Changelog

Release notes for the UMA for Agents reference architecture, newest first.

Calendar versioning in vYYYY.MM.N format, where N is the sequential release within that month. One entry per release.

September 1 2026

v2026.09.3

Enhancements

Docs: the Lab demonstrations pages carry everything the run cards do — the setup, where to sign in, the Codespace and re-run notes, and how to switch model provider — with every command in a copyable block.
Docs: the README and the Codespace walkthrough link the run cards.

v2026.09.2

Bug fixes

Docs: make kagent was still described as the local no-account path in KAGENT.md, DEMOS.md, KUBERNETES.md and the Run the lab guide after the default became a hosted model, and kagent.sh pinned an Anthropic model two releases behind the one the demo cards name.
Docs: the Lab demonstrations pages reproduce their run cards rather than paraphrasing them, and are generated from those cards so the two cannot drift.
Agent shim: Upstream.resume() reported "still waiting" as a bare string, the same type as the grant it had to be distinguished from. It returns an explicit state.

v2026.09.1

New

Demos: a run sheet per use case, in docs/cards/ and under Guides → Lab demonstrations. Each one is driven by asking an agent a question and then deciding as the owner, rather than by running a check.
kagent: RESOURCE= points an agent at Carol's account, a jointly held account, the firm's book, or an agent the owner operates herself — make kagent RESOURCE=carol|joint|either|shared|hers. Each resource publishes the authority that speaks for it, so which owner decides follows from the resource rather than from configuration.
Agent shim: UMA4A_PUBLISH_TO publishes the adapter's signing key in an operator's key directory and names that origin as its client id, so an adapter can be the owner's own agent rather than a third party's.
Kubernetes: make k8s-demo and make k8s-joint-demo, k8s-multi-owner-demo, k8s-first-party-demo — the same negotiations with nobody answering for the owner, following the Job's log rather than printing it at the end.

Enhancements

Agent shim: a pending decision is returned as a result rather than holding the call open, for any client that cannot render an elicitation. Nothing between the agent and the owner has to keep a connection alive while she decides.
Agent shim: a retry resumes the request the owner is already deciding instead of opening a second one. Re-negotiating spends the attention budget her authority keeps per agent (UMA_AS_PEND_BUDGET), so an agent that checked a handful of times was refused with not accepting new agent requests — correctly, for behaving like a nuisance.
kagent: hosted models are the default; MODEL=ollama remains, pinned to qwen3.5:9b.
Demo driver: the owner's decision window is UMA4A_OWNER_WAIT_S (900s) when nobody is simulating her. 120s is a headless budget.

Bug fixes

Kubernetes: run_job waited on Complete and Failed, and kubectl wait keeps only the last --for — so it waited on Failed alone. A job that succeeded ran to the full timeout, and where that outlived the job's ttlSecondsAfterFinished the Job was collected before its logs printed, failing a run that had passed. k8s-joint-check and k8s-org-check failed outright; every other check paid for it in wall time. make k8s-smoke-test now finishes in seconds rather than minutes.
Docs: DEMOS.md said an ask-me tier pends to her portal while her personal AI is up. It is refused — the ability records no channel to her and stops, which is the safe answer when the one thing it cannot do is ask her.
Demo cards: the pages declare their character set. Without it they rendered as Latin-1 and every · and → came out as mojibake.

August 26 2026

v2026.08.26

New

Cross App Access: identity_provider.subject_map in the charter — what a provider asserts, mapped to the member it means. A real tenant's sub is local to that tenant, so somebody has to say who it is, and the organization is the party that knows.
Cross App Access: make okta-live runs the whole negotiation against a real tenant rather than the provider shipped beside the lab.

