Platform, taxonomy, and SDK changes that reached customers. Dated releases, newest first.
· 2026.11.03.2
Clearer sign-in settings and final safety-floor terms
Settings → Security now lists the sign-in methods that work today, shows real buttons for adding an authenticator and connecting GitHub, and presents the safety-floor acknowledgement as final terms.
Fixed
Settings → Security shows the final liability acknowledgement for turning off the catastrophic-argument safety floor.
Sign-in methods lists how you sign in today: your email and password or a passkey, or GitHub.
Strong factor status shows "Set up" or "Not set up" with the add action, never "unknown".
"Add an authenticator app or security key" and "Connect GitHub" are buttons, and Connect GitHub uses the GitHub mark. A connected account shows "GitHub connected" with your GitHub username.
The blog and research indexes no longer show unfinished status labels, and the developers tutorials page now opens the docs.
· 2026.11.03.1
The site stays dark and fits small screens
Every page now renders in the dark theme whatever your system appearance, nothing scrolls sideways on a phone, and code blocks and tables can be scrolled from the keyboard.
Fixed
The site always renders in its dark theme. Before, a device set to light appearance got a partly light page, where some cards turned pale while their text stayed white.
Pages no longer scroll sideways on narrow phone screens. Wide docs tables scroll inside their own box, long inline code wraps, and the docs steps, the How it works walkthrough, the comparison pages, the API Explorer and the style guide fit the screen.
Code blocks and tables that scroll sideways can be focused and scrolled with the keyboard, and screen readers announce them.
Product videos load the player only when you press play, behind a labelled play button.
· 2026.11.02.1
Risk hints can only raise scrutiny, and guard() verifies every token
Intended now works out each action's risk itself and never lets a caller lower it, the TypeScript SDK verifies and consumes decision tokens by default, and one busy verifier can no longer block the others.
Security hardening
Risk hints in riskContext can only raise scrutiny. Intended works out each action's risk from the action it classified, its verb, its target and its arguments, and combines that with what you send: true flags and a higher baseRiskScore still add scrutiny, but touchesProduction: false no longer hides a production target, and a low score no longer lowers the floor for a write, a high-risk category or a destructive verb. When Intended raises a field, the decision's rationale says which and why. The starter policy (used until you save your own) is now consistent, so raising any risk field never relaxes a decision: privileged-access and sensitive-data actions are always denied (before, the same action in production was sent to approval), medium-risk actions (score 40–79) need human approval in every environment (before, outside production they were denied, while the same action in production was approved), and a low-confidence classification escalates only actions that would otherwise be allowed. Some actions that were approved or escalated before may now need approval or be denied.
The always-on catastrophic floor now reads the action text as well as the arguments, after decoding and normalising them, so encoded or disguised destructive commands (percent-encoding, HTML entities, look-alike letters, SQL comments, split shell words, base64, hex and gzip, nested up to three layers) are held for review like plain ones. It also covers disk wipes (mkfs, dd of=/dev/…, wipefs, shred /dev/…), forced pushes with a +refspec and DROP TEMPORARY TABLE. An action whose real effect cannot be determined statically — a shell expansion used as the command, piping into a shell, sh -c or eval of a variable, dynamic SQL built with CHAR() or concatenation — now needs human approval. Shell commands are read the way a shell reads them (escapes, $'…' quoting and joined quotes are resolved, --rec-style option abbreviations and git's global options are understood). To keep noise down, a recursive or forced rm is held only for broad targets (/, ~, $HOME, ., .., *, system directories, absolute paths two levels deep or less, or an unknown variable) and a DELETE only when it has no real WHERE; file contents you write are checked for destructive commands but not for shell indirection. Your own DENY and escalation rules that use MATCHES or CONTAINS get the same normalisation; allow rules do not.
