v2.2.9

What's Changed

Aivory 2.2.9 introduces layered access control across user groups, workspaces, individual knowledge bases, tools, and active chat sessions. Administrators can now decide which prompts, skills, tools, MCP services, and product capabilities each user group may use. Workspace owners can govern what each member may create or manage, while knowledge-base owners gain explicit read and write sharing with ownership-aware file controls. The chat composer also adds faster knowledge-base attachment through @, a clearer tool-selection workflow, and immediate UI reconciliation when access changes.

User Groups and Fine-Grained Access

• Reworked the user-group editor into four focused tabs: Plan, Quotas, Permissions, and Users, keeping the existing modal workflow while separating unrelated settings.
• Added a searchable, paginated group-member view with name and email filtering, total counts, and 20 users per page.
• Added three-state access policies for administrator-managed prompts, skills, and tools: all resources, selected resources, or no resources.
• Added searchable resource catalogs and selected-item counts so large prompt, skill, tool, and MCP inventories remain manageable inside the modal.
• Added independent user-group permissions for conversation sharing, knowledge-base access, personal knowledge-base sharing, file uploads, conversation export, voice recognition, memory, and drawing.
• Made knowledge-base sharing a dependent capability of knowledge-base access. Disabling knowledge bases also disables sharing instead of retaining a contradictory hidden setting.
• Preserved backward compatibility by granting the existing capability set to legacy groups whose stored permission object is empty or missing.
• Kept administrator accounts exempt from user-group restrictions while continuing to enforce instance-wide administrator master switches.
• Applied temporary group expiration before resolving permissions, so an expired plan cannot retain access until the next profile refresh.
• Added authorization-safe normalization for imported or stale group policies, including invalid modes, duplicate IDs, removed catalog entries, and contradictory capability combinations.

Knowledge Bases and Sharing

• Added a first-class knowledge-base action in the chat composer and an @ mention menu for attaching an accessible knowledge base without leaving the conversation.
• Added a clear user-group error when knowledge-base access is unavailable. The restriction applies equally to personal, project, workspace, and user-shared knowledge bases.
• Removed embedding-model selection from the user experience. New knowledge bases always use the enabled embedding model configured by the administrator.
• Prevented clients from overriding the embedding model in a create request, keeping embedding configuration under administrator control.
• Added personal knowledge-base sharing with read-only and upload-enabled roles.
• Added an owner-only sharing manager with user search, current-share listing, role changes, and share removal.
• Allowed upload-enabled collaborators to add files and to rename, retry, or delete only the files they uploaded themselves.
• Prevented collaborators from deleting another user's files or deleting the shared knowledge base itself.
• Kept the knowledge-base creator authoritative over every file, failed ingestion, share record, and knowledge-base setting.
• Revoked stale conversation selections when a share is removed, so later turns cannot continue using a knowledge base that is no longer authorized.
• Added share-revocation checks around active knowledge-base generation and document operations.
• Prohibited sharing workspace and project knowledge bases, which continue to use their own membership and scope models.
• Prevented a personal knowledge base shared by another user from being copied into a workspace.
• Expanded the knowledge-base file view with filename search, uploader filtering, upload identity, online preview, rename, retry, and ownership-aware delete actions.
• Applied the same file filtering and preview workflow to workspace knowledge bases.
• Added explicit capability metadata to knowledge-base responses so the interface can distinguish share, upload, delete, content-management, and member-management rights without inferring them from ownership labels.

Workspace Governance

• Added workspace-wide member permissions for project creation, private conversations, knowledge-base creation, knowledge-base file uploads, and knowledge-base content deletion.
• Moved all workspace-member permission controls into the existing member list, where the workspace owner can edit each member without opening a separate administration page.
• Granted the complete workspace permission set to newly joined members by default, preserving the behavior of existing workspaces until an owner intentionally restricts a member.
• Kept the canonical workspace owner permanently authorized for all workspace capabilities.
• Made new workspace conversations private by default when the member has private-conversation permission.
• Fell back to a public workspace conversation when the member is not allowed to create private conversations.
• Enforced project-creation and knowledge-base-creation permissions in both the interface and the server handlers.
• Added per-knowledge-base member permissions for adding files and deleting content inside standalone workspace knowledge bases.
• Kept per-knowledge-base permissions separate from workspace-wide member permissions. A library-level grant cannot exceed the member's workspace-wide ceiling.
• Allowed the workspace owner and the current knowledge-base creator to manage the knowledge base's member list and all of its content.
• Locked owner and creator rows in the per-knowledge-base permission editor so their required management access cannot be accidentally removed.
• Reconciled workspace navigation when membership or permissions change, including safe fallback from workspace-only routes and private drafts.