Bug fixes

Agent: the token exchange borrowed the client configured for the resource server, so an agent in a deployment with a private CA could not reach a public identity provider at all — CERTIFICATE_VERIFY_FAILED at the moment it left the deployment. It now verifies against the public roots and the deployment's CA, taken from the caller, the environment or the conventional path in that order.
Enforcement point: how long a refusal may be worded from a cached description of the organization is configurable (UMA_PEP_ORG_DISCOVERY_TTL_S), and the lab sets it short. A charter that had just started federating was described from a copy read before it did.

v2026.08.25

New

Cross App Access: an organization may federate identity to an enterprise identity provider. Its charter names the provider; a member's authority then asks an agent whose employee it acts for, as an ID-JAG (draft-ietf-oauth-identity-assertion-authz-grant) carried in the UMA claim it already had a slot for. Identity is asked for before terms, because which terms apply follows from which member it is.
Cross App Access: new northwind-idp — the customer enterprise's own identity provider, a separate deployment from the one Meridian authenticates its surfaces with. A token from Meridian's provider is not an employee assertion.
Authorization server: verified against a real tenant. Provider keys are found by OpenID discovery rather than a lab convention, permitted algorithms come from the key's type rather than the token's header, provider TLS verifies against the public roots with the lab CA added, and signature failures are reported separately from issuer and audience ones.
Cross App Access: new xaa-broker service — the exchange endpoint, holding the application-to-resource edges an administrator approved. It stands in for a tenant that issues ID-JAGs itself; keys are resolved by discovery, permitted algorithms come from the key's type, and the claim naming the person is configurable, so a charter can name a real tenant instead.
Organization: a member can enrol because her employer's directory vouches for her, instead of with a shared code. Only where the charter names a provider, and one employee's token does not enrol another.
Organization: Charter → Settings gains federated identity — switch it on, name the provider and directory, and choose whether people may enrol without a code.
Authorization server: an assertion is bound to one authorization server, one member and one use, and is only ever asked for over resources the organization actually reaches — never a member's own accounts, never anything she holds jointly.
Agent: Enterprise credentials on the grant loop. An agent carrying them satisfies an identity challenge from a server it has never heard of; the challenge names the provider, the audience, the resource and the scope.

Enhancements

Docs: Try it with Okta — registering the AI agent, the two fields on the resource app that decide aud and aud_tenant, the resource connection, and the organization console side. Verified against a trial tenant.
Docs: an animated diagram of the two halves, from the challenge through the assertion to the three ceilings.
Enforcement point: a resource refused because the caller is not a member of the organization that owns it now names that organization, and says how membership is come by where its charter federates identity. An assertion still enrols nobody — joining is agreed to, not asserted.

August 25 2026

v2026.08.24

Enhancements

Docs: search moved from the docs tab bar into the site navigation. It already covered the blog and the changelog; now it is reachable from them.
Docs: a long changelog contents folds into a disclosure below 1080px, rather than standing between the reader and the first release.

v2026.08.23

New

Docs: a changelog at /changelog/, back to the first release. In ⌘K search as one row per release, in llms.txt, in the sitemap, published as /changelog.md, and readable over MCP with a new listChangelog tool.

Bug fixes

Docs: contents links stopped working after the first click on every doc, post and changelog page. Heading ids were set on the live DOM and lost on the next re-render; they are part of the rendered HTML now.

v2026.08.22

Enhancements

Organization: a charter may only claim a namespace it names. northwind-vault/* is accepted; */get_positions is refused.
Authorization server: an organization reaches nothing an owner holds jointly with somebody else, whatever its charter claims. Enforced at her authority, not in the charter.
Authorization server: terms over a jointly held resource can no longer share a tier with anything else.
Portal: Agent Access → Joint accounts — who else holds each account, what it takes to release it, and a preview to agree to before joining.

Bug fixes

Authorization server: the two organization-admin endpoints returned 500 instead of filtering a jointly held resource out of the results.

v2026.08.21

New

Joint ownership: a resource can have several owners of equal standing, none of whom can decide alone. A published mandate names who is entitled to be counted, at what weight and how many it takes; each owner's authority signs a verdict bound to one negotiation and one agreement; a tally collects them.
Tally: new joint-tally service, speaking an ordinary authorization-server surface so an unmodified agent negotiates with it as with any authority. Reachable at /mcp/joint/<account>.
Tally: every holder's terms are folded into the single document the agent signs: shortest expiry, intersected scopes, unioned prohibitions. Each holder's authority refuses anything signed that is wider than what she published.
Enforcement point: a joint grant carries the holders' signed verdicts. Each is verified against that holder's published keys and the count is re-run before the call is allowed.
Authorization server: /owner/joint to join, preview and leave a mandate; /joint/quote and /joint/verdict for the tally, answered only for a mandate she agreed to.
Kubernetes: the tally runs in a namespace of its own, belonging to neither owner.

