v0.5.0
Released September 23, 2026. Supported until March 23, 2027.
v0.5.0 ships 17 behavior changes, 4 security updates, 26 new features, 13 bug fixes, and 2 deprecations. Behavior between the management plane and the data plane changed in this release.
A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.
Click here to learn how to bring up the full release notes.
Upgrade and rollback
- No breaking changes. No operator action is required before upgrading.
- The upgrade rolls through without dropping traffic.
- Rollback to v0.4.1 is unconditional.
Behavior changes
Gateway
Budget spend and alert thresholds now exclude passthrough cost estimates; only managed and BYOK spend consume the limit.
Every global.observability.backends.custom[] entry must now say which signals it receives.
A guardrail provider the data plane cannot initialise no longer stops it from loading its guardrail configuration. Available once the data plane is on 0.5.0 or later.
Management plane API
Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope.
DeleteUserGroup now refuses with FailedPrecondition while the team still has members or is the target of an active budget policy.
ListUserGroups now returns InvalidArgument for a non-empty page.filter or an unsupported page.order_by instead of silently ignoring them.
ListRequestAttributes now accepts an optional search, returns unfiltered catalog stats, supports sorting by name, value_type or referencing_policy_count, and rejects unsupported page.filter or page.order_by values with InvalidArgument instead of ignoring them.
Audit entries from the management plane's services now record the call that produced them, source_ip, user_agent, http_method and endpoint, and name the user an action was performed on under the subject_user_id metadata key.
Listing and reading guardrail patterns now requires the guardrail_patterns.read permission or a scope that grants guardrail reads.
Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else.
Creating or updating a guardrail rule with the externalService configuration variant now fails with INVALID_ARGUMENT for every provider kind.
Auth
Single-organization auth deployments no longer require a corporate administrator to render; the first SSO sign-in becomes super_admin when none is named.
The auth chart no longer defaults RBAC_AUTH_DB_MODE.
tare CLI
tare install and tare upgrade now stop when the cluster's Gateway API CRDs are older than the version this release is tested against, rather than installing over them.
Consoles
The Admin Console's Patterns page now checks the guardrail_patterns permissions for creating, editing and deleting patterns, matching what the API enforces.
The Admin Console's Guardrail Providers page, sidebar entry and create, edit, delete and credential actions now check the guardrail_providers permissions instead of the broader guardrails ones, matching what the API enforces.
Guardrails
An externalservice guardrail provider now calls its guardrail service with the contract v1 request, so a service built for the earlier request shape, or one that answers only on /evaluate, stops working once the data plane is upgraded. Available once the data plane is on 0.5.0 or later.
Security updates
Gateway
Deleting a provider now removes its credential from the data plane. Available once the data plane is on 0.5.0 or later.
The data plane no longer accepts a guardrail provider's credential file path from the configuration it receives. Available once the data plane is on 0.5.0 or later.
Management plane API
Data plane upgrade operations require the data plane machine role or an effective dataplane_operator scope.
Creating or updating a guardrail provider now rejects the config key api_key_file, and the credential keys api_key and auth_token, under any spelling, with INVALID_ARGUMENT.
New features
Management plane API
PolicyService can explain which attribute-routing policy governs a key or tag preview.
Teams can now be managed end to end through PolicyService instead of the console's own database.
QueryAuditLogs and QueryPlatformAuditLogs accept subject_user_id, which selects the entries where a user was acted upon rather than the entries they performed themselves.
The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service.
Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session).
Administrators can sign a user out of every session through the management plane API, for example after lowering their role.
Signed-in users can change their own display name through the management plane API.
Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API.
The management plane now serves the RBAC read surface directly: a caller can resolve their own permissions at an organization or project, list the project ids they can reach, and read the deployment's permission catalog.
GetMe now returns session claims to a signed-in browser session: the caller's organization-level permission set and whether the deployment has an administrator.
Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified.
The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it.
The unified policy list now includes attribute-routing policies alongside the budget, rate-limit, fallback-chain and traffic-split rows, naming each policy's target, effective project, and monitor or enforce mode, and appearing only where the caller could read it directly.
You can now register and connect an MCP server whose OAuth provider issues public clients, which have no client secret.
Catalog audit entries now say whether a write came from a batch.
Consoles
The management API now accepts cookie-authenticated calls from browser origins on its allowlist, so a dashboard can talk to it directly across origins.
The Admin Console can now add and edit an external guardrail service provider.
Gateway
Gateway request tracing can now be turned on from Helm values.
Each observability destination now chooses what it receives.
AI request tracing can now stop recording the prompt, the completion and the invocation parameters: set global.observability.signals.traces.capture to metadata-only.
The data plane reads an Azure Content Safety guardrail provider's stored API key from its mounted credential and picks up a rotated key without a restart. Available once the data plane is on 0.5.0 or later.
Catalog sync
A management plane now records its catalog syncs, and tare api catalog status reports when the last sync ran, which published catalog version this plane is on, and how old that catalog is.
Guardrails
A guardrail provider credential now typically reaches the gateway within seconds of being set or rotated, with no restart and no traffic interruption. Available once the data plane is on 0.5.0 or later.
A guardrail provider of kind externalservice now connects your own guardrail service over guardrail service contract v1. Available once the data plane is on 0.5.0 or later.
At the output stage, an externalservice guardrail provider's request to your guardrail service also carries the user's prompt in an optional prompt field, so output checks such as relevance or groundedness can judge the response against it. Available once the data plane is on 0.5.0 or later.
tare CLI
tare api guardrails providers create and update take the provider as --provider, a JSON object in the API's shape, so a guardrail provider can be registered and enabled from the CLI.
Bug fixes
Management plane API
Scoped management API keys can now reach audit-log and metrics operations without organization or project fields.
Request log stats now report the full billed amount.
Fallback policies now keep independent ordered entries for each protected model and resolve project and organization policies, plus API-key policies, in the documented precedence order.
A request whose session lookup fails now answers with an internal error instead of 401.
Connecting an MCP server through a popup window now returns you to the tab you started from.
Revoking an MCP server's stored token now works for an OAuth client whose secret is held outside the database.
Gateway
Gateway requests now fail over through the configured model sequence when an eligible provider timeout, capacity, rate-limit or server failure occurs, while preserving the serving model and provider in the response and request log. Available once the data plane is on 0.5.0 or later.
The management plane no longer stops deploying routes for every provider when it cannot read one provider's credential.
A guardrail rule that redacts a model's response now sends the redacted response with a matching content length. Available once the data plane is on 0.5.0 or later.
Output guardrail checks that compare the response with the prompt, such as Azure Content Safety groundedness and relevance, and the prompt recorded on a guardrail trigger report now use the user's latest message. Available once the data plane is on 0.5.0 or later.
Data plane
The data plane now records the fallback steps it leaves out of a passthrough route: the controller log names the chain that was narrowed, the provider it left out, and why, instead of discarding that line through an unconfigured logger.
Consoles
Tools fetched for an MCP server that authenticates with OAuth 2.0 can now be saved.
Fetching tools for an MCP server whose OAuth client has no stored secret now reports why it failed, instead of an empty server error.
Deprecations
Management plane API
The microdollar cost fields are deprecated.
The externalService variant of a guardrail rule's configuration is deprecated: nothing reads it, and its headers were never sent as HTTP headers.