What changed.

May 2026

1. SecurityMay 14

   MFA step-up authentication for gate approvals

   TOTP-based MFA now required for gate approvals and policy publish when enrolled.

2. ReliabilityMay 14

   OpenTelemetry distributed tracing

   FastAPI Core API now exports OTLP spans. Dashboard propagates W3C traceparent.

3. EnterpriseMay 13

   Per-workspace SLA enforcement + reviewer efficiency dashboard

   Configurable warn/breach thresholds. Auto-escalation. /sla dashboard with daily trend.

4. SecurityMay 12

   Complete workspace RBAC + tenant isolation audit

   All 163 API routes now enforce workspace membership. Tenant isolation view covers 24 tables.

5. ReliabilityMay 11

   Redis pub/sub replaces SSE polling

   Notification bell now uses Upstash Redis pub/sub. Scales to 1000+ concurrent users.

6. EnterpriseMay 10

   Reviewer decisions appended to tamper-evident audit chain

   Every gate approve/reject now writes a SHA-256 chained audit row.

7. FeatureMay 8

   Policy simulation studio + compare mode

   Drag-and-drop bundle composition, balanced vs strict comparison, Copy for demo button.

8. FeatureMay 7

   AI SDR Guardrails policy pack

   Pre-built bundle: pricing hallucinations, competitor mentions, tone violations.

9. FeatureMay 5

   Stripe billing + bundle subscription lifecycle

   Checkout, metered usage, grace window, reactivation — all idempotent.

10. ReliabilityMay 1

    Approval queue cursor pagination + real-time updates

    Queue now uses (created_at, id) cursor pagination. Replaced LIMIT 200 hard cap.