claim is removed. Tokens no longer carry https://governance.eqtylab.io/platform_access. Service account tokens carry is_service_account and service_name instead.

  • Service accounts cannot be imported as members. POST /api/v1/external-users/import returns 400 for a service account.

  • Path identifiers resolve by membership. Auth Service routes accept the same identifiers as Governance Service (see Access and API Keys). A project UUID or slug: in an organization where the caller has no role returns 404 rather than 403, as does an unknown or another user’s did:key.

  • User signing keys cannot use the platform key name. Creating a user key whose normalized name matches the platform signing key returns 403.

Governance Service Writes

  • Writes check permissions live. Create, update, and delete requests to Governance Service bypass the Auth Service permission cache, so a revoked role blocks writes immediately rather than after AUTH_CACHE_TTL. A refusal from Integrity Service now returns 403 Insufficient permissions instead of 500.

Operations

  • Auth Service no longer falls back to another key provider. An unknown key management provider, or one that fails to initialize, stops Auth Service at startup instead of falling back to Azure Key Vault or to mock keys. The selected provider’s required settings are checked at startup. Confirm your key management configuration before upgrading.
  • Integrity Service writes structured logs to stdout. Logs are JSON lines on stdout when stdout is not a terminal, instead of text on stderr. RUST_LOG replaces the configured log levels when set. Update log collection that reads Integrity Service stderr or parses its text format.

Changes Since v1.2.0

These changes are grouped by area.

Governance Studio

  • Apply several indicators to a control, or one indicator to controls across several policies, in one step, with a confirmation screen that reports any pairs that could not be applied.
  • The gateway plugin configurations tab is rebuilt: a summary of the active configuration, hooks listed in execution order, a details panel for each plugin that can be linked to directly, idle and disabled entries, rollback candidates in the history table, and the reason an agent’s membership was denied.
  • User names across Studio link to the member’s page, including invitations, agent registration and authorization, credential issuers, and configuration history.
  • Activity logs filter by user rather than display name, so members who share a name can be told apart, and filtered views can be linked with ?user= and ?project=. Member activity logs show project names.
  • Agent badges are searchable by label and plugin, with a more compact badge and a wider badge dialog.
  • Breadcrumbs for an archived applied policy lead to the archived policies view, and evaluation logs for an archived policy show the archived banner.
  • Service accounts are no longer offered in the add member dialog.
  • Agent project associations can be created without an expiration date.
  • After you change your own roles, Studio refreshes your permissions and project list without a page reload.
  • Long policy names no longer break page layout, and policies whose names contain tabs, line breaks, or repeated spaces can be archived or deleted by typing the name.

Access and API Keys

  • GET /api/v1/api-keys/{keyId}/usage returns the requests recorded for an API key, newest first, with limit (default 50, maximum 200), offset, and since parameters. It is available to the key’s owner through a signed-in session.
  • Auth Service routes accept integer ids or UUIDs for organizations, integer ids, UUIDs, or slug: values for projects, UUIDs or did:key values for users, and key names or did:key values for keys.
  • Adds the revoke_agents and restore_agents permissions, granted to organization owners. API keys cannot carry these scopes.
  • Organization owners’ API keys that are scoped to permissions but not bound to a project reach every project in the organization.
  • GET /api/v1/organizations/{orgId}/members/{userId}/activity-logs lists a member’s activity, addressed by user UUID or did:key. A UUID also returns the history of a former member.

Signing

  • Version-bound signing. Clients can fetch the current signing key reference from GET /api/v1/protected/signing-key or GET /api/v1/protected/platform/signing-key and pass it as signingKeyReference when signing; the request returns 409 if the key has rotated in between.
  • Version-bound PDF signing. Set eqty-pdfgen.config.signingBound: true to have EQTY PDFGen fetch its certificate from Auth Service and bind each PDF signature to that key version. EQTY PDFGen now verifies every signature against its certificate before embedding it, and fails the render on a mismatch.
  • Setting eqty-pdfgen.config.timestampUrl to an empty value signs PDFs without an RFC 3161 timestamp, for environments without outbound access.

Gateway Stack

  • Project membership credentials without an expiration date are accepted, and LLM Gateway prefers a non-expiring credential when choosing the one that authorizes a request. Previously such credentials were treated as invalid.
  • Credentials issued with the EQTY identity, component, and state attestation contexts verify offline.
  • The gateway stack was not enabled in the staging validation for this release, so these changes are not covered by its validation evidence.

