Changelog

Every release,
as it ships

New capabilities, improvements, and fixes across identity, enforcement, approvals, and audit. Newest first, receipts included.

v2.4.0NewImproved

Policy Enforcement Point: generally available

  • The Policy Enforcement Point is GA on every plan: real-time policy decisions on every agent action, with an 8.4ms median at the SDK boundary.
  • Compiled policy graphs replace interpreted rule evaluation, so decision latency no longer scales with rule count.
  • Shadow mode lets you evaluate a draft policy version against live traffic and diff the verdicts before enforcing it.
  • All fallback paths now fail closed with structured denial reasons agents can handle programmatically.
v2.3.0New

Audit-chain verification API

  • New /v1/audit-chain endpoint exports receipt bundles with the public keys needed for fully offline verification.
  • The open-source verifier now checks external transparency-log anchors alongside hashes, signatures, and sequence continuity.
  • Receipt exports stream as line-delimited JSON, so multi-million-receipt periods no longer require pagination gymnastics.
v2.2.1ImprovedFixed

Registry hardening

  • Passport revocation now propagates to every enforcement node in under two seconds, down from eight.
  • Registry lookups are rate-limited per caller with scoped keys, closing an enumeration vector reported through our disclosure program.
  • Fixed a race where a passport revoked mid-rotation could briefly present both key generations as valid.
v2.2.0NewImproved

Approvals in Slack

  • Held actions now resolve directly in Slack: full context, one-tap approve or reject, and the decision lands in the audit chain as a signed receipt.
  • Approval requests include the agent's recent history and the exact policy rule that triggered the hold.
  • Expired holds now record the timeout in the receipt, so deny-by-default is provable, not just configured.
v2.1.0NewImproved

Budget runway alerts

  • Budgets now project their exhaustion point from current burn rate and alert at configurable thresholds, so you hear about drift days before a hard stop.
  • Budget hierarchies: per-action, per-agent, and per-team caps evaluate together on every spend decision.
  • Alert destinations extend to Slack and webhooks alongside email.
v2.0.2NewFixed

Agent health scores

  • Every passport now carries a health score derived from denial rates, budget pressure, and approval outcomes. Spot drifting agents before they page you.
  • Health history charts on the agent detail page cover the trailing 30 days.
  • Fixed reputation scores double-counting held actions that were later approved.
v2.0.1NewImproved

Passport share sheets

  • Passports now generate a public share sheet (identity, key fingerprint, scopes, and verified history) for vendors and reviewers, no login required.
  • Share sheets can be scoped to hide budgets and internal policy names while keeping identity verifiable.
v2.0.0New

govern.sh launch

  • Agent Passports: per-agent Ed25519 identity, minted in one API call and revocable in one click.
  • Policies: scoped permissions and spending budgets, evaluated on every action.
  • Approvals: policy-triggered human sign-off for high-stakes actions.
  • Signed Audit Trail: hash-chained receipts for every decision, verifiable independently of govern.sh.

Run the newest release today.

Everything above is live on every plan, including the free tier's three agents and full policy engine.

Mint your first passportTalk to us