Fides 2.94.X release notes

• 2.94.0: September 14, 2026

Fides 2.94.0

Helios

Detect and classify global data risks with comprehensive visualization for data mapping and reporting for modern Enterprise.

• TCF-Compliant Asset Consent: Website monitor assets can be categorized as TCF compliant, either by the monitor when a page serves a TCF experience or by hand with a new "TCF compliant" toggle in the Action Center. Assets marked this way resolve to a new "Exempt (TCF)" consent status with its own label and colour, so assets covered by a TCF experience are no longer reported as violations. Includes a database migration.
• Google Consent Mode Awareness: Assets that load after an opt-out but whose Google Consent Mode signal shows storage was denied are classified as "Consent respected (GCM)" rather than flagged as violations. The status and the per-request signal evidence behind it appear in the Action Center consent breakdown, the asset report, and the monitor report PDF.
• CDN And First-Party Asset Provenance: Website monitor assets record how they were served. Assets delivered from a known CDN are ignored automatically by default and can be reviewed or restored from the Ignored view. The discovered assets table adds a "Served via" column, first-party and auto-ignored filters, and an auto-ignored banner with bulk restore, and the website monitor form gains an "Include CDN assets" toggle.
• Batch Classification On By Default: LLM datastore classification batches fields by table in a single request by default, and the "Batch classification" toggle is on for newly created monitors. Monitors that already stored a value keep it, and monitors saved before the toggle existed render as batched, which is how they were already being classified.
• Classification Model And Timeout Controls: Batched datastore, website, and identity provider classification move to a faster default model, while per-field datastore classification is unchanged. Classification calls now carry a per-attempt timeout that scales with chunk size and can be overridden per monitor with llm_call_timeout_seconds, and the batch token ceiling is lowered so oversized batches fail fast instead of stalling.
• Dataset Promotion Provenance Resolution: Promoted datasets are resolved through the provenance link recorded at promotion rather than by matching their key against a resource URN, and staged resources gain support for a collision-free URN encoding. Every existing monitor stays on its current encoding, so no stored URN changes. Includes a database migration.
• Bug Fixes:
  • The system configure page no longer shows the previously viewed system's form fields, custom field values, or Compass suggestion state after switching systems with the Cmd+K quick switcher.
  • Action Center no longer marks a system as newly detected once the System exists. Staged resources detected before the System was created are back-linked to it when it is added from the vendor dictionary, created through the add-system flow, or given a vendor.
  • Datamap filter dropdowns narrow to the values present under the other active filters.
  • Expand/Collapse all works for table cells that carry only a few tags.
  • The discovery monitor configuration modal has a Back button.
  • The cloud infrastructure "Add New System" modal no longer creates a system with an empty name and key when the dictionary service is switched off.
  • Vendors the GVL has deleted are no longer matched against discovered resources or offered in the vendor picker. Existing links still resolve, and identity provider resources attributed to a deleted vendor are cleaned up on the next scan.
  • The vendor typeahead no longer silently omits Compass vendors beyond the first 2000.
  • RDS MySQL and Postgres connection tests connect to each IAM-auth-enabled instance and run a query, so IAM misconfigurations surface at test time instead of at scan time.
  • RDS scans and DSRs no longer reuse a pooled connection opened under an expired IAM auth token.

Lethe

Enterprise grade privacy request management and processing with a single orchestration layer for DSRs across vendors and systems

