§ CHANGELOG
What's new in Execlave
Governance policy types, SIEM exporters, SDK releases, and platform hardening — the latest changes to the Execlave AI agent governance platform.
- Late October 2026performance · cost controls
Faster enforcement, measured in production, and cost rules that do what they say
- ▸Policy checks are about three times faster in production: 19.9 ms at the median on the server, authentication included (measured on 29 October 2026). The figures, the method and what they cover are on the benchmarks page.
- ▸The kill switch is measured in production too: a pause through the API is in force 57.1 ms (median) after it reaches the server, and in every measured pause the agent's next call was already blocked.
- ▸Every enforce and pause response reports its own server-side time in a Server-Timing header, broken down by stage, so you can check the figures on your own traffic.
- ▸Multi-step attack analysis now runs right after the decision instead of inside it. A detected attack blocks the agent's next call; the action that triggered the detection is allowed.
- ▸Cost rules: pause_agent now pauses the agent through the kill switch, and budget warnings notify your Slack, email and PagerDuty channels once per rule and window.
- ▸Self-hosted: the worker now gets the same feature flags as the backend in Docker Compose and Helm, so tool policies also apply when traces are checked after the call, and anomalies turn into policy suggestions.
- October 2026policies · team
Model-judged rules, rules you can test, and team invitations
- ▸Model-judged rules: write what an agent must not do in plain language. A qualified model judges each stored action against the rule after it runs, in monitor or warn mode, and the trace and policy pages show how it was judged. Compliance reports count these rules separately from enforced ones. Included in Professional and Enterprise.
- ▸Test a rule before saving it, write your own rule on the create page with a field reference beside it, and see a notice when a policy's rule cannot match anything, together with the recommended rule.
- ▸Invite team members by email with the role they need, send a pending invitation again or withdraw it, and change roles in the member list.
- ▸GDPR erasure from the dashboard: admins can erase a member's personal data, owners can erase the whole organization, and every request keeps its receipt in the organization settings.
- August–October 2026outcome evidence
Know whether an action really took effect
- ▸A new outcome for actions whose effect has not been confirmed yet. The Unconfirmed Queue lists them with their resolution history, and the signed compliance report carries confirmation coverage.
- ▸Per agent, set the confirmation window and how strict outcome checks are. A strict agent refuses a success that has no confirming evidence.
- ▸Register a read-back check for an agent: Execlave runs it and settles the unconfirmed actions it can confirm.
- ▸Both SDKs report effect evidence and can resolve an unconfirmed trace later.
- September 2026sdk-js / sdk-python v1.8.0
Enforcement you can account for
- ▸The SDKs report periods in which enforcement was bypassed, and the signed compliance report carries them.
- ▸Choose what happens when a policy check fails, for the whole organization, in Settings → Security.
- ▸API keys can be limited to scopes, and the scopes are enforced on every request.
- ▸When a member’s access changes, or the member is removed in the sign-in service, their earlier sessions and live connections end at once.
- July 2026sdk-js / sdk-python v1.6.0
Stronger enforcement, broader prompt-injection coverage, and signed compliance reports
- ▸Prompt-injection detection now covers encoded payloads (base64, hex, leetspeak, reversed text), cross-script look-alike characters, and non-Latin languages including Chinese, Japanese, Korean, Hindi, and Arabic — plus system-prompt-extraction attempts and attacks split across multiple conversation turns.
- ▸Kill-switch and fail-closed behavior hardened: a paused agent has its next policy check blocked, and 'fail closed' now blocks on the very first enforcement outage as documented.
- ▸Framework adapters (LangChain, OpenAI Agents) now enforce policy on direct model calls and agent input, not only wrapped chains — closing gaps on the most common integration paths.
- ▸New SDK APIs: scan a tool's output before it reaches the model (enforceToolOutput / enforce_tool_output), and pass conversation history for multi-turn injection scanning.
- ▸Compliance reports are now digitally signed (RSA-SHA256-PSS) and carry an enforcement-decision summary — allowed and blocked counts, not just violations — so coverage is provable to an auditor.
- ▸Opt-in redaction of PII in stored trace payloads, and clearer, more reliable AI policy generation from plain English.
- ▸Upgrade note: the SDK enforcement call now rejects unknown fields with a clear error instead of ignoring them — use the documented option names.
- July 2026sdk-js / sdk-python v1.5.0
Approval certificates now bind to the full request, not a hand-picked field list
- ▸The OpenAI Chat adapter sealed only { model, messages } into the approval certificate's digest — tools, tool_choice, temperature, and response_format could drift from what a human approved without invalidating the certificate. It now seals the full request.
- ▸Fixed a serialization gap shared by both SDKs: one non-serializable field anywhere in a payload used to collapse the entire sealed value to a placeholder, silently making certificate verification a no-op for everything else in it. Now isolated per field instead.
- ▸CrewAI's Python integration previously enforced tool-call policy with no sealed metadata at all — brought in line with every other adapter.
- ▸A new structural test blocks any adapter from hand-picking fields into a certificate's sealed metadata going forward.
- June 2026i18n · security
Execlave is now available in German
- ▸The full product — every marketing page and the entire dashboard — is now localized in German (de), with locale-aware routing and hreflang alternates for search.
- ▸Approval and violation history now preserves a policy's name after it is deleted, so audit trails stay readable after cleanup.
- ▸Richer search presence: JSON-LD structured data, x-default / hreflang alternates, and on-page FAQs across key pages.
- ▸Security hardening: next-intl upgraded to v4, plus nodemailer and form-data CVE patches.
- June 2026
SIEM exporters + compliance PDF export
- ▸New OpenTelemetry (OTLP), Splunk HEC, and Microsoft Sentinel trace exporters — stream every agent trace to your SIEM, off the enforcement path.
- ▸SIEM credentials are envelope-encrypted (AES-256-GCM) at rest, never stored as plaintext.
- ▸Compliance evidence packages now export as signed PDF, alongside HTML and JSON.
- ▸New public EU AI Act overview mapping Execlave to the high-risk (Annex III) obligations, which apply from 2 December 2027 under Regulation (EU) 2026/1744.
- June 2026sdk-js / sdk-python v1.4.0 · cli v1.1.0
HMAC request signing + federated policy export
- ▸Optional HMAC request signing across the JS and Python SDKs — replay-safe, opt-in request authentication.
- ▸Signed, portable policy export/verify and a federation export endpoint for multi-environment policy sync.
- ▸Built-in policy types expanded to 19, covering tool integrity, response groundedness, OPA Rego, and agent lineage.
- May–June 2026
Enforcement hardening
- ▸Audit-log atomicity and hash-chain hardening; append-only immutability enforced at the database trigger level.
- ▸Prompt-injection ReDoS guards and a semantic-classifier circuit breaker.
- ▸Approval-workflow TOCTOU fix and per-namespace enforcement rate limiting.
- ▸Multilingual prompt-injection and PII detection across 13 languages.
- May 2026sdk-js / sdk-python v1.2.0
Framework integrations + tool-integrity governance
- ▸SDK integrations for LlamaIndex, MCP, OpenAI, and AutoGen.
- ▸Tool-integrity governance: baseline expected tools and detect drift in agent tool usage.
- ▸Per-evaluator enforcement modes (monitor / warn / require approval / block) with configurable failure modes.
§ DETAILS
Per-package release notes
The SDKs and CLI ship their own versioned CHANGELOGs in the repository; this page summarizes platform-level changes.