v4.2.0

Changelog

Every change to how permission is evaluated.

Breaking changes never loosen a deny statement. If a release changes the evaluation order, it only makes it stricter.

v4.2.02026-10-28current

Provable hard-limit immutability

  • Published formal verification proof that hard limits survive any platform_admin override attempt.
  • Added Rego and Terraform HCL export targets to the Policy Builder.
  • Tightened dead-man switch grace period from 15s to 11s on critical-risk sessions.
v4.1.02026-08-12breaking

Removed reason field from POST /v4/revocations

  • The revocation endpoint previously ignored an optional `reason` string. It now rejects payloads containing one with 400 UnknownField, because nobody should be asked why.
  • Added traffic-light check-in signals (green / yellow / red) to the live session console.
v4.0.02026-05-03major

Per-call affirmation freshness

  • Replaced session-level consent caching with per-call evaluation of `iamsec:affirmation.max_age_minutes`.
  • Introduced `monitor.hold` requirement on `contact.restraint` scopes.
v3.8.02026-01-19feature

Vanilla role & zero-assumption onboarding

  • Added the `vanilla` role with zero kink scopes and full self-audit visibility.
  • Proposals can no longer be auto-accepted by silence; timeout resolves to deny.