Breaking: TypeScript SDK 0.8.0 guard() verifies the decision token with POST /verify/token and consumes it before your callback runs. A token that is invalid, expired or already used returns denied and the callback does not run. Use { verifyToken: "verify" } to check without consuming, or "off" to skip the check (the SDK warns that the decision is then advisory). If your callback passes the token to a service that consumes it, switch to "verify", or that second consume is refused.
New
The console's Insights page shows how many allowed actions in the last 7 days had their token verified by the tool that ran them.
POST /verify/token accepts keys with token:read for checking a token. Consuming one (consume: true) needs intent:create (the "Write" preset). Breaking: a verify:token key can still check a token but can no longer consume one; any key without intent:create gets 403 MISSING_CONSUME_SCOPE.
The /verify/* rate limit is now 600 requests per API key per 5 minutes (was 120).
Improved
Each credential now gets its own share of the tenant's /verify/* rate window. One busy or misbehaving verifier is refused on its own (VERIFY_RATE_LIMITED) and can no longer exhaust the window for your other verifiers.
· 2026.11.01.3
The spend alert replaces the old monthly budget setting
The console's monthly budget field and its 80% and 100% alerts are removed. The spend alert on the Billing page is the spend control; the daily decision limit stays.
Improved
Removed the "Monthly budget" field and its "Notify at 80%" and "Notify at 100%" options from Settings → Consumption Controls. Under per-decision billing they no longer did anything. To be told about spend, set the spend alert on the Billing page. The daily decision limit and its notification email are unchanged.
· 2026.11.01.1
Agent chains from your decisions, and clearer names
Link an agent's decisions into one chain by sending the same chain id, halt a runaway run from the console, and a few names that still said "execution" now say what they mean.
New
Agent chains. Send the same chain.id (your agent's run or task id) on each POST /intent or /v1/agent-intent of one run, and Intended links those decisions in order into one agent chain, with its aggregate risk, denials and pending reviews. An operator can halt the chain; while it is halted, new intents that name it get 423 AGENT_CHAIN_HALTED and no decision or token. The halt is cooperative, not a security boundary: your agent supplies chain.id, so it stops agents that send it, and policy still decides every intent either way.
Improved
The API key scope execution:read is now token:read, because it only ever allowed reading decision tokens. Existing keys were updated, and keys or requests that still use execution:read keep working.
POST /authority/replay now returns the action as action (targetSystem, action, result) in place of connectorAction.
Usage, billing and entitlement responses no longer include execution counters or an executions limit, since Intended does not execute actions. The usage page shows approved and denied decisions instead, and the usage block rate is now the share of evaluations that were denied.
A 402 free_allowance_exhausted response no longer includes resetsAt: the free allowance is a one-time grant per workspace and does not reset. spend_cap_reached still includes it.
Self-hosted deployments: the data encryption secret is now named DATA_ENCRYPTION_SECRET (it encrypts webhook signing secrets, idempotency records and tokens awaiting delivery). Add the new key to your intended-stack-secrets Secret with the same value as CONNECTOR_SECRET_ENCRYPTION_SECRET; the old name is still read for now.
Intended is a pure authority layer, and escalations come back to your agent
Intended decides and proves; your agent acts. Connectors and server-side execution are removed, and when a decision needs a human, your agent now waits for the answer and continues automatically.
New
When a decision is escalated to a human, your agent now gets the answer back automatically. guard() and authorize() wait for the approver by default: on approval your callback runs with the signed authority token, and on rejection you get the denial and the approver's reason. Set onEscalate: "return" (TypeScript) or on_escalate="return" (Python) to handle it yourself, and waitTimeoutMs / wait_timeout_seconds to change how long to wait (10 minutes by default).
New GET /v1/decisions/{intentId}/wait endpoint. It returns as soon as the decision is final, or after up to 50 seconds with PENDING, so any client can wait for an escalation without building polling or webhooks. See What your agent gets back.
Escalations now expire. An escalation nobody answers within 24 hours becomes EXPIRED and is treated as a denial. Change the window per workspace in authority settings.
