# Identity Mesh — September 2, 2026 **Release Date**: September 2, 2026 **Release Type**: Mixed (New Features, Improvements, Bug Fixes, Security Fixes) ------------------------------------------------------------------------ ## Overview This release connects the Mesh assistant to tools you host, lets it build live data tables on demand, introduces a guided Okta connector setup, and brings a new Settings experience for managing connectors, identity providers, and logs. - **External tool servers** — register MCP servers you host, approve the tools the assistant may call, and review every call it makes on your behalf. - **Live tables in the workspace** — ask for "a table of the riskiest service accounts" and the assistant composes a live table widget from your data. - **Guided Okta connector setup** — a five-step wizard with a connection test before you continue. - **New Settings experience** — connectors, identity providers, MCP servers, external agents, and logs managed from one consistent place. ------------------------------------------------------------------------ ## New features ### External tool servers for the assistant You can now register MCP servers that you host and let the Mesh assistant use them. Tenant administrators add a server from **Settings → MCP servers**, choose which of its discovered tools the assistant may call, and mark whether each tool only reads data or can change it. **What you get:** - **A guided setup.** Connect, authenticate, discover the server's tools, pick the ones you want to allow, and save. The connection is tested before you can grant tools. - **Attributed answers.** When the assistant uses one of your tools, the answer says which server it came from. Results from external servers are never persisted in Mesh. - **Safety controls.** Tools that change data are held to a stricter grant, and a server marked read-only cannot be given a data-changing tool. - **Large catalogues.** The tool picker scales to servers exposing hundreds of tools. - **Usage logs.** Every external call the assistant makes is recorded with the server, the tool, and the user who asked. Per-server logs and a summary view are available under **Settings → Logs**. **Why it matters:** the assistant can now answer from systems Mesh does not ingest — a ticketing system, an internal knowledge base, a vendor console — without that data being copied into Mesh, and with an audit trail of what was asked and where. To get started, see [Connect an external MCP server](/docs/admin-guide/external-mcp-servers). ### Live data tables in the agentic workspace When you ask the assistant for a data set that no curated widget covers — "show me the riskiest service accounts", "a table of non-human identities by owner" — it now composes a live table widget on the canvas instead of answering with an inline chat table or substituting an unrelated summary widget. - The table is bound to your live data and refreshes like any other widget. - Columns are taken from the underlying data set. - An empty result is shown as an empty table with an explanation, not as an error. This release ships the first such data set, non-human identities (service accounts and similar principals). Further data sets will follow. See [Generative UI](/docs/user-guide/generative-ui). ### Guided Okta connector setup Setting up an Okta connector is now a five-step wizard — **Connection, Authenticate, Collection, Tuning, Review** — instead of a single long form. - **One action per step.** Later steps stay locked until the current one is complete. - **Authenticate the way you already do.** Choose an API token or a service-app key; only the fields for the method you picked are shown. The step lists what to set up on the Okta side alongside what to enter in Mesh. - **Test before you continue.** The connection test must pass before you can go on. If a token is missing one of the read scopes the connector needs, the step names the missing scope. - **Paste your Okta URL.** You can paste your Okta admin or preview-domain URL and Mesh derives the organization from it. - **View mode.** An existing connector opens read-only in the same layout, so what you review matches what you configured. See the [Okta connector](/docs/connectors/idp/okta) page for prerequisites and capabilities. ------------------------------------------------------------------------ ## Improvements ### A new Settings experience Connectors, identity providers, MCP servers, external agents, and logs now live in one consistent Settings area with a shared look and feel. - Manage every integration type from the same tables, forms, and dialogs. - Connector health is clearer: a connector you deliberately **stopped** is now shown differently from one whose state is **unknown**. - Settings for the agentic workspace are available to administrators. ### Pagination and page-size controls in the audit log The audit log now offers page-size controls (100 or 1,000 rows per page) and page navigation, including jumping directly to the last page. See [Audit logging](/docs/admin-guide/audit-logging). ### On-prem connector management - The connection-test result is easier to read and can be collapsed. - The agent detail panel can be resized. - The ingestion runs table has a refresh control. See [On-prem connectors](/docs/connectors/on-prem/). ### Faster re-evaluation on large tenants Tenant-wide risk re-evaluation and compliance evaluation place less load on the database, so large tenants complete re-evaluation more predictably. ------------------------------------------------------------------------ ## Bug fixes ### Connector sync frequency was not always applied The sync frequency configured for a connector is now applied on every schedule refresh. Previously a connector could continue on its default schedule, and a connector that was still initializing could have its next run repeatedly postponed. Connectors whose sync has stopped are now shown as stopped in Settings. ### SBOM project identifiers were hidden when they looked like UUIDs The **SBOM Projects** field in the asset detail panel did not display project identifiers that were UUID-shaped, even though the value was correct. The field now shows them. ### Compliance grading - An algorithm that no policy rule classifies is no longer reported as **Compliant** and does not count towards the compliant total. - Compliance templates scoped to one tenant are now evaluated only for that tenant. - Disabling a compliance template now takes effect at run time. - A tenant can create more than one user compliance program. See [Prove continuous compliance](/docs/use-cases/prove-continuous-compliance). ### Universal REST connector ignored required request headers When a connector was generated from an OpenAPI specification, header parameters declared in the specification were not carried into the generated template, so APIs that require a protocol header on every request failed. Header parameters are now applied, and the wizard has a **Custom request headers** section for headers you need to add yourself. See [Universal REST connector](/docs/connectors/universal-rest). ### Re-correlation warning overstated what is deleted The confirmation dialog and consent statement said that re-correlating deletes every existing correlation. Correlations you asserted or confirmed are preserved; only engine-generated links are rebuilt. The wording now says which links are kept. See [Manage the correlation engine](/docs/admin-guide/correlation-engine). ------------------------------------------------------------------------ ## Security fixes - **CVE-2026-56854** — updated the Go cryptography library across the platform. - **CVE-2026-84304** — updated the gRPC library across the platform. - **CVE-2026-46600** — updated the Go networking library across the platform.