Skip to main content

AxonFlow v8.3.0 Release Notes

Released 2026-05-27. Indonesia regulatory compliance coverage (PII detection, OJK module, UU PDP breach notification) and production-ready OTel observability exporter configurations for Datadog and Grafana. SDKs updated to v8.3.0 (Rust v0.5.0). No breaking changes.

Headline: Indonesia compliance — PII detection + OJK + UU PDP​

AxonFlow now ships built-in support for Indonesian financial regulation and data protection. The pii-indonesia category detects eight national identifier patterns. The OJK enterprise module adds six compliance API endpoints. UU PDP breach notification enforces Article 46 required fields and 72-hour SLA deadlines.

PII detection (Community)​

Eight context-anchored patterns in the pii-indonesia category:

PatternDescription
NIK (Nomor Induk Kependudukan)National ID — 16 digits, province-code validated against 34 provinces
NPWP legacyTax ID — 15-digit format
NPWP newTax ID — 16-digit format, context-anchored
+62 phoneIndonesian mobile numbers
BCA accountBank Central Asia account numbers
Mandiri accountBank Mandiri account numbers
BRI accountBank Rakyat Indonesia account numbers
BNI accountBank Negara Indonesia account numbers

All bank account and NPWP patterns are context-anchored to minimize false positives against credit card numbers, UUIDs, and timestamps.

# Test Indonesia PII detection
curl -X POST http://localhost:8080/api/policy/pre-check \
  -H "Content-Type: application/json" \
  -d '{
    "query": "Customer NIK is 3201234567890001",
    "mode": "gateway",
    "client_id": "test"
  }'

OJK compliance module (Enterprise)​

Six API endpoints under /api/v1/ojk/:

EndpointMethodDescription
/api/v1/ojk/audit/exportPOSTExport audit data in JSON, CSV, or XML format
/api/v1/ojk/audit/export/{id}GETCheck export job status
/api/v1/ojk/audit/retentionGETQuery retention status by data type
/api/v1/ojk/audit/readinessGETValidate compliance readiness checklist
/api/v1/ojk/breach/notifyPOSTSubmit UU PDP breach notification
/api/v1/ojk/dashboardGETCompliance dashboard summary

Set AXONFLOW_COMPLIANCE_REGION=ID to enforce a 1825-day (5-year) minimum retention floor per OJK AI governance requirements.

UU PDP breach notification (Enterprise)​

Article 46 compliant breach notification with required fields, 72-hour SLA calculation, and MOCDA (Ministry of Communication and Digital Affairs) as default notification authority. Integrates with the OJK audit export pipeline for end-to-end compliance traceability.

Cross-border transfer audit fields (Enterprise)​

New columns on audit tables for logging cross-border data transfer metadata required by Indonesian financial regulators — origin jurisdiction, destination jurisdiction, transfer basis, and data classification.

OTel Observability Exporters​

Pre-built OTel Collector configurations for routing decision spans (emitted by the v8.2.0 decision tracer) to production monitoring backends.

Datadog APM​

export DD_API_KEY=<your-key>
export DD_SITE=datadoghq.com
docker compose -f docker-compose.yml -f docker-compose.otel-datadog.yml up -d

All decision.*, org.id, and tenant.id span attributes are exported as Datadog APM tags, searchable in the trace explorer and usable in monitors.

Grafana + Tempo + Prometheus​

docker compose -f docker-compose.yml -f docker-compose.otel-grafana.yml up -d
open http://localhost:3000   # Grafana (admin/admin)

Brings up five services: OTel Collector, Tempo (trace storage), Prometheus (metrics), Grafana (dashboards), and the AxonFlow agent. The OTel Collector's spanmetrics connector generates calls_total and duration_milliseconds Prometheus metrics from decision spans, labeled by verdict, stage, org, and tenant.

Decision Mode Grafana Dashboard​

A 9-panel dashboard ships at grafana/dashboards/decision-mode-overview.json: decision rate, verdict distribution donut, error rate, latency P50/P95/P99, decisions by stage, policy trigger rate, per-tenant volume, deny rate table, and latency heatmap. Template variables $org_id and $tenant_id filter all panels.

LangSmith Trace Correlation​

The W3C trace_id returned in every decision response can be passed as LangSmith run metadata for side-by-side correlation of LLM execution traces and governance decisions. No code changes on the AxonFlow side — see Observability Exporters for Python and TypeScript examples.

Industry migrations​

Four new migrations under industry/banking/:

MigrationDescription
500OJK compliance tables
501OJK policy templates
502Audit cross-border fields
503Breach notification tables

SDK updates​

SDKVersionWhat's new
Pythonv8.3.0pii-indonesia category constant, data_residency + transfer_basis audit fields
TypeScriptv8.3.0Same
Gov8.3.0Same, plus OJKAssessment typed response for Enterprise callers
Javav8.3.0Same
Rust (preview)v0.5.0pii-indonesia category, cross-border audit fields

Minimum SDK floor remains v8.0.0. Existing v8.2.0 callers keep working unchanged.

Examples​

Three new curl-based examples for Indonesia compliance:

  • examples/indonesia-compliance/http/decision-mode-indonesia-pii.sh — PII detection via Decision Mode
  • examples/indonesia-compliance/http/ojk-audit-export.sh — OJK audit data export
  • examples/indonesia-compliance/http/ojk-breach-notification.sh — UU PDP breach notification

Fixed​

  • PII detection ordering for Indonesia patterns. Detection categories are now evaluated in deterministic registration order. Previously, category evaluation order was map-iteration-dependent, which could cause inconsistent results when multiple categories matched.

  • Migration 501 schema. OJK policy template migration updated to use the current policy_templates schema (with display_name, subcategory, template, variables, tags columns) instead of the legacy schema.

  • Shared policy type export. PolicyCheckResult.Reason field correctly exports as string for use across packages.

What's NOT changed​

  • No breaking changes. All existing SDKs, plugins, and API consumers continue to work unchanged.
  • SDK versions: Recommended Python / TypeScript / Go / Java at v8.3.0; Rust preview at v0.5.0. Minimum: v8.0.0. Previous SDK versions keep working.
  • Plugin versions: Recommended claude / cursor / codex at v1.5.2; openclaw at v2.6.1. Unchanged from v8.2.0.

Upgrade notes​

Self-hosted Community (Docker / docker compose up)​

Pull the v8.3.0 image. Four industry migrations (500–503) apply automatically on startup if AXONFLOW_COMPLIANCE_REGION=ID is set. PII detection for Indonesian identifiers is available immediately — no configuration required beyond the standard PII_ACTION setting.

In-VPC Enterprise​

No preflight required for v8.2.x to v8.3.0. Existing licenses, credentials, and DSN secrets keep working. To enable the OJK module, set AXONFLOW_COMPLIANCE_REGION=ID.

Community-SaaS users​

No action required. Indonesia PII detection is available at all tiers.

SDK users​

Existing v8.2.0 SDK callers keep working. Upgrade to v8.3.0 to access the pii-indonesia category constant and cross-border audit fields.

Migration resources​

Last updated on