Release 0.5.0: Enterprise Authorization and the Workflow Engine

Highlights

Enterprise authorization. A full cutover from role-based to relationship-based access control (ReBAC) backed by OpenFGA, with Keycloak as the identity provider and an AgentGateway ext_authz bridge enforcing per-call MCP decisions.

A workflow engine. Multi-step agentic workflows with a visual editor, human-in-the-loop approval, artifact capture, and sharing.

Alongside those: a new Webex bot, an envelope-encrypted credential store with an OAuth connector platform, and a rebuilt Skills platform.

The entire authorization stack is opt-in and disabled by default: for a stock 0.4.x deployment this is a drop-in upgrade with no values.yaml edits required.

Features

Identity and authorization (OpenFGA ReBAC)

• ReBAC core, admin BFF, and admin UI: a new ui/src/lib/rbac library (OpenFGA client, tuple builder, store, PDP, decision cache, role mapping, group sync, team/agent resolvers, Keycloak Admin REST helpers), the full admin BFF surface, and admin UI for teams and authorization.
• Auth foundation charts: new keycloak, openfga, openfga-authz-bridge, and agentgateway subcharts, with Keycloak realm init, token-exchange and auth-reconcile jobs, the OpenFGA model bootstrap, and the Python ext_authz bridge.
• Shared MCP agent-auth library: a new mcp-agent-auth package (JWT validation, caller-key derivation, OBO exchange, in-process JWKS cache, downstream token forwarder, PDP) wired uniformly into 13 agent MCP servers via MCPAuthMiddleware.
• RAG ReBAC with per-document ACLs: OpenFGA authorization for the RAG server, ACL propagation through every ingestor, per-document enforcement at retrieval time, and a userinfo cache for the OBO validation hot path.
• admin implies member plus an auto-provisioned Super Admins team, removing the need to dual-write tuples.
• Channel-derived team binding: the authorizing team is derived from the Slack channel, Webex space, or DM context, which is correct for multi-team users by construction. Personal DM commands added to both bots.
• Persisted onboarding defaults in platform_config, and an admin-configurable discovery cache TTL.

Workflow engine

• Server-side workflow infrastructure, API routes, stores, and types.
• ReactFlow-based visual editor with skill isolation.
• Human-in-the-loop: waiting_for_input run cards with approval forms, hidden on terminal runs; a cancelled status.
• Step context injection, artifact capture, and warnings for unavailable resources.
• Config-driven seeding with read-only protection and a banner in the UI.
• Visibility and sharing RBAC with config-access checks on runs.
• Step-level tool restrictions via a Tool Access picker.
• YAML export/import (switched from JSON), run deletion with file cleanup, and auto-expiry.
• Workflow tools for dynamic agents, with run cards and trigger info.
• Gated behind WORKFLOWS_ENABLED.

Bots: Webex and Slack

• New Webex bot integration: a full webex_bot integration (A2A client, app, identity linking, audit, hardening, Prometheus metrics) plus a webex-bot subchart, Dockerfile, and CI workflow.
• Slack ReBAC additions: channel-team resolver, JIT identity linking, SSE OBO, runtime policy, and opt-in first-message channel onboarding for unmapped channels.

Credentials

• Envelope-encrypted credential store: MongoDB-backed storage with KMS-style data-key wrapping (AES-GCM with a master key), an OAuth connector platform (built-in providers, token refresh, state store, provider detection), and a Python credential-exchange client for agents. Gated behind CAIPE_CREDENTIALS_ENABLED and disabled by default.

Skills platform

• Unified Workspace browsing every hub (GitHub, GitLab, local) in one view.
• Standalone scanner microservice, decoupled from the gateway for reliability.
• Installer rewrite with per-skill install history, multi-source hubs, ZIP export, and AI Assist for authoring.
• Skills Builder for dynamic agents, gallery filter/sort controls, and a HIDE_BUILTIN_SKILLS flag.
• AI Review module for skills and dynamic agents, with a reworked rubric.

Dynamic agents and chat

• HITL tool approval: agents pause for explicit human approval before running a sensitive tool, with GridFS-backed storage for large artifacts.
• JWT/OBO auth plus an OpenFGA PDP gate, bringing the runtime to parity with the rest of the auth surface.
• MCP endpoint normalizer and self-heal: canonicalizes MCP URLs from bot configs (trailing slash, /mcp suffix, scheme inference), forwards request tokens via OBO, and resolves credential references.
• A curl builtin tool for PUT/POST and an allow_non_public_urls option for private endpoints.
• A generic files API, a resizable context panel, editor blocker hints, and protection for the platform default agent.
• get_file_line_count, which the agent is prompted to call before read_file so large files are read in bounded ranges.

