New capabilities, improvements, security updates, and documentation changes to the AI control plane — grouped by month, newest first. Subscribe via RSS.
Governance starts the moment an organization exists. Every organization — including those created through self-serve signup — starts with governance controls active and its audit trail recording from the first action, so the evidence of how the workspace was set up is part of the record. The first-run path now links agent templates directly to the governance controls that apply to them, shortening the route from a new agent to a governed one.
Organization owners can now enable protected-action evidence for their own organization from Security settings, without contacting support; the change is recorded in the audit trail, and the capture-scope view shows immediately which action paths become covered. Plan requirements still apply, and the settings page states them before you enable the feature.
Praesidia's own MCP server now exposes tools to create a connection, create a guardrail, create an agent task, and query the audit log — in addition to the read and operational tools it already offered. A coding assistant or orchestrating agent can therefore set up governance for a new integration and check what happened afterwards, using the same protocol it uses for everything else. Each call runs under the caller's permissions and is itself recorded in the audit trail.
Two capabilities for connecting MCP servers safely landed together:
OAuth browser authorization — connecting an MCP server that uses OAuth 2.1 now completes the authorization-code flow in your browser from the workspace. The resulting tokens are held centrally, refreshed automatically, and never handed to individual agents.
MCP tool inventory — each connection lists every tool the server exposes, so tool-level permissions are chosen from what actually exists rather than typed from memory, and a server that adds tools later is visible before any agent can call them.
Every entry states its support status, which surfaces are governed, the evidence grade produced, and known limitations, so you can judge coverage before adopting it.
Access to an MCP server is the door key; access to specific tools is what least privilege actually requires. Tool-level permissions can now be configured on a connection in the workspace using attribute-based rules, so the same server exposes different tool subsets to different agents. Per-agent tool policies complement this from the agent side, and the same tool-level rules apply to tool calls made through the OpenAI Responses route on the model gateway.
Three quickstarts now sit beside the original getting-started guide, each ending with a result you can inspect:
Your first model request — configure a provider, send one OpenAI or Anthropic request through the gateway, and read the recorded usage.
From agent action to audit evidence — execute a governed MCP action, inspect its authorization record and timeline, export the signed bundle, and verify it offline.
Install a matching runtime SDK — install from a source checkout and separate runtime credentials from review credentials.
The start page helps you choose which path to take first.
The new use cases section describes twelve scenarios the way a buyer frames them, rather than by feature: securing MCP servers on an internal developer platform, capping runaway agent spend, eliminating shadow AI, producing a SOC 2-ready agent audit trail, governing customer-support agents under the EU AI Act, zero-trust agent-to-agent access across organizations, autonomous coding agents in CI/CD, healthcare, public sector, financial services, legal document review, and agent marketplaces.
Each page states the problem, the controls that address it, and the evidence produced, and links to the relevant guide and documentation.
People who review evidence should not borrow an agent's credential to do it. From your profile you can now create, list, and revoke personal API keys that carry your own permissions, so a reviewer inspecting an action or exporting a bundle does so under their own identity. Runtime credentials for agents remain separate and continue to follow the non-human identity lifecycle.
Signed webhooks now keep a delivery history per endpoint: each attempt records the event, the timestamp, and the status your receiver returned. When a receiver was down or misconfigured, you can replay the delivery from the workspace once it is healthy, instead of reconstructing the missed event by hand. Security events such as sign-ins and failed sign-ins are among the events you can subscribe to.
Evidence is only as good as its coverage, so the platform now tells you where coverage ends. A capture-scope view lists which action paths are supported, partially supported, or unsupported for protected-action evidence, and a coverage summary returns aggregate counts of recorded actions for your organization. Neither claims to count actions outside the configured capture paths — the point is to make the boundary explicit.
The audit-verifier can now confirm that the signing keys in a bundle are the ones Praesidia issued to your organization. Details in the action evidence quickstart and on the verification page.
A tool result tells you what came back; it does not prove what was authorized. Governed MCP actions now produce protected-action evidence: a single-use authorization bound to the exact request, a timeline of events from proposal to closure, and an evidence grade stating how strong the record is. This evidence is included in signed audit exports, and the audit-verifier checks it offline. The verifier also gained machine-readable JSON output and distinct exit codes for valid, failing, and unsupported components, so it drops cleanly into CI.
Exported compliance bundles can be checked by your own team or your auditor using @praesidia/audit-verifier, a stand-alone, Apache-2.0 licensed command-line tool. It vendors its own cryptographic primitives, has no runtime dependencies, and never contacts Praesidia: verification is a static, offline check of one exported artifact. The command exits 0 only when every signature, link, and inclusion proof verifies; anything else is a non-zero exit, never a silent pass. When enabled, it also confirms each Sigstore Rekor transparency-log receipt.
The model gateway now accepts OpenAI-wire requests at an OpenAI-compatible base URL and native Anthropic Messages requests, each under your own provider account. Change the base URL in an existing client and every request is attributed to an application, checked against budgets and policies, and recorded with its usage — no SDK change required. A denied request returns an explicit error naming the control that stopped it.
Bring-your-own-key configurations now cover Ollama and any endpoint that speaks the OpenAI-compatible API, alongside the existing hosted providers. Provider credentials are held at the gateway and injected server-side, so the application only ever holds its Praesidia key. A BYOK status panel in organization settings shows which providers are configured and where their keys are held. Self-hosted, private-network model endpoints can be enabled by an administrator.
