Aten Security Docs Changelog

v0.1.17 / v0.3.3 — Proxy 0.3.3 and provider 0.1.7 release alignment

Sun, 10 May 2026 00:00:00 GMT

Go SDK: unchanged at `sdk/go/v0.1.15` | Python SDK: `sdk/python/v0.1.16` | TypeScript SDK: `sdk/npm/v0.1.17` | Thoth proxy + `thothctl` binary line: `thoth/v0.3.3` | Terraform provider: `v0.1.7` | Pulumi provider: `v0.1.7` | Promoted Thoth CLI/proxy docs to the `thoth/v0.3.3` binary line. | Standardized provider references on `v0.1.7` across Terraform and Pulumi docs.

v0.1.16 / v0.3.0 — Org API key auth for IaC + Thoth 0.3.0 release line

Tue, 05 May 2026 00:00:00 GMT

Go SDK: unchanged at `sdk/go/v0.1.15` | Python SDK: unchanged at `sdk/python/v0.1.15` | TypeScript SDK: unchanged at `sdk/npm/v0.1.16` | Thoth proxy + `thothctl` binary line: `thoth/v0.3.0` | Terraform provider: `v0.1.3` | Pulumi provider: `v0.1.2` | Added org-level API key auth for provider workflows and preserved bearer-token compatibility. | Standardized CI/CD auth through `THOTH_API_KEY` for Terraform and Pulumi provider usage.

v0.1.15 / v0.2.23 — Canonical release lines, Secrets Broker GA docs, and ingest resilience

Thu, 30 Apr 2026 00:00:00 GMT

Go SDK: `sdk/go/v0.1.14` | Python SDK: `sdk/python/v0.1.14` | TypeScript SDK: `sdk/npm/v0.1.15` | Thoth endpoint runtime: `thoth/v0.2.23` | Standardized customer docs on canonical release channels (`thoth/v*` for endpoint runtime, `sdk/*` for SDKs). | Updated install and quick-reference pages to reflect current stable versions and package constraints. | Added customer-ready strict-mode Secrets Broker examples for MCP tools (for example Figma, Notion, and Stitch host bindings). | Documented fail-closed token handling patterns for endpoint runtime use without storing long-lived tokens in local tool config.

v0.1.14 / v0.2.22 — SDK log-level controls + governance envelope hardening

Tue, 28 Apr 2026 00:00:00 GMT

Go SDK: `sdk/go/v0.1.13` | Python SDK: `sdk/python/v0.1.13` | TypeScript SDK: `sdk/npm/v0.1.14` | Thoth endpoint runtime: `thoth/v0.2.22` | Added SDK log-level controls across Go, Python, and TypeScript for cleaner operator debugging. | Improved STEP_UP token and enforcement trace diagnostics to make approval-path troubleshooting faster. | Unified auth/delegation envelope fields across control-plane and runtime services. | Added stricter default purpose-class enforcement and promotion lifecycle guardrails.

v0.5.5 / v0.2.20 — Tenant-scoped telemetry and API-key hardening

Mon, 27 Apr 2026 00:00:00 GMT

Go SDK: `sdk/go/v0.1.11` | Python SDK: `sdk/python/v0.5.4` | TypeScript SDK: `sdk/npm/v0.5.5` | Thoth endpoint runtime: `thoth/v0.2.20` | Go, Python, and TypeScript SDK ingestion paths now align to tenant-scoped telemetry/event IDs to avoid cross-tenant event collisions. | Instrumentation payload models were updated to preserve scoped event identity throughout ingest and normalization. | Improved API key management UX and guidance for scope-aware authorization. | Set a secure 90-day default API key expiry with proactive warnings for near-expiry keys.

v0.5.4 / v0.2.19 — In-place runtime update experience

Sun, 26 Apr 2026 00:00:00 GMT

Go SDK: unchanged at `sdk/go/v0.1.10` | Python SDK: unchanged at `sdk/python/v0.5.3` | TypeScript SDK: unchanged at `sdk/npm/v0.5.4` | Thoth endpoint runtime: `thoth/v0.2.19` | Added in-place update workflows for endpoint runtime and admin tooling. | Each command checks GitHub Releases, verifies asset checksums (`checksums.sha256`), and installs only verified binaries. | `--force` is supported for explicit reinstallation of the latest release. | Updated external docs to reflect current Thoth binary line `v0.2.19`.

v0.5.4 / v0.2.18 — Scoped key reliability + SDK ingest auth parity

Sun, 26 Apr 2026 00:00:00 GMT

Go SDK: `sdk/go/v0.1.10` | Python SDK: unchanged at `sdk/python/v0.5.3` | TypeScript SDK: `sdk/npm/v0.5.4` | Thoth endpoint runtime: `thoth/v0.2.18` | Go and TypeScript SDK emitters now send both `Authorization: Bearer ...` and `X-Api-Key` headers on ingest calls to match enforcer/runtime expectations. | Non-2xx ingest failures now log the HTTP status, target URL, and a safe response-body snippet to speed up debugging. | API key creation and authorization flows now support explicit scope selectors: | `--organization`

v0.1.6 / v0.2.8 — Python SDK `ThothClient` Backward-Compatibility Export

Fri, 24 Apr 2026 00:00:00 GMT

Go SDK: unchanged at `sdk/go/v0.1.5` | Python SDK: unchanged at `sdk/python/v0.1.6` | TypeScript SDK: unchanged at `sdk/npm/v0.1.6` | Thoth binary line: unchanged at `thoth/v0.2.8` | Restored `from thoth import ThothClient` compatibility export. | Added legacy method aliases (`wrap`, `wrap_openai_tools`, `wrap_anthropic_tools`) that delegate to current `instrument*` APIs. | Python SDK README now includes a legacy compatibility section for `ThothClient`. | Docs-site Python SDK reference now calls out preferred module-level APIs and legacy `ThothClient` support.