• Pre-Approval Webhook Visibility And Retry: The privacy request detail page gains a Webhooks section showing each configured pre-approval webhook's dispatch status — pending, in-flight, succeeded, failed, or skipped — its eligible or not-eligible verdict once the reply arrives, and progress through the current retry backoff cycle. A webhook that never dispatched or never replied before the request was manually approved or denied reads as skipped. Unfinished webhooks can be retried in bulk or one at a time, from the UI or through a matching API. Includes a database migration.
• Branded Access Packages: The downloadable HTML access package renders the branding of the property the request came through — logo, colours, header, and footer. Operator-authored HTML is sanitized through a shared allowlist and logo URLs are restricted to https.
• Withheld Data Categories In Access Packages: Access request results withhold the values of data categories a business may not disclose to a subject — government IDs, health and medical identifiers, biometrics, financial accounts, payment details, and credentials. The field is still reported under its data category, with a redacted value in place of the identifier. The set of withheld categories is configurable through FIDES__EXECUTION__PROHIBITED_DATA_CATEGORIES, which accepts a comma-separated string or a JSON array and withholds nothing when empty. Erasure is unaffected.
• Streaming Result Uploads: DSR result uploads stream to storage by backend rather than by a per-configuration toggle. S3 always streams and GCS can stream once enable_streaming is set, so large packages no longer buffer the whole archive in memory.
• Dataset Graph Size Limit: A configurable execution.max_graph_nodes limit (default 5000, 0 disables the check) refuses to build dataset graphs over the limit, protecting DSR workers from memory exhaustion and queue flooding caused by very large graph configurations. Oversized graphs fail fast with a clear error on privacy request preview, traversal, and reachability checks.
• More Accurate Skipped-Erasure Reporting: The "Request completed with skipped erasures" warning, its notification email, and the CSV column now fire only for skips that may need remediation. Expected skips — condition-not-met manual tasks, disabled actions, out-of-organization collections, and non-applicable erasure emails — no longer raise a warning, and the reason a step was skipped is recorded and exposed on the execution log API. Includes a database migration.
• DSR Cache Cleanup: Redis state from completed DSRs is cleared as soon as a privacy request reaches a terminal state, with a finalization sweeper catching stragglers, instead of squatting in the cache for the full default TTL. At scale this removed several million accumulated keys a month. Governed by FIDES__EXECUTION__DSR_CACHE_CLEAR_ON_TERMINAL_STATE and FIDES__REDIS__DSR_CACHE_INDEX_TTL_ENABLED.
• One-Way Policy Webhook Failures Are No Longer Ignored: A non-2xx response from a one-way policy webhook is now acted on. Post-execution webhooks stay fire-and-forget, recording the failure as an error execution log while execution continues; pre-execution webhooks gate the run, so their failures error the privacy request.
• Multiselect Custom Request Fields: The Admin UI supports multiselect custom privacy request fields.
• Bug Fixes:
  • A privacy request is no longer persisted as complete when its completion notification failed, which left a permanent audit-trail inconsistency. Completion emails send before the terminal state is written, with retry-safe idempotency.
  • A failed access package upload halts the privacy request with an error before erasure runs, instead of erasing data the subject never received. When a policy has multiple access rules, a failed upload aborts the whole step before any results are saved, so a partial package is never delivered, and the request can be reprocessed from the upload checkpoint once storage is fixed.
  • Access packages no longer silently truncate streamed attachments over 2GB.
  • Streaming CSV uploads build their header from the union of every row's keys, so a row carrying a key the first row did not no longer fails the upload.
  • Manual-only privacy requests with no manual task integration, and privacy requests carrying custom fields while collection is disabled, are rejected at creation instead of succeeding silently.
  • Creating or editing a pre-approval webhook no longer deletes the other configured webhooks, and field values no longer leak between pre-approval webhook modal sessions.
  • BigQuery DSR queries that filter on or under a repeated (array) field fail fast naming the offending dataset field instead of returning an opaque BigQuery 400.
  • SQL erasure and access DSRs no longer fail when an integration database or proxy severs a pooled connection between tasks. Integration SQL engines pre-ping connections on checkout and can recycle them on a configurable interval, covering Postgres, MySQL, Redshift, and Google Cloud SQL.
  • Retrying DSR graph nodes hand their backoff to the message broker instead of sleeping in-process, so a retrying node no longer holds a worker slot.
  • The interrupted-task watchdog detects async tasks orphaned by a deleted or disabled connection even after their cache entries expire, requeueing the privacy request instead of leaving it stuck in processing.
  • The requeue retry counter is reset when a run completes, is restarted, or is resubmitted, so a stale counter can no longer cancel a later run prematurely on its first interruption.
  • Masking-secret lookups no longer build a new database engine, and a new connection pool, on every cache miss during erasure requests.
  • The scheduled job that expires paused privacy requests no longer leaks database sessions and connections.
  • The erasure graph builder no longer mutates the source collection while building, so graph construction is safe to run more than once and request task snapshots no longer carry a phantom root entry.
  • Erasure node failures are logged with the privacy request and task context before the exception propagates, matching the access and consent node runners.
  • The regex masking strategy returns an empty list for an empty input instead of raising.
  • DSR result upload no longer filters out a dataset graph that omits manual-task datasets.
  • Backend failures on privacy request creation are surfaced in the Request Manager.
  • The privacy request detail page polls only while a request is approved or in processing, rather than every two seconds for any non-terminal status.
  • The privacy request activity timeline no longer renders stray list bullets.
  • The access package redaction hint alert no longer wraps awkwardly beside the action buttons.
  • The Complete Task modal no longer grows unbounded when a discovered-context field contains a long list of values — each list-valued field scrolls inside its own fixed-height container, so the inputs and footer buttons stay reachable.
  • The denial reason in the privacy request denied email is centered with the rest of the message, and a typo in the same paragraph is corrected.
  • S3 storage credential errors name the auth method's actual missing field, and a streaming S3 configuration with no region is rejected on the secrets write and in the storage status endpoint.
  • Materialized graph previews no longer persist a stale row when a dataset edit races the request — the write is skipped and the next request recomputes from consistent state.

