Astralis 3.0.0 release notes

• 3.0.0: October 13, 2026

Data Mapping

Detect and classify global data risks with comprehensive visualization for data mapping and reporting for modern Enterprise.

• Path Rules For Datastore Monitors: Datastore discovery monitors can include or exclude resources from detection with regex rules over the resource path, managed through new endpoints to list, create, update, and delete them. A collapse rule keeps one representative table from a partitioned or sharded family and skips the rest, so a monitor no longer stages hundreds of near-identical tables. Includes a database migration.
• Every LLM Datastore Monitor Classifies In Batches: The classify_params.batch_mode monitor setting and its Batch classification toggle are removed, and every LLM datastore monitor now classifies a table at a time. Monitors that had batching turned off move to the batch model (gemma-4-31b, previously gemini-2.5-flash), and their custom LLM instructions are now added to the standard prompt instead of replacing it. A monitor with a pinned model override keeps its model. The batch completion budget is also floored by chunk size, so a monitor carrying a stale, small max_tokens no longer truncates the completion and fails the whole table. See the note below.
• Catalog Context For Classification: Microsoft Purview glossary terms and source classifications are extracted during discovery, stored on the discovered resource, and given to the classifier as context for the fields they describe. Descriptions and glossary terms from linked catalog records are folded in at both field and table level, and each label records which sources fed it. Includes a database migration.
• Cross-Source Catalog Matching (In Development): Catalog object matching runs automatically when a monitor finishes detection, linking its resources to the monitors it is explicitly linked to. Each canonical group carries a single review status, and reviewing, muting, promoting, or resetting a linked resource applies to every source record it is linked to. New GET /canonical-results and /canonical-results/summary endpoints return one row per real-world data element, however many monitors staged it. The UI is still gated behind the alphaCatalogNormalization feature flag.
• Website Monitor Consent Status Generally Available: The assetConsentStatusLabels feature flag is removed, so website monitor consent status is on for everyone, and findings are worded as potential compliance issues. The ignored and first-party filters are renamed to All ignored, Manually ignored, and Auto-ignored, and Any domain, Same domain, and External domain, with a tooltip explaining domain origin.
• No More Uncategorized Page Assets From Website Scans: Website monitor scans no longer add each scanned page as an uncategorized "Browser request" asset. Existing rows of this kind are cleared only by reprocessing a scan with reset_results.
• Clearer Monitor Creation: Saving a new monitor that will start scanning immediately asks for confirmation first, and its save button reads "Save and start scan".
• Monitor Tasks Always Run On Celery: Detection for datastore, website, and identity provider monitors always runs as a Celery task, and the in-process background fallback is removed. See the note below.
• Bug Fixes:
  • Dropped tables and schemas leave datastore monitor results promptly instead of slowly.
  • Promoting a Salesforce resource from detection and discovery updates the integration's own dataset instead of creating a duplicate.
  • The system asset Add/Edit modal no longer pre-fills with values from the previously opened asset.
  • Sticky Action Center asset table headers stay aligned with narrow cell content, and AWS service icons show in the Action Center again.
  • The Data lineage page requests the caller's active organization instead of a hardcoded default, so organization-scoped users see their own data map and switching organizations refetches it.

DSR Orchestration

Enterprise grade privacy request management and processing with a single orchestration layer for DSRs across vendors and systems