Integrity Service

  • Project membership credentials can be issued without an expiration date by omitting expiryDate.
  • Logs can be exported over OTLP by setting OTEL_EXPORTER_OTLP_ENDPOINT or OTEL_EXPORTER_OTLP_LOGS_ENDPOINT.

Fixes

  • Indicator evaluations create their declarations and evidence attachments again. In v1.2.0, the governance worker was denied permission to create declarations, so evaluations were recorded without declarations on the control timeline. Declarations missing from evaluations run on v1.2.0 are not backfilled; rerun the affected evaluations to produce them.
  • With a preconfigured Keycloak governance worker client secret, the governance worker is now linked to its identity and receives its DID key.
  • Microsoft Entra ID worker requests no longer create duplicate users.
  • Project agent pages in Governance Studio no longer fail for agents without badges.
  • Credentials issued by Integrity Service with sub-second timestamps verify in the gateway stack.
  • Plugin versions no longer display with a doubled v prefix.
  • A failed permission lookup is no longer cached as lost access.
  • Governance Service logs client errors and Integrity Service refusals as warnings rather than errors.

Security

  • Updates anyio in the EQTY PDFGen image to 4.14.2 for CVE-2026-63374.
  • Governance Studio opens only http and https citation links.
  • EQTY PDFGen restricts its signing digest to SHA-256.

Charts and Release Manifest

  • Bumps runtime and umbrella Helm charts to 1.2.1 and pins component source refs, image tags, and image digests in the release manifest.
  • Runtime charts accept image.digest to pin an image by digest, including the gateway stack images.
  • global.utilityImages.busybox sets the image used by the Auth Service, Governance Service, and Integrity Service dependency wait containers.
  • governance-service.localStorageCA adds a private CA for local object storage to Governance Service’s trusted certificates.
  • Integrity Service supports filesystem blob storage with integrity-service.config.integrityAppBlobStoreType: local_fs and integrityAppBlobStoreLocalPath, backed by integrity-service.persistence.integrity.existingClaim.
  • All new values are off by default. With unchanged values, v1.2.1 renders the same resources as v1.2.0.

Installation Tooling

  • Deployment guides, examples, and govctl are updated for Cloudsmith distribution. govctl init defaults to --artifact-source cloudsmith, which keeps the chart’s image tags and digests with IfNotPresent pulls. Pass --artifact-source github to install from GitHub Container Registry as before.

Customer Artifacts

  • Release manifest
  • Packaged Helm charts and chart digests
  • Connected installation package with its checksum
  • Optional air-gap package when enabled for the release
  • Generated OpenAPI reference
  • Generated Helm values reference

Before Installing

Confirm that the release manifest has validation.evidence.status set to approved, and use only the chart versions and runtime image tags recorded in that manifest. Do not mix v1.2.1 images or charts with earlier v1.2 artifacts.

Update any direct API integration, token consumer, or log pipeline for the breaking changes above before upgrading.

If you set global.imageRepositoryPrefixOverride and enable the gateway stack, the Control Plane registry wait container now pulls docker.io/library/postgres:17.6 rather than a prefixed copy. In an air-gapped environment, set gateway-stack.controlPlane.waitForRegistryViews.image.repository or global.imageRegistryOverride to your mirrored image.

Database Migrations

This release migrates the Auth Service, Governance Service, and Integrity Service databases.

  • Auth Service removes project roles held by organization owners. Project assignments held by an owner of the same organization are deleted, and project roles are removed from owners’ organization memberships. The down migration does not restore them. Record any owner project assignments you need before upgrading.
  • Governance Service indexes the activity log. The index is built without CONCURRENTLY and blocks writes to the activity log until it completes, which depends on the size of the table.
  • Auth Service adds two tables that this release does not use, and replaces an index on API key usage.
  • Integrity Service allows project membership credentials without an expiration date. Its down migration refuses to run once such a credential exists.

Plan the upgrade as follows:

  1. Back up all platform databases. Rolling back to v1.2.0 requires restoring this backup.
  2. Schedule a maintenance window sized to the Governance Service activity log table, during which platform writes are blocked.
  3. Confirm your key management configuration, because Auth Service no longer starts with a missing or invalid provider.
  4. Upgrade the governance-platform chart to 1.2.1 as described in Upgrade, using the chart versions and image tags recorded in the release manifest.

Release Readiness

This release is customer-facing. The deployment repository published the platform/v1.2.1 GitHub Release, and the release manifest records approved manual validation evidence. That validation covered a staging upgrade from v1.2.0 with Keycloak and external PostgreSQL. The gateway stack was not enabled in staging and is not covered by it.