Skip to main content

Release 0.5.33 — Caller Tool Authorization and Team Membership Performance

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-30 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.33 Previous release: 0.5.32

Highlights​

0.5.33 adds configurable caller-tool authorization to the OpenFGA authz bridge subchart and eliminates redundant OpenFGA tuple rewrites on every resource save, significantly reducing write load for deployments with large teams.

What's New​

Configurable caller tool authorization in OpenFGA authz bridge​

The openfga-authz-bridge subchart now exposes a callerToolCheck.enabled flag. When enabled, the bridge enforces per-caller tool authorization checks through OpenFGA before routing tool calls. This gives platform operators fine-grained control over which callers may invoke which tools without modifying agent configuration. (#2093)

Bug Fixes​

  • Redundant team membership tuple rewrites eliminated: On every resource save, the platform was unconditionally rewriting all membership tuples for the resource's owning team, even when membership had not changed. For teams with many members this caused unnecessary OpenFGA write load and latency. Membership tuples are now only written when they actually change. (#2077)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.32.

Upgrade Guide: 0.5.32 → 0.5.33​

No values changes required for existing deployments.

To enable caller tool authorization, add to your values:

openfga-authz-bridge:
  callerToolCheck:
    enabled: true
helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.33 \
  -f your-values.yaml

Verify:

kubectl get pods -n <namespace>