• Data Subject Document Uploads (Alpha): Behind the alphaDocumentUpload feature flag, privacy requests can collect documents from data subjects:
  • Requesting documents: a Documents button on each request type in the property editor sets whether the request asks for documents, when the upload link is sent, and what the upload page accepts. The data subject is emailed a secure upload link to a Privacy Center page where they send their files, and a Request another document action sends a new link.
  • Forms: Privacy Center file upload fields can offer a downloadable form, set in the form builder. The admin create-request form accepts file uploads on a data subject's behalf and holds the request until its files are uploaded. Uploads keep their original file name, form field, and source.
  • Reviewing documents: a Documents tab on the privacy request detail page lists every file with who provided it, how it arrived, when, and its size. Reviewers can mark documents verified, and the approval modal warns when they have not been. A switch on each document includes it in the access package or leaves it out.
  • Audit trail: downloads use short-lived links, with a Download all zip and per-document download counts. Every verification, inclusion change, and download is audited, and document events appear as one Documents entry in the Activity timeline, with a drawer listing each event's file and actor and a CSV export.
  • Includes database migrations.
• Configurable Attachment Retention: Set FIDESPLUS__ATTACHMENT_RETENTION__DAYS to delete privacy request attachments a set number of days after the request is completed, denied, canceled, or deleted. A daily sweep at midnight UTC removes expired files and their records, up to 1,000 candidates per run, and keeps files still referenced by another request. Retention is off by default and deletion is irreversible.
• Automated Request Rules: When risk scoring is enabled, a new Automated request rules section under DSR configuration defines rules that act on scored requests at approval. Rules are checked in order and the first live match acts. A rule can deny a request with a stated reason, or remove it from the queue when its condition requires an unverified identity, and a rule set to report only records what it would have done without acting. The request detail page and activity timeline name the rule that acted, the Flagged tab gains a report-only filter, and rules can also be managed through a new API. Includes database migrations.
• "No Data Found" Completion Message: An optional "Request completed, no data found" messaging template tells a data subject that an access or erasure request found no personal data. It is seeded disabled, and when enabled for a property it replaces the standard completion email only when the request is certain to have found nothing. Any uncertain case still gets the standard message.
• Manual Task Context Controls: Manual task context is more tightly governed:
  • A new task_context:manage scope, granted to Owners, is required to change the dataset fields and context sources that manual task assignees see. This covers the manual task config API, SaaS config updates, custom connector templates, and the dataset APIs. See the note below. Includes a database migration.
  • Context sources are limited to datasets on the task's own connection, and manual tasks, including ones already configured, only receive context from fields still marked as task context on their own integration.
  • A context source can be marked as a witness, so a task set to skip when its context is empty is still created when the witness's collection produced no value.
  • The configuration UI clarifies that Access manual tasks also run for Portability requests.
• California DROP Failure Alerts: Privacy request notification recipients are emailed when a DROP cycle, upload, SLA check, or backfill fails.
• Regulation Coverage For More US States: Regulation tags and 45-day extension budgets are added for Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island. Existing regulation selections are not changed.
• More Reliable Request Execution:
  • DSR cache lookups no longer fall back to a Redis keyspace scan, which stalled privacy requests on deployments with large caches. The redis.dsr_cache_strict_index setting is removed.
  • Temporal DSR activities no longer block the worker's event loop, which had stalled workflow tasks and caused detached-session errors under load, and in-flight DSR activities finish on worker shutdown instead of being cancelled.
  • The Temporal engine passes upstream access data to erasure nodes the same way the Celery engine does.
• Bug Fixes:
  • Bulk retry of errored requests now matches single retry. When cached identity data has expired, requests are resubmitted from scratch instead of restarted from a checkpoint.
  • Async callback access requests resolve connector_param placeholders, such as a custom path or host, in a read request's param_values.
  • Form Builder visibility rules save and apply in the Privacy Center, and saving a form no longer deletes identity inputs the builder cannot render.
  • Saved redaction patterns show on the DSR settings page.
  • Moving a manual field to another request type no longer leaves it in both configurations, and the Add/Edit condition modal no longer opens with a previous condition's values.
  • SaaS integrations in the privacy request activity timeline show their vendor logo instead of a generic icon. Includes a database migration.
  • The Request workflows canvas renders on the Astralis DSR Workflows page, and the upload modals no longer error when a drop contains no files.