v0.1.6 / v0.2.8 — Headless operations improvements

Wed, 22 Apr 2026 00:00:00 GMT

Go SDK: unchanged at `sdk/go/v0.1.5` | Python SDK: unchanged at `sdk/python/v0.1.6` | TypeScript SDK: unchanged at `sdk/npm/v0.1.6` | Thoth endpoint runtime: `thoth/v0.2.8` | Added tenant-scoped MDM provider configuration and sync workflows for Jamf and Intune. | Fleet management now supports on-demand provider inventory synchronization to upsert endpoint records. | Provider sync now supports default fleet and environment mapping for imported endpoints. | Admin tooling is now documented as the default path for no-dashboard bootstrap and updates.

v0.1.6 / v0.2.7 — Proxy Identity Defaults + Enforcer Context-Diff Warnings

Tue, 21 Apr 2026 00:00:00 GMT

Go SDK: unchanged at `sdk/go/v0.1.5` | Python SDK: unchanged at `sdk/python/v0.1.6` | TypeScript SDK: unchanged at `sdk/npm/v0.1.6` | MCP Proxy: `thoth/v0.2.7` | Endpoint identity resolution now defaults to immutable machine identity (Intune/Jamf managed ID override, then OS machine ID), with hostname only as last-resort fallback. | `THOTH_USER_ID` remains required and must be a valid email address. | `enforcer_url` and `govapi_url` are inferred from `tenant_id` + `apex_domain`. | `--enforcer-url` / `THOTH_ENFORCER_URL` are now deprecated and ignored.

v0.1.6 / v0.2.3 — Wrap-Config Env Injection + Simpler Endpoint Routing

Mon, 20 Apr 2026 00:00:00 GMT

Go SDK: unchanged at `sdk/go/v0.1.5` | Python SDK: unchanged at `sdk/python/v0.1.6` | TypeScript SDK: unchanged at `sdk/npm/v0.1.6` | MCP Proxy: `thoth/v0.2.3` | `thoth wrap-config` now supports repeatable `--env KEY=VALUE` to inject runtime environment values directly into selected MCP server entries. | Wrap output remains idempotent and now reports environment changes when values are updated. | Fleet registration URL handling is simplified: | `govapi_url` is derived automatically from `tenant_id` + `apex_domain` as `https://grid..`.

v0.1.6 / v0.2.2 — Fail-Closed Enforcement + Canonical Contract Parity

Sun, 19 Apr 2026 00:00:00 GMT

v0.1.3 / v0.2.0 — Telemetry Metadata + Policy Context Propagation

Wed, 15 Apr 2026 00:00:00 GMT

v0.1.2 — Tenant API URL Contract + Session Intent Enforcement

Fri, 10 Apr 2026 00:00:00 GMT

Go: `sdk/go/v0.1.2` | Python: `sdk/python/v0.1.2` | TypeScript: `sdk/npm/v0.1.2` | Go, Python, and TypeScript SDKs now use a single tenant API URL for both: | policy enforcement (`POST /v1/enforce`) | behavioral event ingestion (`POST /v1/events/batch`) | SDK startup now requires tenant API URL configuration via: | explicit config (`APIURL` / `api_url` / `apiUrl`)

v0.1.1 — API Contract Fixes

Tue, 31 Mar 2026 00:00:00 GMT

Critical enforcement compatibility and decision-handling fixes across request/response mapping. | Endpoint and schema alignment updates for stable enforcement and step-up behavior. | Improved client metadata propagation and response observability fields. | `emitBehavioralEvent` was not exported from the package root. It is now accessible via | All endpoint paths, request field names (corrected to snake_case), response schemas, and

v0.1.0 — First General Availability Release

Mon, 30 Mar 2026 00:00:00 GMT

`instrument(agent, ...)` — Instrument any AI agent with a `.tools` attribute. Auto-detects | `instrument_anthropic(tool_fns, ...)` — Wrap tool execution functions for Anthropic Claude | `instrument_openai(tool_fns, ...)` — Wrap tool execution functions for OpenAI tool-calling loops. | `ThothPolicyViolation` exception — raised when the enforcer blocks a tool call. Fields: | `get_current_session()` — Access the active session context from within a governed tool call. | `ThothConfig` — Pydantic model with full field validation. | `EnforcementMode` enum — `observe` | `progressive` | `step_up` | `block`. | LangGraph and CrewAI integrations — auto-detected via duck-typing.