Janus

Consent management and enforcement across web, mobile, and server-side surfaces

• Delete And Restore Privacy Notices And Experiences: Privacy notices and privacy experiences can be deleted and later restored, gated by new privacy-notice:delete and privacy-experience:delete scopes. The Admin UI adds delete and restore actions with a "Show deleted" toggle on each table, and the admin list endpoints accept a show_deleted parameter. A deleted notice or experience is no longer served to end users, regardless of whether it is still enabled. Includes a database migration.
• Bug Fixes:
  • The Privacy Center's notice-driven consent item shows a child notice's configured translation title and description instead of the internal notice name.
  • The Privacy Center sends the identity verification code on the notices-served request. A request missing the code returns a clear 403 without consuming a verification attempt.
  • Wildcard cookie patterns such as AMP_-id- no longer match sibling cookies such as AMP_MKTG_*, in both FidesJS and the website monitor sweep.
  • Consent metrics settings changed through the config API take effect within five minutes instead of requiring a webserver restart, and a combination of settings that would be unusable is rejected at write time with a clear error.

Astralis

AI-assisted privacy assessments, access policies, and purpose-based access control

• Unified Policy Language (v2.1): Access policies accept documents written in the v2.1 unified policy language. The release adds the document grammar for framework, control, and policy documents with strict rejection of unknown keys, the action vocabulary, predicate pushdown through partition_when, and an expression parser covering leaf expressions and all/any/not condition sources with attribute references. Documents are validated through the grammar and stored with the parsed form alongside their YAML source. Includes a database migration.
• v2.1 Policy Evaluator: The evaluator resolves priority-ordered, first-terminal-wins decisions, accumulates obligations, records a per-policy trace, matches taxonomies hierarchically, and fails safe when consent is undeclared.
• One Switch Between Policy Formats: FIDESPLUS__PBAC__POLICY_V21_ENABLED selects which policy defaults are seeded and which engine enforces, and deletes nothing in either direction, so a deployment can move to the policy language and back. With the flag on, the MCP gateway evaluates v2.1 documents on every SQL tool call and denies with the policy's own authored message.
• Data Subject Matching In Policies: Policies can match on resource.data_subject. The data subjects declared on a dataset, collection, or field reach the evaluator as a resource label, with the most specific declaration winning, and a denial records the subjects the decision saw.
• Access Evaluation API For LLM Gateways: A new access-evaluation endpoint lets an external LLM gateway guardrail have agent tool calls evaluated against access policies before they run, behind the alphaAccessEvaluation feature flag and a new evaluation scope. A LiteLLM guardrail adapter ships alongside it, enforcing access-policy decisions on MCP tool calls and declaring each MCP server's SQL dialect, with a demo UI and setup scripts to run it end to end. Includes a database migration.
• Agent Tool Attribution: Access log entries and policy violations record the agent tool call behind a gateway-decided query, including the tool name and its provider, surfaced on the violation log, the detail responses, and the violation detail drawer.
• Call-Scoped Data Uses: The policy pipeline accepts optional call-scoped data uses that override dataset-declared purposes for policy matching. Every query is now routed through the access policy engine, and the separate consumer-purpose check is removed.
• Assessments v2 Fact Store (Alpha): The foundation for derived assessment answers, behind the alphaAssessmentsV2 flag. It adds a per-organization fact store with append-only fact versions, topic tags, and gate-decision and decomposition-run ledgers over a shared provenance mixin; a derivation vocabulary and identity layer that mints canonical fact keys against a code-owned topic spine; metadata resolvers and a known-gate with a fail-closed trust ceiling; datamap fact producers that glean facts from the system inventory and organization metadata; a mapping from the v1 template keys onto the topic vocabulary, with each fact's trust tier versioned so a re-derivation can neither strip a human confirmation nor silently displace one; and the per-tenant assessment instance schema for assessment plans, assessments, and topics. Includes database migrations.
• Framework Decompositions (Alpha): Framework decompositions have a defined draft shape and validation rules, and are stored as draft content so a drafted decomposition is validated up front and held for a human to ratify.
• Assessment Comments And Attachments (Alpha): Assessments support comments and a request-changes flow, with optional text anchoring so a comment can point at a specific passage. Assessment plans take comments and standalone attachments, and files can be attached directly to an assessment. Behind the alphaAssessmentsV2 flag. Includes a database migration.
• Astralis Chat (Alpha): A command palette and agent chat panel are docked on every route, with a measured hero position on Home, a conversation thread, and an ask row. Conversation state streams from the agent over server-sent events.
• Astralis Sign-In: The Astralis app gains a login page with a cookie-based session and route guard, OIDC/SSO sign-in, invite acceptance, a forgot-password page with token-based reset, and an email verification page.
• Bug Fixes:
  • The risk and mitigation, Slack autofill, and scheduled reassessment background tasks resolve the assessment model from configuration, honouring a configured override instead of ignoring it, and the scheduled path no longer crashes on a removed method.
  • The privacy assessments UI shows the assessment name.
  • Consumer identity resolution matches every identity-bearing scope field and no longer treats a role as an identity, fixing missing consumer attribution in access-control audit records. An ambiguous field is skipped rather than ending resolution.
  • The briefing status row paints its status dot, and its copy drops to the smallest supported text size.
  • Inline score tags in an annotated briefing size off their own text and sit on the prose line, and the mini sparkline beside a score no longer carries a doubled left margin.
  • Dark-mode primary buttons and field validation text meet contrast expectations.