Consent Management

Consent management and enforcement across web, mobile, and server-side surfaces

• Archive Replaces Soft Delete For Notices And Experiences: Privacy notices and experiences are archived and unarchived rather than "deleted", since the record and its history are always kept. New POST .../archive and .../unarchive routes, privacy-notice:archive and privacy-experience:archive scopes, a show_archived filter, and an archived_at response field replace the soft delete equivalents. The Admin UI uses the new wording, brings unarchive back, and replaces the per-table switch with a shared "show archived records" toggle. The previous routes, scopes, deleted_at field, and show_deleted filter keep working for one release. Includes a database migration.
• Required Experience Translation Labels: Save and acknowledge labels are required for banner and modal experiences, save labels for TCF overlays, and title, description, and save labels for Privacy Center translations. Blank legacy values are backfilled from the localized defaults. Includes a database migration.
• Consent Configuration Change Attribution: Privacy notice and experience configuration history records store the user or API client that made each change. The data is recorded only for now and is not yet returned by any API. System history now shows the root client ID instead of a blank editor when no root username is configured. Includes a database migration.
• Faster Removal Of Deleted GVL Vendors: Global Vendor List vendors with a deleted date leave the TCF experience within an hour of the Compass cache reload, instead of waiting for the daily Compass system sync.
• Janus Mobile SDK: The iOS SDK's minimum deployment target is now iOS 15.0. API errors carry their HTTP status instead of reading as "error N".
• Security:
  • The public PATCH /privacy-preferences endpoint rejects opt-in preferences when the request carries an unverified email or phone number, and rejects any other identifier in that identity, so a caller can no longer opt someone else in. Unverified identities can still be used to opt out.
  • FidesJS sanitizes HTML descriptions when it renders them, so only allowlisted formatting tags and safe links reach the page, and the consent form GPC prompt description is sanitized on save.
• Bug Fixes:
  • On iOS, Accept All no longer opts in notices that are not ATT-exempt when App Tracking Transparency is denied.
  • The iOS and Android SDKs save notice-only notices as acknowledged instead of opted in, and setConsent seeds the TCF fides string into the consent WebView.
  • The ATT exemption switch displays correctly for notice-only privacy notices.
  • Expanded locations and properties in the experiences list wrap instead of stacking.
  • Custom stylesheet selections clear after an upload or cancel.

Assessments

AI-assisted privacy assessments

• Assessment Plans (Alpha): Behind the alphaAssessmentsV2 flag, assessment plans can be generated in the background, listed, viewed, and published through new API endpoints, with an option to publish a draft as soon as it is generated. Each plan item shows the regulation requirements behind it, a plan only includes topics its framework's ratified requirements cover, and publishing records who published it and fixes each topic's regulatory citations as of that moment. Includes database migrations.
• Assessment Findings And Risks (Alpha): Assessments v2 generates a finding for every requirement checked and a risk for each one that is not met, naming the unmet requirements behind it. Generation runs one step per requirement and publishes the result in a single step, so an assessment keeps serving its last completed output while the next run builds. A race that could lose an assessment's published output when a new run started before the previous one finished is fixed. Includes a database migration.
• Ratified Framework Content (Alpha): Managed frameworks ship with ratified content for GDPR (DPIA, LIA, TIA, and Article 28 processor due diligence), UK GDPR (DPIA, TRA, and LIA), Swiss FADP DPIA, EU AI Act (FRIA and Article 6(3)), PIPL (PIPIA and export PIPIA), Quebec (section 17 PIA and system-project PIA), CCPA risk assessment, and the Colorado, Connecticut, Texas, and Virginia data protection assessments, including Colorado and Connecticut profiling. Every framework source carries an authority label of binding, guidance, or draft. Managed frameworks are seeded only when the alphaAssessmentsV2 flag is on. Includes a database migration.
• Assessments Run In The Deployed Temporal Worker: The deployed Temporal worker now runs assessments v2 work beside DSR work, so assessments are picked up in deployed environments without a separate worker. All assessment work runs on one task queue, in-flight work finishes when the worker stops, and a run whose input cannot be read fails instead of retrying forever.

