This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+2 more
Affected surfaces
ReleasePort's take
Light signalRelease v2.50.0 adds role‑based access control (RBAC) with 20 predefined roles, limiting operators to their verticals and hiding Build controls in the console while preserving full admin privileges.
Why it matters: RBAC enforces per‑vertical permissions for API endpoints and Operate UI; admins retain unrestricted access. Operators now see only relevant cases and actions.
Summary
AI summaryRBAC now restricts operators to their verticals and hides Build controls, while admin retains full access.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds RBAC with 20 roles restricting API and console actions per vertical. Adds RBAC with 20 roles restricting API and console actions per vertical. Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Feature | Medium |
Hides Build and 'Start a run' in console for operator roles. Hides Build and 'Start a run' in console for operator roles. Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Feature | Medium |
Restricts start picker to role's verticals in the console. Restricts start picker to role's verticals in the console. Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Feature | Medium |
Adds case-detail drawer with step trace, owner, progress, audit trail, and JSON export. Adds case-detail drawer with step trace, owner, progress, audit trail, and JSON export. Source: llm_adapter@2026-06-07 Confidence: high |
— |
| Bugfix | Medium |
Enforces RBAC so BSA officer cannot see or sign rcm cases outside its vertical. Enforces RBAC so BSA officer cannot see or sign rcm cases outside its vertical. Source: llm_adapter@2026-06-07 Confidence: high |
— |
Full changelog
Does the CTO need the admin board? No — the Operate console is the operational staff's surface (the licensed humans who sign). The CTO/admin builds in the CLI and oversees; only admin may switch to Build.
- RBAC (
scripts/lib/roles.mjs, 20 roles) — an operator role (coder · BSA officer · customs broker · CPA · QPPV …) only sees and signs the cases for its own vertical(s);compliance-leadsees every queue but can't Build;admindoes everything. Enforced on the API: runs are role-filtered and approve/reject/start return 403 outside a role's verticals. - Console — role picker scopes the queue, hides Build + 'Start a run' for operators, restricts the start picker to the role's verticals.
- Case-detail drawer — click a run → full step trace · accountable owner · multi-gate progress · audit trail · ⬇ Export audit (JSON).
276 lib tests (verified: a BSA officer can't see or sign an rcm case).
Breaking Changes
- Operator roles now see only cases within their assigned verticals; approve/reject/start actions return 403 outside those scopes.
- Build functionality and 'Start a run' are hidden from operator roles in the Operate console.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About great_cto
Engineering-management layer of 34 specialist AI agents covering the full SDLC (architect, PM, senior-dev, reviewer, QA, security, devops, L3-support + 18 archetype-specific reviewers) with auto-detected archetypes and compliance gates (PCI-DSS, HIPAA, FedRAMP, GDPR, EU AI Act). Runs in Claude Code, Cursor, Codex CLI, Aider, and Continue via AGENTS.md + MCP. MIT.
Related context
Related tools
Earlier breaking changes
- v2.72.2 Removes Autopilot sidebar item and Operate topbar button from dev board.
- v2.55.0 Hard-gates the Build board; redirects invite sessions to Operate for operators.
- v2.43.0 Runtime now blocks autonomous execution of irreversible actions without prior human checkpoint.
- v2.43.0 Adds reversible and blastRadius fields to every flow step.
- v2.32.0 Removed AgentShield scanner and its CLI commands.
Beta — feedback welcome: [email protected]