api-v1.4.0

[1.4.0] - 2026-07-27

Added

• Custom roles and permission-based access control — The API now supports custom roles — each can be named, granted a specific set of permissions, and given its own members. Access to every protected part of the API is now fully driven by a permission engine and a security classifier. Role changes require an MFA confirmation and are written to an audit record. (PR #100)

Changed

• ⚠ BREAKING: Tier level is now categorized by ordinals — Endpoints for access management now emit access role ordinals. Clients consuming the field will require a configuration update. (PR #100)

Security

• Role changes now take effect immediately — When a user's role changes, their existing sessions lose the old level of access straight away and the old cache is immediately invalidated at the infrastructure level. (PR #100)