PBAC

Access policies and purpose-based access control

• Visual Builder For The v2.1 Policy Language: Rules in the v2.1 policy language can be created in the visual builder, with inline validation and control creation. The builder canvas edits v2.1 documents natively, including all, any, and not condition groups, structured expression editors, and a then block with a terminal decision and obligations.
• Legacy v2 Policies Become Read-Only: Once the v2.1 policy language is enabled, existing v2 access policies are shown as read-only "Legacy" rules and the v2 builder is no longer offered. See the note below.
• Enforcement And Policies Navigation: "Access control" is renamed "Enforcement" and "Access policies" is renamed "Policies", and both move to the top of the Data governance navigation. Items on the Policies page are now called rules, and the page descriptions explain how policies, controls, and rules relate.
• Decision Records: Every PBAC decision is recorded with its outcome, the call, its reason, the inferred data uses and their confidence, the labels of the tables it touched, the columns each table's categories were narrowed to, coverage gaps, dataset purposes, and the policies that denied it along with the label facts they matched. Records also carry the statement type and warehouse job ID. New GET /api/v1/access-control/decision-records and /decision-records/{decision_id} endpoints list decisions in a date range with cursor pagination and return a single record, violation logs link to their decision record, and a decision drawer in the Enforcement log walks through each decision's intent, inferred purpose, data accessed, policies, and outcome.
• Purpose Inference (Behind A Flag): Behind the purposeInference flag, which is off by default, PBAC can infer the data use of a call and decide on it:
  • Access policies can match a call's inferred data use as request.data_use, and the MCP gateway infers it for SQL calls whenever a loaded policy reads it. A call that gets no data use is decided on its datasets' declared purposes, and the record says why.
  • Query-log sources can opt in with infer_data_use, so polled queries are evaluated under their inferred data use.
  • A new data use guidance API lists, sets, clears, and imports the guidance that tells the model when a data use applies, under new data_use_guidance:read and data_use_guidance:update scopes. Every change is audited and shown in the data use taxonomy's History tab.
  • Inference has its own LLM configuration for timeout and retries, and is bounded by a deadline below the gateway's own timeout. Running out of time is recorded as an inference_timed_out gap.
  • Includes database migrations.
• SQL Statements In The Evaluate API: POST /api/v1/access-control/evaluate accepts a SQL statement directly as well as a tool call. See the breaking change note below.
• Policies Alone Decide Coverage: An unregistered caller, a dataset without declared purposes, or an unregistered table is no longer reported as a coverage gap. The call is allowed or denied by the loaded policies instead. See the note below.
• Shared Redis Fixture Store: PBAC fixtures (datasets, consumers, purposes, and policies) can be served from a shared Redis store by setting pbac.fixture_store to redis, so each decision reads only the fixtures for the tables a query names instead of a full per-process copy. One replica populates the store at startup and rewrites it each refresh interval, and datasets and purposes reach it as they change, including writes from Celery workers. A decision that cannot reach the store is recorded as an audited gap instead of an error. The default remains the per-process snapshot.
• MCP Gateway Agent Policy: An opt-in agent policy allows only read-only BigQuery SQL, applies stricter credential route restrictions, and gives richer API discovery with a per-instance tool cache. Remote tools need an explicit read-only override for their mutation metadata. Both gateway surfaces discover tools without blocking and keep healthy providers when another fails, and /mcp keeps its existing route access and SQL behavior.
• Bug Fixes:
  • Access policies scoped to a dimension that cannot be enforced no longer match every request.
  • MCP gateway tool calls are checked off the main thread, so a slow upstream or Redis lookup no longer stalls every other call on the same worker.
  • The fixture refresh endpoint's policy count includes policy language documents.

