Governance now reaches every place data leaves or enters CDC outside the store: HTTP requests and responses, plugin tasks, messages and agents. And a publish no longer breaks what depends on it, because every definition now has Drafts, Published versions and a Dependency graph. Many entries carry an upgrade step, so read "Before you upgrade" first.
New
Governed exchanges — your Rules now act wherever data crosses the edge of CDCgovernanceAction required
A Rule can now govern the request an HTTP Start takes in, the response an HTTP
End sends, what a plugin Task sends and receives, the messages that message
elements send and receive, and what an Agent Task sends to its LLM provider. A
refused crossing moves no data: a request returns 403 and starts no instance, a
message is dead-lettered, and a prompt is never sent.
An Outbound Rule on a Domain model field acts through every mapping, so one Rule
on Customer.ssn refuses an HTTP End whose response copies the ssn. A new Exchange
model type describes payloads outside the store, and each plugin task's input and
output appear as Exchange models that stewards can govern. Rules can also decide
by the destination system or its Location, set on the Sources page.
The run monitor, debug panel, dead-letter queue, Node test runs and agent
transcripts now apply your Rules for the viewer, and logs and traces no longer
carry payload values.
Dependency graph — see what a change reaches before you make itmodelsAction required
CDC now keeps a Dependency graph of every model, process, agent, plugin,
Connection, plugin entity and the governance that acts on them, current after
every save, import and delete. The first start after the upgrade fills it once.
A Dependency graph page draws one definition or the whole deployment, a column
per kind. Models, processes and agents get a Dependencies section that names what
depends on them, what they need, and a dependent that has not taken an upgrade.
Deletes, archives and plugin uninstalls now answer from the graph, refuse while a
Draft or Published version depends on them, and name each one. A publish reads
the graph too, so it costs a handful of reads whatever the size of the deployment.
Drafts and Published versions — a publish no longer breaks what uses itmodelsAction required
Every reference now runs the latest Published version of the model, process or
agent it names, and each run log step shows the version it used. A publish no
longer breaks the processes, Ingests, events and agent tools that use it, and a
new plugin version keeps every task and Connection working.
Agents get Draft, Published and Archived versions like models and processes. A
Published version can no longer change, a debug run can use the Drafts of what it
calls, and process settings apply to every version from its next start.
Models, processes and agents share one name rule, and a rename changes no stored
record. A runaway Call Activity recursion now stops at a configurable depth.
A publish refuses a change that a follower cannot take, and names itmodelsAction required
A publish now refuses a change that a Published process or model cannot take, and names each one and why. The publish dialog shows every definition that follows yours, and lets you publish their Drafts together.
Publish a process and the models it needs in one stepprocesses
Publish a process Draft and the model Drafts it needs together, so neither has to wait for the other.
Choose a Classification's Rules, and see what a change reaches before it savesgovernance
Choose a Classification's Rules when you create it, and add or remove them later on the Classifications page. Where the Classification is placed, Save first shows every field the change reaches, says where each one gets stricter or looser with the riskiest first, and asks you to confirm. Place rule shows the same preview.
The rule builder offers every Action, not only refusegovernance
The rule builder now offers mask, anonymise, remove, record, retain and encrypt. A Rule that encrypts a field picks its Key custodian group from your Access groups, with no API call needed.
API keys — Power BI, Excel and scripts can call CDC without OAuthaccess
Issue an API key for an API client, and tools that cannot do OAuth call CDC as that client, with its scopes. The key is shown once, can expire, and stops working within seconds of a revoke.
Plugins can serve their own HTTP endpoints from Masterplugins
A plugin can now serve endpoints under /plugins/{plugin}/, behind CDC's sign-in. The plugin SDK adds readers for the plugin's own entities, published models and the calling user.
Improved
Classifications open as cards, and every removal asks for a reasongovernance
Classifications open as cards that show their Rules, a description and every place they are placed, each a link. Saving a Rule change shows what you changed, what gets riskier and where else it lands. Taking off a Rule or Classification now asks for a reason, so the trail explains each lost protection.
No hidden platform definitionsmodels
Every model and process is now a normal definition you can see, rename, export and edit. The upgrade deletes leftover hidden definitions that nothing uses and keeps every one that holds data.
Dependencies updatedsettings
Eight dependency updates to the frontend libraries and the Aspire packages, including Mermaid 12 and a DOMPurify security fix.
Fixed
An API or webhook with no saved authentication now requires a tokenaccessAction required
An API or webhook that never saved an authentication choice now requires a bearer token, as the designer showed. Before, it let anyone through while the designer called it Authenticated.
A deployed platform no longer creates Keycloak clients with known secretsaccessAction required
The debug client is created only on a developer machine, and the scope reader takes its secret from your configuration.
Rules decide on the facts of the request they judgegovernance
Ingest Rules now decide on the source system the Ingest element declares, on each field's Owning systems, and only on the fields an ingest writes. Location Rules decide on the Requester's Location, a run for a Declared group meets request.activation is declared, and a refusal names the fact it waited for.
Every ingest records its governance decisiongovernance
The governance trail of a record or a run now shows each write. A stored event and a dead letter again carry their correlation id, the user who wrote it and the sending run.
A Rule can no longer name a group that does not existgovernance
The rule builder picks groups from Access, with no free text. A group no longer in Access shows as not in Access, and the Rule saves only once it is removed or replaced.
Long dialogs stay inside the windowgovernance
Placing a Rule or Classification on a whole model no longer pushes Save off the screen. Long dialogs scroll their content, so Save and Cancel are always visible.
The designer shows the authentication an API Operation really requiresprocesses
The Api default is included. An Operation override can add scopes, but no longer looks like it removes the Api's requirement.
An endpoint plugin can resolve a model reference againplugins
References name their target model by lineage, and the plugin SDK's model catalog now finds the Published version of a lineage.
A fresh database upgrade no longer stops on a repeated migration versionsettings
On PostgreSQL and SQL Server, two migrations that shared one version no longer stop a fresh database upgrade.
The Users tab stays on the page you pickaccess
The tab no longer jumps back right after it opens, or when the search text only gains spaces.