Changelog

The AI System Inventory now supports a user-assigned inventory number on each system record. Numbers are scoped to the user who sets them, imported values are gated per account, and the field appears in CSV exports alongside existing columns. Teams that maintain asset registries or map AI systems to internal control frameworks can now keep those identifiers in one place.

Two sets of high-severity vulnerabilities were patched this week. CVE-2026-66066 in Active Storage has been remediated, and high-severity advisories GHSA-r28c-9q8g-f849 and GHSA-mh99-v99m-4gvg affecting postcss and brace-expansion have been resolved. No action is required from users.

The economy evaluation preset now routes scoring through three distinct judges instead of one, reducing systematic bias and producing more stable results across runs. Report generation is pinned to a consistent model, so audit summaries and pillar insights stay coherent with the rest of the report. Embeddings automatically refresh when the underlying model changes, keeping semantic search accurate after model updates. Gemini model calls have been moved off deprecated and preview endpoints, which reduces truncation events in generated output.

Traffic to and from the model gateway is now encrypted in transit with TLS enforced at the infrastructure level. Audit log data stored for analysis expires automatically after 180 days, keeping retention scoped to what leading compliance frameworks require. Organizational policies are now enforced across all platform environments, closing configuration drift between environments.

Developers who run the model gateway setup script now get VS Code configured in the same pass as the CLI. Traffic from the editor routes through the same governed gateway as terminal-based tools, with no separate configuration step. Re-running the script is safe: it detects an existing setup and lets you keep or replace it without losing your current configuration.

Swept Workbench now supports OpenAI Codex as a configured agent, so teams that use Codex for code-generation tasks can bring it under the same governance, spend controls, and audit trail as every other model in their environment. Configuration follows the standard agent onboarding workflow with no additional infrastructure required.

Company administrators can now add and remove users directly from the User Management page using just an email address, without a support request or IT ticket. The same page surfaces which access groups come from your identity provider alongside any manually assigned grants, giving admins a single view of how every user gets their permissions.

Administrators can now assign compliance grants to bundles directly from the admin panel without waiting on automated resolution. The underlying data model handles conflict resolution so grants stay consistent across the platform. A dedicated bundle authoring interface lets admins compose and publish grant assignments from a single place.

Administrators can now move a governance workflow into any state directly from the Governance panel and apply a backdated timestamp when doing so. This makes it straightforward to correct workflow state after the fact or record approvals that happened outside the system. The backdated date travels with the state change so audit records stay accurate.

Human judging sessions now support entry sampling and filtering, so reviewers work through a representative slice rather than every item in a run. Inter-rater reliability (IRR) scoring using Cohen's kappa shows how consistently reviewers agree, making calibration gaps visible before they affect results. Results and disagreements export to CSV for offline analysis, audit records, and integration with existing reporting workflows.