Integrations

• External Secrets Managers For Integration Credentials: Integrations can now read their credentials from an external secrets manager instead of storing them in Astralis.
  • Linking: connections are linked to a secrets manager through the existing connection endpoints. Linking wipes the stored secrets, every link change is audited, and the manager must belong to the connection's organization or the universal tier. A Jira ticket connection linked to a managed Jira integration reads the same secret instead of keeping a copy.
  • Providers: HashiCorp Vault is available alongside AWS Secrets Manager. It reads KV v1 and v2 secrets over AppRole auth, supports a non-default AppRole mount path, always verifies TLS, and only connects to an address checked at connect time. AWS managers return the trust policy to apply to your role, and an owner can rotate a manager's external ID and see how many connections depend on it.
  • Checking before you link: a secrets template endpoint shows the keys a connection type's secret must contain, a reference check reports which of those keys a secret holds without returning any value, and a manager can be limited to a reference prefix.
  • Testing: the reachability test is now POST /plus/secrets-manager/{key}/test. Testing a managed connection reports manager reachability, secret resolution, and the downstream connection as separate steps, and retries once with fresh credentials so a recent rotation does not read as a failure. Manager details are returned only to callers with the write scope.
  • Where credentials resolve: the web server and every worker resolve managed credentials, so privacy request execution, SaaS dataset graphs including external references, query-log connectors, PBAC identity providers, the DataHub sync, consent webhooks, and the consentable items routes all work with managed connections. Fetched credentials are never written back to the database, never appear in logs or API errors, and are percent-encoded in Postgres, MySQL, MariaDB, and Redshift URLs so a password with special characters authenticates. Refreshed OAuth tokens store only the keys Astralis generated. An HTTPS connection whose credentials are managed no longer keeps an OAuth client configuration.
  • Resilience: a brief secrets manager outage marks dataset validation unverified instead of failing it, retries consent webhooks and DataHub syncs, and answers the consent webhook HMAC check with a 503 so the sender retries.
• MySQL And MariaDB Through RDS Proxy: MySQL and MariaDB connections work through Amazon RDS Proxy, with PyMySQL updated to 1.2.0.
• Microsoft Purview eDiscovery Skips Empty Reviews: The Purview eDiscovery integration skips its reviewer task for subjects whose estimate ran and found no items, and keeps the task when the estimate did not complete.
• Bug Fixes:
  • Two workers refreshing the same connection's tokens at once no longer overwrite each other, so a rotated OAuth refresh token is not lost.
  • One connection's failed consent webhook token refresh no longer fails the refresh of every connection after it.
  • Writing a connection's secrets locks the row before checking for a secrets manager link, so a link that lands mid-request cannot be followed by a plaintext write.
  • Integration multiselect secret fields start empty and never save blank entries, and closing an untouched integration form no longer prompts about unsaved changes.
  • Connector logos show in the Astralis app.