Integrations

• Microsoft Purview eDiscovery: Available as a hybrid DSR connector.
• Integration State Visibility: The integration detail page header shows a "Disabled" tag and per-action tags when request types are switched off, and the integrations list shows each integration's enabled request types.
• Bug Fixes:
  • The Microsoft Purview integration is renamed Microsoft Purview Data Map. It and the other integrations with no DSR path — AWS, DataHub, S3, website, and mock datastore — no longer ask for request types or show a privacy requests tab, which is also hidden for Microsoft Entra ID, Okta, and Google Workspace.
  • Creating an integration with the same name as an existing one no longer overwrites the existing integration.
  • Integrations with no name display their connection key rather than "(No name)", and unrelated actions such as the enable/disable toggle or a request-type change no longer silently write the connection key into the integration name.
  • Sensitive connection secret fields stored as empty render as null rather than as a row of asterisks. Genuinely present credentials, including empty strings, are still masked.

Fides core

• Multi-Organization Scoping: The multi-organization work continues, still inert for deployments not running Advanced RBAC with the multi-org feature flag. This slice covers:
  • A single switch: resource scoping gates on the alphaMultiOrgManagement flag plus Advanced RBAC everywhere it is applied, matching the request-context, attribution, and Property gates, so all resource scoping activates together. Deployments running the fail-closed ENFORCE_ORG_SCOPING_FOR_ALL_USERS setting keep scoping regardless of the flag.
  • Request Manager: privacy requests show their organization and can be filtered by it.
  • Read and write enforcement: the generated privacy-request child routes (comments and attachments, including the manual-webhook access and erasure surfaces, manual-field submit and skip, and manual task completion), a per-request organization gate on routes that load a request through their own query, the System update route, the DSR execution graph and its connection list, manual tasks and manual webhooks during DSR execution, datasets read by a DSR node, the access-package loaders and the manual-task search queryset with re-authorized approve and redaction writes, the Jira ticket surface, Detection & Discovery monitor and staged-resource reads, the Detection & Discovery aggregate statistics, and path-addressed Detection & Discovery and identity-provider monitor mutations. Out-of-scope records read exactly as missing ones. Manual-task digests respect the recipient's organization scope, and match_organization is deploy-time only rather than API-settable.
  • Per-organization storage destinations: a storage configuration can be tagged to an organization, and that organization's default destination takes precedence over the global default. Access packages and subject-uploaded attachments upload to the requesting organization's destination, and the destination used is recorded on the privacy request so downloads resolve where the package actually landed.
  • Subtree deduplication: an optional deploy-time setting deduplicates privacy requests within an organization subtree rather than a single organization.
  • Includes database migrations.
• Trace Sampling And Temporal Metrics: Traces are head-sampled at 5% by default, parent-based so a trace stays whole across services, instead of exporting every span. Temporal workflow tracing is added, and the Temporal worker emits telemetry under its own role and flushes on shutdown. A Temporal metrics bridge scrapes the Temporal server's Prometheus endpoints and re-exports an allow-listed subset over OTLP; it is off by default and can run as its own container rather than a webserver thread.
• The not Operator In Conditions: The shared condition system gains a not logical operator, with schema validation, evaluation, SQL translation, and rendering, available to policy conditions, consent, digests, and custom-field display conditions.