The MCP server has a new check_decision tool, and submit_intent tells the assistant to use it when a decision is escalated. The MCP gateway, LLM gateway and Claude Code hook hold an escalated tool call while they wait and forward it with the token once it is approved.
The console shows when an agent is waiting on a pending escalation, and when an escalation has expired.
New releases: @intended-inc/sdk 0.7.0, intended (Python) 0.3.0, @intended-inc/mcp-server 0.2.0, @intended-inc/mcp-gateway 0.3.0, @intended-inc/claude-code-hook 0.2.0 and the LLM gateway image 0.3.0.
Improved
Intended decides and signs. It never holds your keys or calls your systems. Every decision returns the verdict, a signed authority token for allowed actions, and a receipt. Your agent performs the action and your service verifies the token before acting.
Connectors and server-side execution are removed. Requests to /v1/agent-intent return the decision only, and Intended no longer stores credentials for third-party systems. Report what happened after the action with outcome reporting in the SDK.
Govern any system your agents touch with the SDK (guard() and authorize()), the MCP gateway you run, the LLM gateway, the Claude Code hook, or the hosted MCP server.
The website, docs, API reference and legal pages now describe this model. Old connector pages redirect to Integrations.
Offline receipt verification, AI controls, and published retention
Every decision now has a receipt you can verify with the SDK and no call to Intended, workspace admins control every optional AI feature, and data retention follows the published policy.
New
Every decision now comes with a sealed receipt, including decisions approved after review and decisions changed by an override. A receipt bundles the decision, its hash-linked audit entries and, for allowed actions, the signed authority token.
Verify receipts offline with @intended-inc/sdk 0.4.0 and later: verifyReceipt() from @intended-inc/sdk/receipt, or the intended-verify-receipt command. From 0.5.1, a receipt is checked as of the time the decision was made, so it stays valid as historical evidence.
Settings → Privacy & AI in the console. Intended is deterministic by default, and workspace owners and admins decide whether optional AI features are on. AI policy drafting is off unless you turn it on, and every change to these settings is recorded in the audit trail.
Decision data is kept for the period in the published policy: 30 days on Free, one year on paid plans, and up to seven years on Enterprise. Legal holds pause deletion.
Decision records keep natural-language request text and connector output as SHA-256 digests rather than full text. Full request text is stored only if raw prompt logging is turned on for your workspace (it is off by default), and is then redacted and encrypted.
Webhook endpoints are paused automatically after repeated failed deliveries. Re-enabling an endpoint resumes delivery.
The decision detail view in the console shows the receipt on screen.
The website serves its own fonts, so pages no longer request fonts from a third party.
@intended-inc/sdk 0.5.0 moves to zod 4.
Fixed
Audit trail badges, intent links, and counters in the console show the right values.
Security hardening
Authority tokens can never be issued with a lifetime above the maximum.
Updated third-party dependencies across the platform, including the web framework.
Govern AI assistants over MCP
Intended now works inside MCP clients such as Claude, Cursor, and Codex. Ask Intended for decisions as MCP tools, put a governed proxy in front of your other MCP servers, or check every Claude Code tool call before it runs.
New
MCP server @intended-inc/mcp-server with five tools: submit_intent, verify_token, get_receipt, list_policies, and explain_decision. Run it locally, or connect to the hosted endpoint at https://mcp.intended.so/mcp with a workspace API key and nothing to install. See MCP server and MCP gateway.
MCP gateway @intended-inc/mcp-gateway: a proxy between your AI assistant and another MCP server. Tool calls are decided by Intended before they reach the upstream server. Allowed calls are forwarded with an authority token, escalated calls return a pending status while a person reviews them, and denied calls are never forwarded. If Intended cannot be reached, the call is refused.
Claude Code hook @intended-inc/claude-code-hook: a PreToolUse hook that checks every Bash, Edit, Write, and MultiEdit call. Allowed calls run, escalated calls ask you, and denied or undecidable calls are blocked.
