Changelog

Every release,
as it ships

New capabilities, improvements, and fixes across identity, enforcement, approvals, and audit — newest first, receipts included.

v2.4.0NewImproved

Policy Enforcement Point — generally available

  • The Policy Enforcement Point is GA on every plan: real-time policy decisions on every agent action, with an 8.4ms median at the SDK boundary.
  • Compiled policy graphs replace interpreted rule evaluation — decision latency no longer scales with rule count.
  • Shadow mode lets you evaluate a draft policy version against live traffic and diff the verdicts before enforcing it.
  • All fallback paths now fail closed with structured denial reasons agents can handle programmatically.
v2.3.0New

Audit-chain verification API

  • New /v1/audit-chain endpoint exports receipt bundles with the public keys needed for fully offline verification.
  • The open-source verifier now checks external transparency-log anchors alongside hashes, signatures, and sequence continuity.
  • Receipt exports stream as line-delimited JSON, so multi-million-receipt periods no longer require pagination gymnastics.
v2.2.1ImprovedFixed

Registry hardening

  • Passport revocation now propagates to every enforcement node in under two seconds, down from eight.
  • Registry lookups are rate-limited per caller with scoped keys, closing an enumeration vector reported through our disclosure program.
  • Fixed a race where a passport revoked mid-rotation could briefly present both key generations as valid.
v2.2.0NewImproved

Approvals in Slack

  • Held actions now resolve directly in Slack — full context, one-tap approve or reject, and the decision lands in the audit chain as a signed receipt.
  • Approval requests include the agent's recent history and the exact policy rule that triggered the hold.
  • Expired holds now record the timeout in the receipt, so deny-by-default is provable, not just configured.
v2.1.0NewImproved

Budget runway alerts

  • Budgets now project their exhaustion point from current burn rate and alert at configurable thresholds — hear about drift days before a hard stop.
  • Budget hierarchies: per-action, per-agent, and per-team caps evaluate together on every spend decision.
  • Alert destinations extend to Slack and webhooks alongside email.
v2.0.2NewFixed

Agent health scores

  • Every passport now carries a health score derived from denial rates, budget pressure, and approval outcomes — spot drifting agents before they page you.
  • Health history charts on the agent detail page cover the trailing 30 days.
  • Fixed reputation scores double-counting held actions that were later approved.
v2.0.1NewImproved

Passport share sheets

  • Passports now generate a public share sheet — identity, key fingerprint, scopes, and verified history — for vendors and reviewers, no login required.
  • Share sheets can be scoped to hide budgets and internal policy names while keeping identity verifiable.
v2.0.0New

govern.sh launch

  • Agent Passports: per-agent Ed25519 identity, minted in one API call and revocable in one click.
  • Policies: scoped permissions and spending budgets, evaluated on every action.
  • Approvals: policy-triggered human sign-off for high-stakes actions.
  • Signed Audit Trail: hash-chained receipts for every decision, verifiable independently of govern.sh.

Run the newest release today.

Everything above is live on every plan — including the free tier's three agents and full policy engine.

Mint your first passportTalk to us