• Role Visibility On The Users Page: Non-Owner users see user roles on the Users page, with a Restricted tag rendered where role reads are not permitted.
• Invite Expiry In The Invitation Email: The user invite email states when the invitation expires, based on the configured invite code lifetime.
• Removed: the unused classify CLI (fides classify, fides api, fides convert), the fides generate and fides scan command groups, the dataset and system generation endpoint, the classify-instance endpoint, and the Admin UI's "connect to a database" dataset creation flow. These features built raw database connection URLs, which cannot carry Snowflake key-pair credentials.
• Security:
  • snowflake-connector-python bumped to 4.7.3 and snowflake-sqlalchemy to 1.11.1 (CVE-2026-15925, CVE-2026-85525, CVE-2026-15736), with a defense-in-depth format check on the Snowflake account_identifier secret.
  • tornado bumped 6.5.7 → 6.5.8, fixing CVE-2026-82397 and two further advisories.
  • The OAuth code and state are stripped from the OIDC callback URL, so the single-use auth code no longer lingers in the address bar or browser history (CWE-598).
  • Token validation and generation are timezone-aware (UTC), preventing timezone-related validation failures.
• Bug Fixes:
  • Rate-limited endpoints — login, OAuth token, forgot and reset password, reinvite, resend verification, external login and invite, and policy generation — no longer return a 500 when a client-IP header is configured for rate limiting.
  • Enabling telemetry no longer stalls Temporal DSR workflows or logs deadlock warnings. Records that could not be serialized were being dropped silently and now reach the collector, a log call passing a sensitive value from a workflow thread is no longer exported unredacted, and a metrics callback error can no longer drop a whole export interval.
  • System-creation actions are hidden from the Viewer role.
  • Browser password managers no longer overwrite the email field in the Users form.

Database schema & data changes

• This release includes database migrations for the TCF-compliant asset consent fields, the assessments v2 fact store and its topic vocabulary, trust tiers and assessment comments, v2.1 policy document storage and the access-evaluation scope, per-organization storage destinations and the destination recorded on each privacy request, pre-approval webhook dispatch tracking, soft-delete columns and scopes for privacy notices and privacy experience configurations, skip-reason recording on execution logs, staged-resource URN encoding and dataset promotion provenance resolution, and internal event outbox storage and migration-history housekeeping.

Notes

• Large deployments must raise the dataset graph limit before upgrading. Deployments with more than 5000 enabled collections must raise FIDES__EXECUTION__MAX_GRAPH_NODES before upgrading, or those privacy requests will fail graph construction.
• One-way pre-execution webhooks now fail their privacy request. Tenants with a one-way pre-execution webhook pointed at an endpoint returning a non-2xx response will see privacy requests move to error where they previously completed. Post-execution webhooks stay fire-and-forget and only record an error execution log.
• Access packages withhold some data categories by default. Six categories of undisclosable data are redacted in access results. Set FIDES__EXECUTION__PROHIBITED_DATA_CATEGORIES to an empty value to withhold nothing, or to your own list to change the set. Erasure is unaffected.
• Several CLI commands and generation endpoints are removed. fides classify, fides api, fides convert, fides generate, fides scan, the dataset and system generation endpoint, the classify-instance endpoint, and the Admin UI's "connect to a database" dataset creation flow are gone. Automation depending on any of them must be updated.
• BigQuery array annotations are now trusted. The new repeated-field guard reads the dataset annotation, so a field annotated as an array but actually scalar will now error rather than silently querying.