Changelog

Release history

In development

absorb init generates a starting policy from a specification, with reads allowed, writes and administrative paths denied, and likely sensitive fields excluded.
Surface comparison, so a policy change can be reviewed as a delta in a pull request.
Per-agent and per-tool call limits, enforced at runtime and recorded in the audit log and metrics.

Released September 24, 2026.

The free Community edition: one production API, unlimited non-production APIs, and the same compiler and enforcement engine as the paid editions.
A Community build with approvals, delegation, metrics and the dashboard compiled out. It serves only with a Community license, which is always enforced at startup.
An "Absorb Community Edition" watermark on diff output and the HTML review report produced by the Community build.

Released September 24, 2026.

An environment setting on each API. Only production APIs count toward the license, and staging, development and test are reported separately.
Paid licenses are never enforced at startup. A deployment outside its entitlement logs a warning and is settled at renewal.
absorb license install replaces the license and keeps the previous file, and SIGHUP applies it without a restart.
Licenses can be signed by dated issuing keys, which a release can revoke. Existing licenses verify unchanged.
Signed releases with checksums verifiable using OpenSSL, container images that run as a non-root user, and an air-gap bundle for installations with no network access.
Builds per edition, where capabilities the configuration uses and the license does not include are refused at startup with a message naming them.

Released September 23, 2026.

Signed licenses recording edition, production API count, packs and expiry, with license show and a checksummed license report for renewals.
Capabilities compiled per edition. Approvals, delegation, metrics and the dashboard can each be left out, and a build names anything its configuration asks for but does not contain.
The absorb approvals command works without the dashboard.

Version	Highlights
0.8.0	Prometheus metrics and signed audit export to your collector
0.7.0	Conditions on arguments: claim binding, numeric bounds, enumerations, patterns, lengths and approval thresholds
0.6.0	Delegated identity through RFC 8693 or Microsoft on-behalf-of, and OIDC agent sign-in
0.5.0	Human authorization for sensitive writes, the administrative dashboard, several APIs in one process, and configuration reload
0.4.0	Swagger 2.0, `absorb lint`, the HTML review report, gateway configurations and validation against 4,130 public specifications
0.3.0	Upstream credentials at the boundary, agent authentication with per-agent scopes, the audit log and absorb probe
0.2.0	MCP server over streamable HTTP, SSE and stdio
0.1.0	The deterministic compiler, field-level projection and `absorb diff`

Send a specification. We will show the tools it produces, the operations it withholds, and the document your security function would review.