Docs
Open the console →
Help

Release notes

Cloud Control release notes: the shipped rounds — SSO and login hardening, the cloud connections engine, RBAC and API tokens, and the FinOps core — plus what's in progress.

Cloud Control ships in rounds, each landing with an extended end-to-end test suite. These notes summarize what is real today and what is next.

R4 — FinOps core (2026-07-19)

  • Billing ingestion normalized to the FOCUS standard for all four clouds, reconciling to source to the cent.
  • Spend by cloud, service and tag with an explicit untagged bucket; a daily trend.
  • Budgets with ok / warn / breached evaluation.
  • Statistical anomaly detection (mean + 3σ over the trailing 28 days) with full attribution, audited once.
  • New endpoints: GET /api/finops/cost, POST /api/finops/ingest, GET/POST /api/finops/budgets, PATCH/DELETE /api/finops/budgets/{id}.

R3 — RBAC, ownership & API tokens

  • A fixed role-to-capability model enforced on every mutation with honest, audited 403s.
  • Capabilities recomputed per request, so downgrades bite without re-login.
  • Organization ownership: first registrant is owner; MFA-gated transfer.
  • cc_pat_… API tokens with a role ceiling, expiry, one-time secret, last-used tracking and revocation.

R2 — Cloud connections engine

  • Real AWS (STS AssumeRole + SigV4) and GCP (workload identity federation + Asset Inventory) adapters.
  • Health checks with exact missing permissions; non-destructive disconnect; duplicate detection.
  • A sync engine driven by cron, connect-kick and on-demand passes, with token buckets, delta cursors and soft-delete reconciliation.
  • The empty-to-real cutover with per-section provenance and freshness.

R1 — SSO & login hardening

  • OIDC bring-your-own identity provider: per-org config with discovery, an encrypted client secret, PKCE (S256), RS256 ID-token verification and JIT provisioning.
  • The 5-attempt login lockout (and MFA-code cap), enumeration-safe and audited.
  • TOTP MFA with one-time recovery codes; enumeration-safe password reset.

In progress & on the roadmap

Next up is a monitoring and alert-rule engine, followed by network reachability, a real pipelines runner, a Terraform/OpenTofu engine, and SAML/SCIM. See Preview & roadmap features for the honest status of each surface.