v2.6.6

Use case and AI app lifecycle, multiple organizations per account and Shadow AI syslog ingestion

Use cases and AI apps now move through In review, Planned, Live and Retired. Each has a go-live date, a retirement step and a regular "Still live?" check. One account can belong to several organizations, with a different role in each. Shadow AI can take proxy logs over syslog, and matched AI tool usage is recorded again. Intake forms suggest a risk level to the applicant and can be previewed as each role. The confirmation email names the reviewer and the review date.

Upgrade notes

No action needed. Upgrade as usual. Database changes run on startup by themselves (#5179, #5186, #5195, #5196, #5197, #5198, #5200, #5227, #5228, #5232). Changes your users will notice:

• Organization memberships (#5179): users and their roles move to a new memberships table, and the existing data is copied across. A user who belongs to two or more organizations picks one at login.
• Lifecycle stages (#5196, #5200): an existing use case starts as In review when an approval request is pending, as Retired when it is Closed, otherwise as Planned. AI apps under review start as In review, banned apps as Retired, the rest as Planned.
• Shadow AI figures can drop (#5228): insights count only traffic that matched an AI tool, and so do the new user and sensitive department alerts. Ordinary web traffic inflated them before.
• Syslog listener (#5232): off by default. To turn it on, set SHADOW_AI_SYSLOG_ENABLED=true, give it a TLS certificate and key, then publish port 6514. Docker Compose, the install script and the Helm chart (shadowAiSyslog) carry commented examples.
• API versions (#5173): new and changed endpoints live under /api/v1. The existing /api routes are unchanged.

Highlights

• Use cases (#5196, #5199, #5195, #5185): tabs for In review, Planned, Live and Retired, with counts. An owner can mark a use case live, confirm it is in use or retire it, and each move is written to its history. Pending intake requests appear in the In review tab. A new dashboard card shows time in review. Admins set the region and frameworks a new use case starts with.
• AI apps (#5200): the same lifecycle as use cases. An intake form can request a new AI app, which is created when the request is approved.
• Organizations (#5179): one account can join several organizations. Inviting an email that already has an account sends a join link. Removing a user takes them out of that organization only.
• Intake forms (#5198, #5197, #5175, #5177, #5176, #5174, #5194, #5181): the applicant sees the suggested EU AI Act risk level with the articles behind it. They can accept it or add context for the reviewer. The confirmation email names the reviewer and the due date, from a review time set per form. Builders can preview the form as the submitter or the review flow as each role. A test submit in the preview sends nothing. A Logic view lists every calculation, show/hide rule and risk tag. Formulas and rules can read any field, and they show field names. Routing thresholds have info tooltips. The submissions list refreshes while it is open.
• Intake fixes (#5165, #5178, #5180, #5182, #5184): the builder keeps edits made during a save, and guidance goes on the right field. Routing labels use plain terms. URL checks, empty answers and placeholders work as expected.
• Shadow AI (#5232, #5233, #5227, #5228): a syslog listener for Zscaler, Netskope, Squid and generic key=value or CEF logs, with a key per source. The AI tool registry (55 tools) is back, so matched events are stored instead of failing. Insights count AI tool usage only. The parsers handle time zones, IPv6 and more Netskope formats, and the user guide is updated.
• AI Gateway (#5202): MCP servers can authenticate with OAuth client credentials or AWS IAM.
• Post-market monitoring (#5229): a View reports button on the Monitoring tab opens the saved reports for that use case.
• Change history (#5186): edits to EU AI Act controls, subcontrols, ISO 42001 annex categories and model lifecycle values are recorded.
• User guide (#5183): intake form fields, calculated values, conditional fields and reviewer assignment.
• Internals (#5173, #5164, #5231): API versioning with a split of the backend app setup. Translations are split into area files. Framework dashboards use shared color tokens.
• Security (#5201, #5226): follow-redirects 1.16.2 (GHSA-mrwp-f3q8-3g9p). The 7 open Dependabot security alerts are resolved.
• Dependencies (#5226, #5204): combined dependency updates across the backend, frontend, AI Gateway, EvalServer and evaluation module, plus pyasn1 0.6.5.

