Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — August 7, 2026

Release Date: August 7, 2026
Release Type: Mixed (New Features, Improvements, Bug Fixes)

Overview​

This release wires up a new post-quantum widget, adds a safer way to re-issue onboarding invitations, and makes the organization risk score consistent everywhere it appears:

  • Algorithm Posture Matrix — a new widget classifying your cryptographic algorithms by post-quantum posture, per category, now driven by your actual inventory.

  • Regenerate onboarding link — administrators can invalidate and re-issue a user's onboarding magic link and security code in one action.

It also makes AI chat answers more dependable (deterministic data tools, phrasing-independent routing, no more half-finished replies), and fixes problems in identity merge, onboarding links, audit logging, risk score display consistency, post-quantum reporting accuracy, and compliance risk attribution.

New features​

Algorithm Posture Matrix​

A new widget classifies the cryptographic algorithms found across your estate by post-quantum posture — per algorithm category — so you can see at a glance which parts of your inventory rely on quantum-vulnerable cryptography.

What you get:

  • Posture is computed from your actual asset inventory, not estimates, and algorithm categories that cannot be classified are surfaced explicitly as an Unclassified tile instead of being dropped.

  • The matrix is available in the widget catalog for your workspaces and dashboards.

Why it matters: post-quantum migration planning starts with knowing which algorithm families you actually run. The matrix turns that inventory into a single view you can report on.

Administrators can now regenerate a user's onboarding invitation from the admin UI.

What changed:

  • Regenerate link invalidates the user's previous magic link and security code, then issues fresh ones — the old link stops working the moment the new one exists.

  • The previous Resend action, which re-sent the original link, has been removed in favor of the safer invalidate-then-issue flow.

Why it matters: re-sending an old link keeps a potentially exposed credential alive. Regeneration guarantees exactly one valid invitation at a time.

Risk re-evaluation​

Risk for already-ingested entities can be re-evaluated on demand, with re-evaluation traffic scoped per entity so one organization's re-evaluation cannot interleave with another's.

Improvements​

More dependable AI chat answers​

  • Asset questions in AI chat are answered through deterministic, scope-fixed data tools, so the same question returns the same grounded answer — and when the data cannot support an answer, the assistant says so instead of guessing.

  • Tool selection no longer varies with how a question is phrased.

  • When a streamed reply is interrupted, the chat now finalizes the partial text instead of leaving a hanging bubble.

Bug fixes​

Identity merge could strand users on a deleted identity​

Merging identities could leave user accounts attached to the identity that was removed by the merge. Merges now re-home affected users onto the surviving identity.

  • A magic-link session could expire long before its advertised lifetime; link lifetime now matches what the invitation promises.

  • Signing in separately in the same browser during onboarding — for example, to test a newly configured identity provider — could cut the onboarding session short. Onboarding sessions are now kept separate from regular sign-in sessions, so the two no longer interfere.

  • When link issuance failed, the failure was silent; issuance is now retried and the real failure reason is shown in the admin UI.

Audit log write reliability​

Monthly maintenance of the audit store did not always prepare storage for the current month ahead of time, which could cause audit writes to be rejected. Maintenance now runs at startup as well as on demand, always covers the current month, and reports a failure instead of retrying against the same gap.

Post-quantum reporting under-counted​

  • The Algorithm Posture Matrix could under-report significantly: a fixed inventory cap truncated large estates alphabetically, and algorithm signatures that didn't match a known pattern were silently dropped. Both are fixed; unmatched algorithms now appear as Unclassified.

  • The quantum-vulnerable and compliance-status widgets received correctness and performance fixes, and "Owner assigned" drill-downs no longer list assets without an owner.

Organization risk score displayed inconsistently​

The organization risk score could read differently depending on where you looked: AI chat derived its own value instead of using the server-computed score, and raw internal magnitudes could leak into the display. The dashboard, the tenant overview, and AI chat now all present the same bounded, display-ready score with day-over-day movement, computed once on the server.

Compliance risks attributed to the wrong organization​

Compliance risk results produced while evaluating one organization's assets could be stamped with the policy owner's organization instead of the asset owner's. Results are now attributed to the organization that owns the evaluated asset.

Admin actions ran against the wrong tenant​

Triggering a risk re-evaluation from the admin portal acted on the logged-in tenant rather than the selected one. The selected tenant is now sent explicitly and the UI shows which tenant the server acted on.

Assorted fixes​

  • Top 10 Identity Risks → Remediate via chat no longer fails with an unexplained error.
  • The agent list no longer renders empty when agents exist.
  • A partially failing dashboard data response is now surfaced as an error instead of rendering as "no data".
  • An unknown correlation seeding status no longer blanks the admin tenant page.
  • Gateway proxy errors are logged with enough detail to diagnose upstream failures.