Core

• Astralis 3.0: The Astralis app now covers most day-to-day work. The Admin UI home page shows a dismissible banner inviting users to try Astralis 3.0, configured through a new admin banner settings API and off by default, and the Admin UI logo and About page carry the Astralis name. New in the app:
  • Inventory: the System inventory list, add and configure system pages, test datasets, the Data catalog with the dataset visual editor, Asset inventory, the Data map report, Data lineage, and the Action Center in the Inventory overview.
  • Integrations: the Integrations list, the Add integration flow, the integration detail page, and the dataset editor and test pages.
  • Consent: the privacy experiences list, the experience type picker, the TCF version history page, and the experience editor with settings, languages, a Preview mode and live mini preview that apply your custom CSS, a Status card, Delete, and a pinned Save that explains what is missing.
  • Settings: the System Configuration page shows the version and documentation links and links back to the classic app, the Feature preview page lists internal alpha flags, and the Privacy Center form builder warns before leaving with unsaved changes.
  • App shell: an active organization switcher in the dock that is remembered across reloads, theme options including Follow system, a favicon and per-page tab titles, the chat dock as a corner button outside Home, shared error and not-found pages, reworked overview pages and page layouts, and a steadier context panel.
• Astralis Home: Home shows a dimensions digest with chart cards and a sticky score card, live consent, violations, DSR timeline, and system coverage charts with hover tooltips and an evidence panel, and a Data Governance dimension built from PBAC dataset readiness and compliance. The briefing is shown from storage at once and marked stale past its cache window. Home then asks for a fresh one, retries a refresh still in progress, offers a manual retry after a failure, and offers a newer briefing on the status line rather than swapping it out. A new refresh endpoint reports a generation in progress as analyzing and returns retry_after_seconds after a failure. The time-of-day greeting is back above the briefing.
• Astralis Assistant (Disabled By Default): A chat assistant in the Astralis app answers questions about your deployment and makes changes on your behalf. It reads through the MCP gateway under the signed-in user's own permissions, holds every write for an explicit confirmation on an approval card, and keeps a one-hour conversation history that can be restored or reset. It defaults to Claude Sonnet 5.5. It needs FIDESPLUS__ASTRALIS_AGENT__ENABLED, FIDESPLUS__MCP_GATEWAY__ENABLED, and the new astralis_agent:chat scope. Includes a database migration.
• Multi-Organization Scoping: The multi-organization work continues, still inert for deployments not running Advanced RBAC with the alphaMultiOrgManagement feature flag. This slice covers:
  • User and role management: the user list shows each user's organizations and filters by organization. The new-user form takes an optional initial organization and role, and creating a user commits the user, permissions, and grant together. The invite form asks for the organization first and offers only roles the inviter may grant there, from a new GET /plus/rbac/roles/grantable endpoint. Org-bound role grants can be added, edited, and revoked from the Roles tab, with a preview of the organizations a grant reaches. Organization-scoped admins see only the controls they can use, and the Admin UI organization switcher is a searchable tree showing each organization's full path.
  • Authorization: a scoped admin can no longer act on users outside their organizations, directly or through routes that name a user indirectly, and naming a user who does not exist returns the same 403, so responses do not reveal which accounts exist. Scoped admins can no longer create, change, or delete deployment-wide roles or RBAC constraints. Removing a role is refused while the user still stewards systems they would lose access to. Monitor writes, monitor task reads, raw system asset reads, privacy assessment writes, questionnaire chat, external respondent invites, and connection-keyed reads for manual fields and consentable items are all checked per organization. Placing scopes on or rotating an OAuth client without a user requires holding every one of its scopes for all organizations.
  • Fixes: organization-scoped user creators can place a new user in their own organization, and organization-scoped owners can grant the viewer, respondent, and data steward roles. Includes a database migration.
  • Data integrity: organization_fides_key is required and references an existing organization on the organization-scoped configuration tables. See the note below. Includes a database migration.
• OAuth Client Management Is Owner-Only: Creating, editing, and deleting OAuth clients is removed from the Contributor role, because a client without a user can act across every organization. Includes a database migration.
• Advanced RBAC Sync At Startup: When Advanced RBAC is enabled, every user with legacy roles has their grants synced into RBAC at startup, so turning the flag on no longer strands an existing admin or owner. Users whose roles were set through the legacy endpoint no longer end up with no permissions.
• Telemetry Improvements: New fides.dsr.created and fides.dsr.finalized counters track privacy requests as they are created and finish. Temporal SDK worker metrics (task slots, schedule-to-start latency, sticky cache, and RPC failures) are exported. LLM call diagnostics, such as model, token counts, and duration, are exported under gen_ai.* and fides.llm.* keys, with OpenTelemetry's error.type replacing the bare error_type attribute, and LLM failure logs include the provider's HTTP status. Log records report the module, function, and line that emitted them again when telemetry is on.
• Security:
  • anyio bumped to 4.14.2.
  • SSO redirect URIs use https (except loopback) and come from admin_ui.url, sso_allowed_origins, or the Host header, never the Referer.
  • Admin UI login no longer follows a protocol-relative redirect path.
• Bug Fixes:
  • The Astralis app returns to login when the session expires, and SSO sign-in, invite and reset links, and sign-out messages work. Invite and reset links open the set-password form even when the browser holds a stored session, and "Return to sign in" on an expired invite shows the sign-in form.
  • Direct links and page reloads open the right Admin UI page, including the dataset visual editor, and a page no longer crashes when the health response omits a capability.
  • Streamed LLM completions no longer hit spurious connection timeouts, and streamed Bedrock completions assume the configured IAM role and report a refused role the same way as other calls.
  • The API docs page pins its Swagger UI version and adds an endpoint search box, since browser find-in-page no longer finds off-screen endpoints.
  • Documentation links that led to missing pages are fixed, and the messaging template edit page shows fetch errors.
  • Astralis page header actions are hidden from users who cannot view the page, nav search results highlight on hover and keyboard selection, and dark mode, sticky headers, and component borders and colors render correctly.

Database schema & data changes

• This release includes database migrations for privacy request document uploads, automated request rules and their audit actions, monitor path rules, classification source tracking on discovered resources, data use guidance, assessment output run tracking, framework source authority labels, assessment plan topic requirements and publishing attribution, and consent configuration history attribution.
• Data and permission migrations seed the task_context:manage, data_use_guidance:read, data_use_guidance:update, astralis_agent:chat, privacy-notice:archive, and privacy-experience:archive scopes, revoke OAuth client management from the Contributor role, let approvers read connection types, and fix organization-scoped owner grants.
• Blank experience and Privacy Center translation labels are backfilled from localized defaults.
• organization_fides_key becomes NOT NULL with a foreign key to ctl_organizations.fides_key (ON DELETE RESTRICT) on connectionconfig, datasetconfig, privacynotice, privacyexperienceconfig, plus_property, privacy_assessment, secrets_manager_config, tcf_configuration, and messaging_template, and gains the foreign key on the assessment, fact, and gate_decision tables. The migration uses a lock-safe validation pattern and is reversible.