---

What's Changed

• fix(intake): keep form builder field edits and put generated guidance on the right field by @gorkem-bwl in #5165
• feat(intake): show field names instead of {field_xxxx} tokens in the formula editor by @gorkem-bwl in #5174
• feat(intake): add a Logic overview to the form builder by @gorkem-bwl in #5177
• feat(intake): let formulas and show/hide rules read any field in the form by @gorkem-bwl in #5176
• feat(intake): preview the form and review flow as each role by @gorkem-bwl in #5175
• fix(intake): keep form builder edits made during a save and enable Save on the first edit by @gorkem-bwl in #5178
• fix(intake): rename routing and lane labels to plain terms by @gorkem-bwl in #5180
• Refactor: API Versioning and App Decomposition by @Br0wnHammer in #5173
• feat(intake): refresh the submissions list while the tab is open by @gorkem-bwl in #5181
• fix(intake): say 'less than' for the close-call margin by @gorkem-bwl in #5182
• docs(user-guide): intake form fields, calculated values, conditional fields and reviewer assignment by @gorkem-bwl in #5183
• fix(intake): URL checks, empty answers, placeholder and guidance caption by @gorkem-bwl in #5184
• fix(use-cases): small list, detail view and copy improvements by @gorkem-bwl in #5185
• fix: complete change-history coverage for framework controls, lifecycle values and read paths (#4915 #4977) by @MuhammadKhalilzadeh in #5186
• fix(deps): bump follow-redirects to 1.16.2 (GHSA-mrwp-f3q8-3g9p) by @gorkem-bwl in #5201
• feat(ai-gateway): OAuth client credentials and AWS IAM auth for MCP servers by @gorkem-bwl in #5202
• feat(use-cases): lifecycle stages, go-live, retirement and still-live checks by @gorkem-bwl in #5196
• feat(use-cases): pending intake requests in the In review tab by @gorkem-bwl in #5199
• feat(ai-apps): lifecycle tabs, intake and retirement flow by @gorkem-bwl in #5200
• feat(intake): explain routing thresholds with info tooltips by @gorkem-bwl in #5194
• feat(use-cases): default region and frameworks for new use cases by @gorkem-bwl in #5195
• feat(intake): suggest the risk level to the applicant before they submit by @gorkem-bwl in #5198
• feat(intake): confirmation email names the reviewer and review time by @gorkem-bwl in #5197
• deps(evalserver): bump pyasn1 from 0.6.4 to 0.6.5 in /EvalServer in the pip group across 1 directory by @dependabot[bot] in #5204
• chore(release): bump Helm chart appVersion to v2.6.6 by @gorkem-bwl in #5205
• feat(whats-new): add the v2.6.6 entry and refresh the Start here blog posts by @gorkem-bwl in #5207
• Merge develop into master (v2.6.6) by @gorkem-bwl in #5206
• fix(pmm): link the Monitoring tab to its saved reports by @gorkem-bwl in #5229
• fix(shadow-ai): count only AI tool usage in insights and alerts by @gorkem-bwl in #5228
• deps: one-fix-to-all — combined dependency updates + Dependabot security fixes by @MuhammadKhalilzadeh in #5226
• feat(i18n): split the large area dictionaries out of the translation file by @Innagl in #5164
• Allow user to be part of multiple orgs by @HarshP4585 in #5179
• fix(shadow-ai): recreate the AI tool registry and fix matched-event ingestion by @gorkem-bwl in #5227
• refactor(framework): render dashboard colors and type from shared tokens by @Innagl in #5231
• feat(shadow-ai): syslog listener for proxy logs by @gorkem-bwl in #5232
• fix(shadow-ai): syslog parser follow-ups from #5232 by @gorkem-bwl in #5233
• Merge develop into master (v2.6.6, Nov 2) by @HarshP4585 in #5236

Full Changelog: v2.6.5...v2.6.6