Skip to main content

AxonFlow Release Notes

Release notes for AxonFlow platform, SDKs, plugins, and framework integrations. Every MINOR platform release has a dedicated page; PATCH releases get a page when they change user-visible behavior.

📄️AxonFlow v10.3.0 Release Notes

AxonFlow v10.3.0 adds one live capability and a great deal of dark infrastructure, and the difference is the whole point of these notes. Live: an AuthZEN-native authorization endpoint, POST /api/v1/access/evaluation, available in every edition at every tier with no flag. Dark: every enforcement plane now dual-evaluates the new policy decision point behind a default-off switch and records what it would have decided, the identity shadow window gains the metrics that give it a denominator, and trust realms, reservations, proof executions and decision-proof key custody all get durable stores that nothing yet writes to. Five additive migrations, and unlike v10.2.0 a Community deployment applies one of them.

📄️AxonFlow v10.2.0 Release Notes

AxonFlow v10.2.0 lands the ADR-065 policy decision and identity control plane as dark infrastructure: a separate deterministic policy decision point with its conformance corpus, trust realms and canonical principals, typed obligations, approval, proof and reservation contracts, and the shadow semantic-diff gate that measures the legacy-to-new migration. None of it consults a request unless you turn on the new identity compatibility mode, which defaults to off and can now be set per organization. One additive Enterprise migration, no removed capability, no new required configuration. One number you already see changes: a licence's days-remaining count is now whole days between UTC dates.

📄️AxonFlow v10.1.0 Release Notes

AxonFlow v10.1.0 ships the US compliance framework family: three new compliance-report regulators covering US insurance (the NAIC AI Systems Evaluation Tool), US banking supervision (federal and Farm Credit), and US securities examination (SEC advisers and FINRA broker-dealers), plus nine US policy template families with regulator-keyed retention presets and a new jsonl artifact format for broker-dealer recordkeeping pipelines. Everything is additive: five migrations, no removed capability, no new required configuration. One authorization change to plan for before upgrading: the three audit-chain verification routes now require compliance read authority, so an authenticated organization member whose role is not admin, owner or policy admin receives 403 where they previously received data.

📄️AxonFlow v10.0.0 Release Notes

AxonFlow v10.0.0 is a major release that closes eight enforcement gaps and stops four read surfaces from reporting things the platform never measured. Governance segments are now enforced on the gateway pre-check, the workflow step-gate, the MCP-server policy tools, the four MCP REST routes and the decision endpoint, and an unresolvable segment set denies fail-closed rather than passing. The orchestrator's second, in-memory dynamic-policy engine is deleted, taking a debug environment variable and one metric label value with it, and risk scores are computed by the platform again, so two long-inert seeded policies begin evaluating. The audit, usage and SEBI surfaces stop publishing fabricated zeroes and unearned completeness. A per-organization posture can make a per-user token mandatory, a presented-but-invalid token is refused rather than downgraded to a shared identity, and the portal's SAML service stops fabricating a per-restart SP signing keypair. Policy rows are selected by organization rather than by a caller-chosen tenant, and a policy row with no resolvable organization stops being selectable. Eight migrations run, two of them whole-table rewrites of the audit log and three more holding an exclusive lock that blocks reads, so size your database statement timeout before you upgrade rather than after.

📄️AxonFlow v9.19.0 Release Notes

AxonFlow v9.19.0 makes the operator console tell the truth: audit rows show policy names instead of raw ids, the compliance summary can no longer contradict the rows beneath it, date ranges follow the viewer's timezone, and approvals raised by the decision API finally appear in the approvals queue. Underneath, five independently maintained policy-condition matchers converge onto one shared evaluator, which changes what some stored policies match. No migrations, but read the behavior notes before upgrading.

📄️AxonFlow v9.18.0 Release Notes

AxonFlow v9.18.0 introduces the Fraud & Risk Add-on, an Enterprise add-on for agentic payments: a seeded FinCrime policy pack with a documented transaction context schema, plus an optional self-hosted ML risk scorer that can route high-risk decisions on the decision API into human review; on tool-call planes the score is recorded as an attributed detection. It also adds an agent task-count outage alarm and fixes the SAML signing-keypair permission in the marketplace CloudFormation template. No migrations.

📄️AxonFlow v9.17.0 Release Notes

AxonFlow v9.17.0 adds self-service portal password recovery by email, through Resend or your own SMTP relay, completes the segment-scoped policy rollout begun in v9.14.0 by bringing segment targeting to the orchestrator's dynamic policies and the remaining agent policy planes, and hardens the forgot-password endpoint: no reset token is ever returned over HTTP on a deployed stack, reset tokens are hashed at rest, and the rate limiter no longer keys on an attacker-controlled header.