A new Decisions list in the console with trend sparklines, inline actions on each row, and clear loading, empty, and error states.
Security hardening
Default-deny authorization on every API route: each route declares who may call it, and anything undeclared is refused.
Tightened role checks on account routes, and only workspace admins see the Admin area of the console.
Creating API keys is limited by role, requested key scopes are validated, and a read-only policy key is available.
Audit entries for administrative actions are attributed from the verified session.
Self-serve sign-up, physical AI in the console, and Perimeter
Anyone can now create a workspace from the website, physical and robotic decisions sit alongside digital ones in the console, and Open Intent policy compiles into NVIDIA OpenShell containment policy.
New
Self-serve sign-up: create a workspace from the website without talking to sales.
One self-serve, usage-based plan, starting with a one-time allowance of 5,000 free decisions. See Pricing.
@intended-inc/perimeter compiles Open Intent policy into an NVIDIA OpenShell containment policy, validated against the OpenShell policy schema. See Perimeter.
The LLM gateway supports the OpenAI Responses API (/v1/responses), streaming and non-streaming, so tool calls from reasoning models and newer agents are governed too.
Physical AI decisions appear in the console's main audit trail and decision views, labeled as Edge.
A visual rule builder for physical AI policies.
A redesigned console.
An accessibility statement, a cookie preferences control in the website footer, and product walkthrough videos on the Platform page.
Improved
In the default physical AI policy, a person detected in a robot's work cell now holds the action for operator review instead of denying it outright.
Escalation explanations state the actual reason a decision was escalated.
Audit-chain verification checks every entry from the first one, handles large audit trails, and reports the result in plain language.
Console pages recover automatically when data is slow to load.
Security hardening
The audit trail is append-only at the database level, and data-erasure requests are handled without breaking the audit chain.
Rate limiting is on by default for the hosted LLM gateway.
The identity on execution requests always comes from the verified credential, never from the request body.
Open Intent 2.1 and published research
Every Open Intent category now carries the context a reviewer needs to judge an action, and the thinking behind Intended is published on the site.
New
Open Intent 2.1 (`@intended-inc/open-intent` 2.1): each category record now includes whether it is safety-relevant, which kinds of actor may perform it, the entities a request should name, the evidence a decision should leave behind, and notes for telling similar categories apart. The change is additive. Domains, categories, and codes are unchanged.
Webhook delivery keeps flowing when a receiving endpoint is slow to respond.
Security hardening
Updated third-party dependencies across the platform.
Hosted LLM gateway and policies on real action arguments
Point your agent's model base URL at the hosted gateway and every tool call the model makes is checked before it reaches your systems. Policies can now match on the actual arguments of an action.
New
Hosted LLM gateway at gateway.intended.so. Change your model API base URL and every tool call the model emits is evaluated against your policies before your agent sees it. The gateway fails closed: if a decision cannot be made, the tool call is not forwarded. See LLM gateway integration.
Policy conditions can read an action's raw arguments by path (for example args.body.path or args.items[0].name) and match them with regular expressions.
An always-on safety floor: any action whose arguments contain a destructive operation such as DROP, TRUNCATE, rm -rf, or git push --force is held for human review, whatever your other policies say. It can only be turned off from an audited Danger Zone page in the console.
A healthcare policy pack that denies exporting patient data and re-identifying patients, and sends changes to health records and claim submissions for review.
Python SDK 0.2.1 adds a fail-closed LangChain tool guard (intended.langchain).
The How it works page and the homepage now sign and verify a real Ed25519 authority token in your browser.
Improved
Decisions distinguish reads from writes based on the classified action. Anything that cannot be classified is treated as a write.
Bulk exports and reads of sensitive data are no longer allowed automatically as routine reads.
