Changelog

Webhook deliveries now include cryptographic signatures on every payload — receivers can verify authenticity before processing. Delivery retries use exponential backoff with configurable retry windows. Failed deliveries surface in the admin dashboard with payload inspection for troubleshooting.

DLP detection rules can now be created and edited through a visual interface in the admin portal — no JSON configuration required. Rules support pattern matching, entity type selection, and enforcement action assignment. Changes take effect on the next policy bundle sync to connected Outpost nodes.

Arbitex Cloud configuration — policies, compliance bundles, team access controls, and webhook endpoints — can now be imported and exported in structured JSON or YAML format. Useful for environment promotion workflows, disaster recovery restores, and version-controlled infrastructure-as-code patterns.

The admin dashboard adds inline policy bundle diffing — compare the active bundle against the last deployed version before pushing changes. Audit log views now support filtering by model endpoint, enforcement action, and compliance framework. Export to CSV and JSONL available for all filtered views.

Hybrid Outpost packages are now GPG-signed for deployments in air-gapped environments where network-based update verification is unavailable. Signatures cover the full deployment artifact including configuration and policy bundles. Signature verification runs automatically at startup and on each policy sync.

Arbitex now ships a tested DR runbook covering Outpost node failure, control plane failover, and audit log recovery. Restore procedures have been validated across the supported deployment configurations. The runbook is available in the admin documentation package.

Admin documentation has been significantly expanded to cover multi-tenant provisioning, policy bundle lifecycle management, compliance bundle configuration, and audit log export procedures. New sections cover SIEM connector configuration, SCIM directory sync troubleshooting, and Hybrid Outpost upgrade procedures.

End-user guides are now available covering day-to-day AI gateway usage: how requests are inspected, what happens when a DLP detection triggers, how to interpret enforcement messages, and how to request access to additional model endpoints. Guides are available in the documentation portal and customizable per-tenant.

OAuth clients are now available in Arbitex Cloud for CI/CD pipelines, automation agents, and backend services. Assign scopes to each client — read access, write access, audit log access — and authenticate using the OAuth 2.0 client credentials grant. Every automated request passes through the same inspection and enforcement pipeline as interactive sessions.

M2M access tokens are now signed with RS256 — industry-standard RSA asymmetric signing. A JWKS endpoint publishes the current public keys so downstream services can verify tokens independently without sharing secrets. Key rotation uses kid headers for zero-downtime transitions.

Set monthly spending caps and request quotas per user, team, or the entire organization. When a budget cap is reached, AI requests are blocked automatically — no overage surprises. Usage data is available in real time for cost attribution and planning.

Every AI prompt and response is checked against a compromised credential dataset in real time. Leaked API keys, tokens, and passwords in AI traffic are detected and blocked before they reach a model or leave your environment.

Continuous health probes track provider availability and response quality across all connected AI models. When a model becomes unresponsive or degrades, Arbitex fails over automatically and surfaces the incident in your observability stack.

Secrets are now managed through a pluggable Key Vault backend with automatic rotation. CSRF tokens are stored in Redis for distributed session integrity. mTLS chain verification is enforced end-to-end between the control plane and outpost nodes.

Session management is now backed by a distributed Redis store — no sticky sessions, stateless scaling across multiple gateway instances. OAuth client secrets can be rotated without downtime using a configurable grace window, allowing old secrets to expire gracefully while new ones activate.