Bug fixes

Authorization server: save_negotiation creates a negotiation that never had a ticket. On Postgres it was an UPDATE that matched no row, so a request created by another owner's tally never reached the owner's queue and timed out.
Kubernetes: joint-vault gained the AuthorizationPolicy naming its caller. Without it the mesh reset the connection and the gateway reported a 500 from an upstream that never saw the request.
Kubernetes: policy-test declares its own ServiceAccount rather than borrowing one from smoke-test, which made it unschedulable on a fresh cluster.

v2026.08.20

New

Organization: an organization can own resources, share them with members under a role, and set policy over them. Each member administers access through her own authorization server and her own terms. New org-authority service.
Console: new org-console, the administrator's surface. The charter is editable as a form or as JSON, with a Rego editor for the organization's own operating rules.
Organization: roles carry delegation — none, first-party-only, any-agent — naming whose agent may act on a shared resource.
Organization: groups are managed from the console: create one, set what it reaches, choose which one joiners land in, move members between them. Each publishes a charter version.
Organization: break-glass grants, signed by the organization and recognised at the enforcement point by issuer. Bounded by a disclosed clause, single-use, and notified to the member when opened.
Authorization server: an organization's ceiling is clamped into her terms on write, so it appears in the document the agent signs.
Resource server: /mcp/shared/<member> — one resource administered by several people, each under her own authority.

August 23 2026

v2026.08.19

New

Authorization server: one resource server can hold many people's accounts, each governed by an authorization server of her own. Every owner-scoped artifact carries its owner: the ticket, the grant, the resource id, the terms template and the RFC 9728 document.
Resource server: POST /rs/register — a resource server introduces itself to an authority nobody configured it against, signing with a key published at the origin of the resource it serves. Registration is pending until the owner authorizes it.
Authorization server: a second owner runs in the lab on her own authority.

August 21 2026

v2026.08.18

Enhancements

kagent: make kagent-ask Q=… asks your own question instead of a hardcoded one, and SIM=0 lets a person answer the request rather than the check answering it.

Bug fixes

kagent: the model config dropped its final line for any provider without an extra block, so anthropic and openai produced an invalid config.

v2026.08.17

Enhancements

Licensing: NOTICE rewritten from a component-by-component audit, separating the application stack, the Kubernetes platform, the website and upstream checkouts. One licence had been stated incorrectly.

August 20 2026

v2026.08.16

New

Authorization server: standing.first_party — an agent is first-party when the operator it names is an origin the owner claimed and her authority found that agent's key published in that operator's directory.
Authorization server: the owner as requesting party, with her own agent as a third party. No new branch in the grant loop.

August 19 2026

v2026.08.15

Bug fixes

Authorization server: the derived enforced annotation was written through publish_terms, which is idempotent per template id — so on any store that had already published a version the field was dropped and never appeared. Postgres failed where the in-memory store passed, because the latter republishes on every boot.

v2026.08.14

Enhancements

Authorization server: her terms mark which prohibitions the enforcement point refuses outright — operation_mismatch and already_consumed — rather than presenting every line as equally a matter of trust.

v2026.08.13

New

Protocol: two optional requester-authored claims on the agreement — a stated reason and a cited mandate — recorded and shown to the owner, never judged. The requesting side previously had nowhere to say what it was asking for.
Authorization server: every ledger entry with a party to name is attributed, so a refused or denied exchange can be traced to an agent.

Bug fixes

Portal: requester-supplied strings were rendered unescaped.