Security hardening
Tightened how the LLM gateway handles enforcement modes, protected its metrics endpoint, and made it fail closed on malformed workspace configuration.
Tightened the authorization boundary for physical AI actions.
SDKs on npm and PyPI, Ed25519 tokens, and database-level tenant isolation
The TypeScript and Python SDKs are published, authority tokens are signed with Ed25519 by default and can be verified locally, and new workspaces start from a conservative default policy.
New
TypeScript SDK @intended-inc/sdk on npm, with intended.guard() for putting an agent action behind a decision in a few lines and, from 0.3.0, authorize(), which returns the decision for your code to act on.
Python SDK intended on PyPI (0.2.0), with authorize() against the same decision endpoint.
Per-workspace public signing keys at /.well-known/authority/<tenantId>/jwks.json, so your services can verify authority tokens locally. See Verify tokens.
Sign in through a hosted login page that supports passkeys.
Override a resolved decision from the console. A reason is required, and the override is recorded in the audit trail with who made it.
Every decision in the console shows a plain-language "why this decision" explanation.
Turn off model-assisted classification of natural-language requests with the X-Intended-Disable-LLM header. Classification then uses deterministic rules only.
Improved
Authority tokens are signed with Ed25519 by default. RS256 and ES256 remain available.
New workspaces start with a conservative default policy: routine actions are allowed, production changes need approval, and high-risk actions are denied.
API keys now use the intended_live_ prefix. Existing keys keep working.
Fixed
Team invitations open an accept-invite page instead of stopping at the sign-in screen.
Security hardening
Tenant isolation is now also enforced inside the database with row-level security, denying access by default.
An action cannot run without a valid authority token on any execution path.
Approvals and rejections are always attributed to the signed-in approver.
Idle console sessions now expire.
Decision webhooks, stronger sign-in, and a new look
Every authority decision can now be pushed to your own systems as a signed webhook, sign-in requires multi-factor authentication on every path, and the website moved to a new design.
New
Outbound webhooks: subscribe an endpoint to authority.decision.created and receive every decision in your workspace as it happens. Each delivery is signed with HMAC-SHA256 in the X-Intended-Signature header (t=<timestamp>,v1=<signature>) and retried on failure.
Webhook delivery history in the console, so you can see what was sent to each endpoint and how it responded.
A redesigned website.
Improved
Setting up an authenticator app now shows a scannable QR code.
API-key scopes map directly onto the permissions each API route checks.
The console shows only your workspace's real data, with clear empty states and a first-run path for new workspaces.
Fixed
Upgrading to a paid plan from the console now completes checkout correctly.
Security hardening
Multi-factor authentication is now enforced on single sign-on too, and checked for every session.
Hardened one-time-code verification and removed secrets from logs.
Hosted platform, Physical AI API, and Open Intent 2.0
The hosted Intended platform and console went live, with a runtime API for physical and robotic systems and a taxonomy that now covers physical work as well as digital operations.
New
Hosted Intended platform: submit an agent's intended action to POST /intent and get an allow, escalate, or deny decision backed by your policies, with every decision written to a hash-chained audit trail. See the API reference.
Physical AI runtime API under /v1/physical/*: classify an action, issue signed authority tokens for edge devices, register actors, record approvals and revocations, and read the audit timeline. Start with the Physical AI quickstart.
Public signing keys for physical authority tokens at /.well-known/jwks.json, so edge devices can verify tokens without calling back to Intended.
Open Intent 2.0 adds 14 physical and embodied-process domains and an embodied-safety domain, for 29 domains and 173 categories. Codes from earlier versions keep their meaning. See Open Intent.
Console: create and revoke API keys, invite team members, and manage the members of your workspace.
Security hardening
Stricter CSRF and CORS checks and a tighter Content Security Policy across the website and console.
A published PGP key and security.txt for reporting security issues. See Responsible disclosure.
Subscribe to the changelog feed.
Atom feed at /changelog.atom. Subscribe in your reader.