Tools, MCP, Memory, and Drawing

• Moved tool selection inside the Tool Calls control instead of presenting Tool Selection as a separate peer action.
• Removed the Auto, On, and Off mode label from the Tool Calls summary. Clicking the control now opens the actual tool selector directly.
• Reinterpreted the built-in tool choices on a model as that model's default selection rather than an immutable user allowlist.
• Added an explicit distinction between model defaults and a user-selected empty list, allowing users to clear every optional tool for a turn.
• Allowed users to manually select any tool that remains available globally and to their user group, even when it is not part of the model's default set.
• Displayed user-group-restricted tools in the selector as unavailable so users can understand the restriction without being able to select or invoke them.
• Kept administrator tool and MCP availability controls as instance-wide master switches. Globally disabled tools are removed from catalogs, model requests, and runtime execution.
• Added a final runtime permission check immediately before built-in or MCP execution, closing the window where a tool could be disabled while a model was deciding to call it.
• Removed the memory tool entirely when memory is disabled globally or for the current user group. It is never shown as a disabled selectable item.
• Applied skill policy to prompt injection, automatic routing, fallback models, explicit skill selection, and final tool execution.
• Hid image models, image styles, image-generation controls, and the sidebar drawing entry when drawing is unavailable.
• Rejected direct image-generation and drawing-tool requests on the server even if a stale client still submits them.
• Guarded the composer against a model that becomes unavailable after a permission update and required the user to select an accessible model before sending.
• Removed voice controls when voice recognition is unavailable while preserving the normal send action.
• Added server-side checks to recorded transcription, streaming transcription, and capability discovery endpoints.

Upload, Export, and Sharing Controls

• Applied file-upload permission to chat attachments, drag and drop, clipboard files, long-text conversion, project files, and writable knowledge-base uploads.
• Removed upload inputs and actions when permission is unavailable instead of leaving controls that fail only after selection.
• Added cancellation and reconciliation for uploads already in progress when upload permission is revoked.
• Rechecked upload permission after the server accepts a file so a mid-request revocation cannot leave an unauthorized attachment in the active draft.
• Applied conversation-export permission to single-response and account-level export actions.
• Applied conversation-sharing permission to share-link creation, inspection, and removal endpoints as well as their interface actions.
• Added stable, localized permission errors for knowledge bases, uploads, voice, memory, drawing, sharing, export, prompts, skills, tools, and workspace operations.

Live Authorization and Revocation Safety

• Added a shared permission snapshot and epoch system for user, group, workspace, knowledge-base, and global capability changes.
• Published permission changes across application instances and refreshed affected clients through the existing realtime event channel.
• Reconciled open prompt, skill, tool, model, knowledge-base, workspace, upload, and voice state as soon as access changes.
• Added generation watchers so active turns stop using revoked knowledge bases, skills, tools, MCP services, memory, drawing, or workspace access.
• Re-read current permissions at API boundaries instead of trusting the permission data embedded in an older authentication response.
• Enforced knowledge-base ownership, share roles, workspace membership, file ownership, and member capability ceilings in SQL-backed authorization paths.
• Added fail-closed behavior for permission lookup errors, malformed policies, stale selections, deleted catalog resources, and cross-scope resource IDs.
• Added revocation coverage for group changes, direct user updates, temporary plan expiration, global tool switches, memory settings, workspace membership, and knowledge-base shares.

Administration and Operational Reliability

• Added permission catalogs that combine administrator prompts, administrator skills, built-in tools, hosted tools, and configured MCP services under stable resource IDs.
• Updated model administration copy to explain that model tool settings define defaults and that global availability remains authoritative.
• Improved administrator tool and MCP loading failures so an unavailable catalog does not silently overwrite the current server configuration.
• Extended configuration backup and restore support to the new user-group policy, knowledge-base shares, workspace member capabilities, and per-knowledge-base member permissions.
• Preserved permission and quota behavior across user-group assignment, payment-driven group changes, redeem codes, and group expiration.
• Added storage and document-ownership checks for upload copies, failed ingestion cleanup, retries, and shared knowledge-base content.

Upgrade Notes

• Database migrations run automatically for SQLite and PostgreSQL; no manual SQL migration is required.
• The migration adds the user-group permission policy, personal knowledge-base share records, workspace member capability columns, and per-knowledge-base workspace member permissions.
• Existing user groups with no stored policy retain access to all previously available capabilities.
• Existing and newly joined workspace members start with all workspace member permissions enabled; workspace owners can narrow them after upgrading.
• Existing personal knowledge bases remain private until their owner explicitly creates a share.
• Existing workspace and project knowledge bases remain unshareable and continue to use workspace or project membership for access.
• Ensure an enabled embedding model is selected in administrator settings before users create new knowledge bases. Users no longer choose an embedding model themselves.
• Review model built-in tool selections after upgrading: they now determine the default checked tools, while administrator global switches and user-group policies remain hard access ceilings.
• Memory availability is the intersection of the global memory switch and the user-group memory permission.
• For Docker deployments, set IMAGE_TAG=2.2.9 and leave SANDBOX_IMAGE_TAG unset once the corresponding application and sandbox images have been published.

Validation

• ESLint and TypeScript type checking passed for the access-control release snapshot.
• 68 frontend test files and 415 frontend tests passed.
• The production frontend build completed successfully.
• Targeted API, store, and tool Go suites passed for user-group policies, permission revocation, knowledge-base sharing, workspace member permissions, uploads, audio, model visibility, tool selection, MCP access, memory, drawing, and storage ownership.

Release Scope

• The feature notes in this document are based on access-control snapshot 6c9577f7dbe2dc656267a2ba3ea613073b41e8e5.
• Later unrelated maintenance changes on main are not expanded in these feature notes.

Full Changelog: v2.2.8...v2.2.9