Skip to main content

Release 0.5.56 — Insights RBAC Scoping and AD Group Sync Filtering

Sri Aradhyula
Sri Aradhyula
Sunny Whang
Sunny Whang
Erik Lutz
Erik Lutz

Released: 2026-07-21 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.56 Previous release: 0.5.55

Highlights​

0.5.56 tightens who can see what in Admin Insights: non-admins now only see data for resources they own, with a new agent filter to narrow further. Operators syncing Active Directory / OIDC groups into CAIPE teams can now include or exclude specific groups by regex instead of syncing every group a user belongs to. The MCP tool picker in the admin lab is now a searchable combobox instead of a plain dropdown, and two unreliable Insights stats (self-resolution, estimated hours saved) have been removed.

What's New​

Admin Insights: owner-scoped visibility and agent filter​

  • Non-admin users now see Insights data only for resources they own — their readable Slack channels, their own web conversations, and agents they manage. Admins continue to see everything.
  • A new agent filter dropdown lets any user narrow Insights down to a specific agent; non-admins only see agents they own in the list.
  • Web chats now show up in the Top Agents leaderboard alongside Slack activity.

(#2209)

AD / OIDC group sync filtering​

Two new environment variables control which Active Directory groups get synced into CAIPE teams from the OIDC member_of claim:

  • OIDC_GROUP_INCLUDELIST — comma-separated regex patterns; only matching groups are synced. Unset means all groups are included (no change from prior behavior).
  • OIDC_GROUP_EXCLUDELIST — comma-separated regex patterns; matching groups are dropped, and any existing team membership from an excluded group is actively removed on the user's next login.

Both lists can be combined — includelist is applied first, then excludelist.

(#2237)

Service accounts: full org-admin visibility​

Org admins can now see, search, and page through all service accounts in the platform, not just ones belonging to their own team.

Searchable MCP tool picker​

The MCP tool picker in the admin lab is now a searchable combobox instead of a plain <select>, making it usable when a tool list is long.

Bug Fixes​

  • insights: removed the "self-resolution" and "estimated hours saved" stats — both were unreliable heuristics (guessing whether a thread was resolved by a human reply, then multiplying that guess by arbitrary time constants) presented as facts on the dashboard. (#2256)
  • agent context: fixed a timing issue where a signed agent-context grant for an MCP tool caller could be revoked before the caller had a chance to use it.

Security​

  • Shortened the local-context grant TTL used by the OpenFGA authorization bridge to 8 hours and corrected the audit object recorded for these grants.
  • Scoped down the GitHub App token used by the prebuild artifact-comment CI workflow to only the permissions the reconciler script actually needs (flagged by static analysis as over-broad). (#2250)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.55.

Known Issues​

None known at this time.

Upgrade Guide: 0.5.55 → 0.5.56​

Overview​

Drop-in upgrade — no values.yaml edits required. The Helm chart's default values are unchanged between 0.5.55 and 0.5.56.

Helm Values Changes​

No Helm values changes between 0.5.55 and 0.5.56. Drop-in upgrade.

Upgrade Runbook​

1. Update chart version​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.56 \
  -f your-values.yaml

2. Optional: configure AD group sync filtering​

If you want to limit which AD/OIDC groups sync into CAIPE teams, set one or both new env vars on the UI deployment:

env:
  OIDC_GROUP_INCLUDELIST: "^caipe-.*,^platform-.*"
  OIDC_GROUP_EXCLUDELIST: "^contractors-.*"

Leaving both unset preserves existing behavior — no action required to upgrade safely.

3. Verify​

kubectl get pods -n <namespace>

Personal Impact Analysis​

No values.yaml changes are required. If you rely on the Insights "self-resolution" or "estimated hours saved" cards, note that they are removed in this release and will no longer appear on the Admin Insights dashboard.

Full Values Diff​

No diff — values.yaml is identical between 0.5.55 and 0.5.56.