Notes

• Legacy v2 access policies are read-only once v2.1 is enabled. Existing v2 policies keep their behavior but appear as read-only "Legacy" rules, and new rules must be written in the v2.1 policy language. The Admin UI now says "Enforcement" for Access control, "Policies" for Access policies, and "rules" for the items on the Policies page.
• Breaking: POST /api/v1/access-control/evaluate requires input_type. The surface field is replaced by a required input_type. Callers still sending surface get a 422, so upgrade callers together with the server.
• Breaking: PBAC no longer reports coverage gaps for unregistered callers, datasets without declared purposes, or unregistered tables. Those calls are now allowed or denied by policy alone. Review policies that relied on those gaps being flagged.
• A Celery worker consuming fidesplus.discovery_monitors_detection is required. Monitor tasks always run on Celery. The default fides worker consumes this queue. FIDESPLUS__DETECTION_DISCOVERY__MONITOR_CELERY_TASKS_ENABLED is ignored and will be removed in a later release.
• LLM datastore classification always batches. Monitors that had batching turned off switch to gemma-4-31b, and their custom LLM instructions are now added to the standard prompt instead of replacing it. Review custom instructions written to stand alone.
• Removed: the POST /api/v1/plus/llm/chat debug endpoint. Use the prompt explorer instead. Its raw_response now has a fixed shape (text, finish_reason, tool_calls, usage) rather than the provider SDK's.
• Removed: the redis.dsr_cache_strict_index setting and the assetConsentStatusLabels feature flag.
• Deprecated: soft delete routes, scopes, and fields for privacy notices and experiences. DELETE and .../restore, the :delete scopes, deleted_at, and show_deleted keep working for this release only. Move to .../archive, .../unarchive, the :archive scopes, archived_at, and show_archived.
• New task_context:manage scope. It is granted to Owners automatically. A deployment that overrides both root_user_scopes and root_user_roles must add it for root. OAuth clients granted the scope directly need a new token, and fides push of a dataset whose fields are flagged as task context on the server needs the scope.
• Manual task context sources are restricted to the task's own connection. A source on another connection's dataset is rejected on save, and a stored one blocks the next edit of that configuration until it is removed. Manual tasks only receive context from fields still marked as task context.
• Contributors can no longer create, edit, or delete OAuth clients. Owners are unaffected.
• Unverified identities can no longer opt in through PATCH /privacy-preferences. An opt-in that carries an unverified email or phone number, or any other identifier in that identity, is rejected. Opt-outs are unaffected.
• Multi-organization upgrade precondition. Every organization_fides_key value on the tables listed above must exist in ctl_organizations. The default organization is seeded automatically, so this only affects deployments with rows pointing at an organization that was removed. The migration fails with a clear error if the precondition is not met.
• Experience labels may lag after upgrade. Backfilled translation labels are served once the experience cache refreshes.
• Old uncategorized website assets stay until reprocessed. Existing "Browser request" page assets are cleared only by reprocessing a scan with reset_results.
• The Janus iOS SDK requires iOS 15.0 or later.
• The error_type LLM telemetry attribute is now error.type. Update dashboards and alerts that read the old name.
• Assessments v2 runs in the deployed Temporal worker. No new deployment is needed, and the fides temporal-worker process now drains both DSR and assessment work on shutdown.
• New optional settings. FIDESPLUS__ATTACHMENT_RETENTION__DAYS turns on irreversible attachment deletion. FIDESPLUS__ASTRALIS_AGENT__ENABLED and FIDESPLUS__MCP_GATEWAY__ENABLED turn on the Astralis assistant. pbac.fixture_store = "redis" selects the shared PBAC fixture store. FIDES__ADMIN_UI__DISPLAY_DELPHI_BANNER shows the Try Astralis 3.0 banner in the Admin UI.