# Identity Mesh — September 22, 2026 **Release Date**: September 22, 2026 **Release Type**: Mixed (New Features, Improvements, Bug Fixes, Security Fixes) ------------------------------------------------------------------------ ## Overview This release adds a headline post-quantum readiness score, brings credential inventory from Axiad Conductor into Mesh, and fills in the identity and risk context the dashboard was missing: - **PQC Readiness Index** — a single composite score for post-quantum readiness, computed from data you already have. - **Conductor connector** — ingest identity and credential inventory from Axiad Conductor through the connector setup you already use. - **Identity Profile panel and a Top 5 Risks by ALE card** — manager, job title, source and group context on an identity, and the ranked loss-exposure view with drill-down. It also lets you change a widget's chart type from the assistant, and fixes a group of defects in connector setup, tenant settings and dark web reporting — along with three security fixes. ------------------------------------------------------------------------ ## New features ### PQC Readiness Index A single headline number for post-quantum readiness — the figure that belongs on a board slide — now appears as an overview widget, computed from your existing inventory rather than requiring new data collection. ### Conductor connector Identity and credential inventory from Axiad Conductor can now be ingested into Mesh through the existing connector setup experience. Supply your Conductor base URL and a supported token, and the credentials Conductor manages are correlated alongside every other connected system — so credential risk, post-quantum readiness and compliance posture cover them too. ### Identity Profile panel The identity detail page gains a side panel showing the context that was previously missing from the screen: the person's manager — clickable, resolving to that manager's own identity — their job title, the source the record came from, and the groups they belong to. ### Top 5 Risks by ALE A dashboard card ranks your top five risks by annualized loss exposure, and each row expands into the existing blast-radius drill-down, so the ranked list and the detail behind it are one step apart. ### Change a widget's chart type A widget can now be redrawn as a different visualization — a table as a pie chart, a bar chart as a line — keeping its data, filters and position. Ask the assistant, or use the widget's edit panel. ------------------------------------------------------------------------ ## Improvements ### Collection frequency for ServiceNow CMDB The ServiceNow CMDB connector form now exposes a collection frequency, so you can set how often it runs without asking support to change it. ### Gen AI canvas A single widget can be exported from the canvas, including when its result set is empty, and a group of rough edges found on the canvas have been smoothed out. ### External agent confirmations Confirmations for external tool actions now use the same confirmation card as agent-to-agent actions, so an action awaiting your approval looks the same wherever it came from. A confirmation is never replayed automatically after an ambiguous failure — Mesh asks again rather than risk repeating an action. ### Branded sign-in error pages The error pages shown during sign-in now carry Axiad branding, matching the sign-in page itself instead of a generic default. ### Clearer failure breakdown The failure breakdown drawer no longer advertises an affected-identities list and an export control that were not available. Both were placeholders; the drawer now shows only what it can deliver. ------------------------------------------------------------------------ ## Bug fixes ### Returning to the setup wizard from a magic link During onboarding, following a magic link after starting identity provider configuration led to the provider's own sign-in page — which could not be completed, because the provider was not configured yet. The link now returns to the wizard. ### Agentic AI inventory widget reported a permanent empty state as a refresh The widget showed "Data refresh in progress" in tenants where it had no data at all and never would, presenting a permanent empty state as a temporary one. ### Test Ingestion failed in the connector wizard Test Ingestion could fail outright for a generic connector configuration, blocking setup at the final step. ### Tenant details edits appeared to save and then reverted Editing a tenant's industry or company size appeared to succeed with no error, but reopening the panel showed the previous value. The write had actually succeeded — the read was returning stale data. Both now agree. ### Dark web breach lists stopped short The all-breaches view offered to show up to 200 records while the data behind it was capped at 100, so the higher limit could never be reached and the list looked complete when it was not. The limits now match. ### HRIS connector failures all read as "System error" Every failure on an HRIS connector reported the same message regardless of cause, so an expired credential, a denied permission and an unreachable provider were indistinguishable. Failures now report the specific reason, matching how other connectors already behaved. ------------------------------------------------------------------------ ## Security fixes ### Connector templates exposed internal engineering commentary Connector templates served to signed-in dashboard users carried internal engineering notes in an editable field in the connector wizard. The content has been removed from the templates. ### Credentials could be written to logs Creating an integration through one connector wrote the request body to the service log at information level, and that body carried the credentials supplied for the target system. Request bodies are now redacted before they are logged. ### Hardened confirmation checks for external tool actions Confirmation handling for external tool and agent actions now fails closed when the calling identity cannot be resolved, and a confirmation is bound to the tenant and user it was issued for, so an approval cannot be used outside the context it was granted in.