The OWASP Agentic AI Top 10 guide walks through ASI01 to ASI10, what each risk looks like in a deployed agent, and which controls address it. It joins the six earlier cornerstone guides.
Ten glossary terms also received stand-alone pages with worked definitions: non-human identity, continuous authorization, agent trust score, bidirectional guardrails, capability token, tamper-evident log, attestation, blast radius, shadow AI, and human-in-the-loop. Start from the glossary.
SIEM forwarding now offers a payload-format selector: Praesidia's native JSON, the Open Cybersecurity Schema Framework (OCSF), or Common Event Format (CEF). Choose the one your SIEM normalises best, and agent security events arrive ready to correlate with the rest of your telemetry rather than needing a custom parser.
The TypeScript and Python SDKs now cover more of the platform:
Emit OpenTelemetry (OTLP) traces and metrics from instrumented agents.
Rotate an agent credential with grace overlap, and request just-in-time capability tokens per task.
Follow a multi-agent chain trace end to end.
Export the EU AI Act auditor report programmatically.
Praesidia's MCP server adds operational tools so an agent or coding assistant can manage workflows, connections, billing, and notifications through the protocol it already speaks. Install from a source checkout as described in runtime installation; see also the capability token definition.
Access control answers "may this agent call this tool?" The new intent layer answers a different question: "is this call what the agent was deployed to do?" You declare the conditions — scope escalation, bulk data extraction, access outside the assigned data domain — and each evaluation resolves to a block verdict, which stops the call, or a flag verdict, which records it for review.
Starting from an empty policy set is slow and error-prone. Governance packs bundle the policies, guardrails, and compliance evidence mappings a regulated industry typically needs — financial services, healthcare, public sector — and install them into your organization from a catalog. Installed packs are fully editable, and re-installing a pack does not duplicate what you already have.
Data-subject erasure is now a platform action. An administrator initiates an erasure request for a data subject, the platform removes personal data the request covers, including data held in agent memory, and issues a completion record that can be shown to the requester or an auditor. Records that must be retained for legal reasons are handled separately from those that are erased.
Agents change: a model update, a new prompt, or a compromised credential all show up as behaviour that no longer matches the past. Praesidia now maintains a behavioral baseline per agent and scores each call against it. Deviations are surfaced in a drift panel under monitoring and feed the agent's trust score, so downstream controls can respond automatically.
Policies can now mark boundaries that no agent may cross alone. When an agent reaches one, the request pauses and appears in a human escalation inbox, where a reviewer approves, denies, or asks for more context; the decision is recorded in the audit trail alongside the original request. Low-confidence flags can be auto-resolved while higher-confidence ones are always escalated, so the inbox stays focused on decisions that need a person.
Every registered agent and application now receives an automatic EU AI Act risk-tier classification, with a per-entity matrix showing which articles apply and where evidence exists. From the same view you can export an auditor or DPO report as PDF. The report can also be requested programmatically from the TypeScript and Python SDKs.
Shadow AI is what you have not registered yet. The new discovery inbox lists agents, applications, and model configurations observed in traffic that have no registered identity, so you can adopt them under governance or dismiss them with a recorded reason. New organizations can start from discovery rather than manual registration, which is usually faster for a team inheriting an existing estate.
Non-human identity received three lifecycle controls:
Zero-downtime rotation — rotate an agent's client credential with a grace overlap so running workloads finish on the old credential while new ones use the new one. Available in the workspace, the SDKs, and the CLI.
Short-lived credentials by default — new agents receive just-in-time, task-scoped tokens rather than a long-lived static secret.
Single-agent revocation — cut off one compromised or misbehaving agent immediately, containing the blast radius without disturbing the rest of the fleet.
Budgets stop runaway spend; alerts tell you before a budget does. You can now define spend alert rules against any budget scope — organization, agent, model, or connection — and route them to the notification channels you already use. Alongside them, a recommendations view surfaces cost-optimisation opportunities computed from actual usage, such as models that are over-used for the tasks they serve.
Configure budgets and alerts before expanding a paid workload, as the getting started guide suggests, and read the AI FinOps guide for attribution and chargeback patterns.
SCIM provisioning now goes beyond creating and deactivating users. Groups pushed from your identity provider can be mapped to Praesidia roles and teams, so a person's authority inside the workspace follows their directory membership: join the group, gain the role; leave it, lose the role. Administrators review provisioned groups and their membership counts under Configure → Integrations.
The AI governance and agent security glossary defines the terms used across the platform and the guides — non-human identity, capability token, tamper-evident log, blast radius, and more.
The readiness assessment walks through the questions a security or compliance lead should be able to answer about their agent estate and points to the guide that covers each gap.
The cost calculator helps estimate model spend for an agent workload before you set budgets.
Human operators can now register passkeys as a second factor when signing in to the workspace. Passkeys follow the WebAuthn standard, so a platform authenticator (Touch ID, Windows Hello, a hardware key) replaces one-time codes with a phishing-resistant credential bound to your domain. Administrators keep existing MFA options alongside passkeys and can require step-up authentication for sensitive changes such as SSO configuration.
Reviewers with the compliance-officer role can now export forensic evidence for a chosen time window from Trust & Safety → Forensics, without asking an engineer to pull records for them. The export contains the same audit records that back your compliance bundles, so what a reviewer sees in the workspace matches what an auditor receives.
See the action evidence quickstart for the full path from a governed action to an exported, verifiable bundle, and the AI governance guide for how forensic evidence fits an audit programme.