August 17 2026

v2026.08.12

Enhancements

Docs: the assurance material split by subject — what an authority can verify, the owner's attention as a denial-of-service surface, revoking an operator rather than an agent, and a guide to writing rules.

v2026.08.11

Enhancements

Authorization server: the owner configures the attention budget and the assurance floors from her portal, rather than them being constants.

Bug fixes

Authorization server: assess() returned binding: 1 unconditionally. Every axis now starts at 0 and is raised only by a check that ran and passed in this negotiation.

v2026.08.10

New

Authorization server: agent assurance — three axes an owner's authority can establish about the asking agent (binding, provenance, accountability), readable by her rules without naming an agent. No level grants access; a strong showing can only stop a rule from firing.
Authorization server: a depth budget on the owner's attention, counted per lane, so a flood of anonymous agents cannot crowd out an attributable one.

August 16 2026

v2026.08.9

Enhancements

Docs: the owner's side described as it now works — a browser session or a signature from a key her own device holds. The walkthrough gains a route to the personal-AI demo.

v2026.08.8

New

Kwaai binding: Kwaai's pAI-OS runs in the lab from a pinned upstream ref, with the U4A ability installed in the layout it scans for. make paios, make paios-check, make paios-down, and the same three in Kubernetes.
Kwaai binding: it grants the tiers the owner gave standing consent to, and refuses an ask-me trade — an ability has no channel to reach its person.

v2026.08.7

New

Protocol: make flow-check — the same negotiation run four times with the requesting side arranged four ways: a bare key, an identified agent whose session key rotates, one described by a metadata document, one published in a key directory. Her terms, her grant and her policy come out identical.
Authorization server: an owner credential, so her authority accepts either a browser session or a signature from a key her own device holds.

August 15 2026

v2026.08.6

New

Docs: the documentation site, around thirty pages across overview, guides and reference.

August 14 2026

v2026.08.5

New

Kubernetes: a devcontainer, so the Kubernetes lab runs in a browser with nothing installed.

Bug fixes

Kubernetes: alice/uma-as and meridian/uma-pep need the waypoint label and no manifest carried it — both had been applied by hand, so a clean clone returned 6 of 13 smoke checks. Without the label the mesh judges the policy at L4, where it cannot read a path, and denies everything with nothing in any log naming a reason.

August 12 2026

v2026.08.4

Enhancements

Docs: the Kubernetes reference architecture on the site.

v2026.08.3

New

Kubernetes: the same source deployed on Kubernetes — six namespaces, one per party, each with its own workload identity, the authorization server replicated against a replicated database, and the cross-principal boundary enforced by a service mesh.
Kubernetes: make k8s-policy-test, asserting the refusals rather than only the allows.

August 11 2026

v2026.08.2

Enhancements

Kubernetes: the deployed shape brought up to the scale the claims need.

v2026.08.1

New

Enforcement point: ENFORCEMENT_MODE=gateway|embedded. The decision logic takes request facts and returns a verdict with no transport of its own, so the same core runs in a gateway or inside the resource server.
Protocol: the challenge is specified as parameters rather than a header — 401 + WWW-Authenticate: UMA where there is a status line, JSON-RPC -32001 carrying the same parameters where there is not.

Enhancements

MCP: aligned to the 2026-07-28 revision. The handshake moved to server/discover, sessions were removed, and client identity travels per request.

Feature deprecations

Registration: push registration removed from the main line. It remains conformant and is preserved on the legacy/rreg-baseline branch.

July 29 2026

v2026.07.1

New

Discovery: beat 0 split into two layers. A public RFC 9728 document names the tool surfaces, the owner's authorization servers and the signing keys; a protected owner-resources listing is served only to a querier that proves possession of the owner's authority key.
Registration: declarative pull registration — the resource server publishes, the authority fetches, verifies the signed metadata and materialises its registry.
Discovery: a second binding encoding at /.well-known/aauth-resource.json, with a content-addressed vocabulary. Both documents point at the same owner-resources endpoint.
Licensing: Apache 2.0.