Integrations and MCP

• AWS MCP server and a Pod Security Standards baseline.
• LiteLLM FinOps MCP server for model cost and usage reporting, with theme-aware report images.
• VictorOps consolidated onto v2 incident reporting; Jira internal service-desk comments.

Operations

• DocumentDB compatibility: the runtime works against AWS DocumentDB, not just vanilla MongoDB.
• Installer UX and runtime simplification; the embeddings menu in setup-caipe.sh expanded to all seven EmbeddingsFactory providers including Bedrock, Cohere, and Voyage AI.
• Documentation site redesign, and versioned docs generated at build time from release tags.

Fixes

• Slack and chat reliability: followup prompts no longer claim knowledge of replies the agent never made; stale env-provided Slack default agent/team are dropped with a warning rather than silently honored; channel discovery uses users.conversations to dodge Slack API rate limits.
• RAG truncation and seed persistence: long retrieved documents are no longer silently cut, and seeded config survives restarts.
• Web ingestion: fixed crawling after the Scrapy 2.16 bump.
• Dynamic agent chat regression: restored chat for agents created through the UI editor.
• RBAC: scoped team admins can edit, delete, and configure their own team; previously group admins could not modify anything within their own group.
• Charts: workflow_configs included in the caipe-ui app ConfigMap so self-service workflows render; the Ollama embedding model is pulled during setup so local embeddings work out of the box.

Security

• Keycloak client-secret hardening: a reconcile pass rotates dev placeholder secrets for the three confidential service-account clients on every install/upgrade, plus a strict-mode gate (keycloak.strictClientSecrets, default off) that fails the install if a known placeholder still mints a token. Five demo users with hardcoded passwords were removed from the bundled realm config.
• BFF admin/admin fallback removed: production requires the client_credentials path against a confidential client and fails loudly otherwise. MongoDB and NextAuth strict-mode gates added.
• MongoDB strict-password gate: mongodb.auth.strictPasswords (default off) makes install/upgrade fail fast when the root password is left at a placeholder like changeme.
• Envelope-encrypted credentials; production installs must use aws-kms (local-cmk is for non-production testing only).
• Dependency hardening: exact pins for aiohttp, websockets, and @aws-sdk/client-kms; fastmcp bumped to 3.3.1; stale MCP uv.lock files refreshed; protobuf and qs bumped.

Breaking changes

There are no breaking Helm values changes in 0.5.0. Every key in the chart diff is additive, and the RBAC/OpenFGA/Keycloak/Webex/credentials stack ships disabled by default (tags.keycloak, tags.webex-bot, openfga.enabled, global.agentgateway.enabled, and CAIPE_CREDENTIALS_ENABLED all default to false).

Three changes landed between 0.4.0 and 0.5.0 that need attention:

Change	Who is affected
Slack botConfig channel schema uses a flat agents list	Anyone who had not already migrated as part of the 0.4.0 upgrade
overthink.custom_prompt removed from the Slack bot config	Only deployments that explicitly set it
active_team JWT claim removed, replaced by channel-derived team binding	Only external code that read the claim; 0.4.x never issued it through this stack

Known issues

None beyond the Slack statistics gap noted in 0.4.0.

Upgrade

helm upgrade ai-platform-engineering \
  oci://ghcr.io/caipe-io/charts/ai-platform-engineering \
  --version 0.5.0 \
  -f your-values.yaml

That alone is sufficient for a stock upgrade. The new authorization stack stays disabled.

Adopting the new stacks

Step	What to enable	Key values
1	RBAC + OpenFGA	tags.keycloak, openfga.enabled, openfgaAuthzBridge.enabled, global.agentgateway.enabled
2	Webex bot	tags.webex-bot: true
3	Credentials store	CAIPE_CREDENTIALS_ENABLED: "true", CREDENTIAL_KEY_PROVIDER: "aws-kms"
4	Workflows	WORKFLOWS_ENABLED: "true"

Data migrations

• MongoDB: no destructive schema migration. New collections back the credential store and Slack/Webex route management; the credential store adds indexes via scripts/init-credential-mongo-indexes.ts. All are created lazily, and only when the corresponding feature is enabled.
• OpenFGA: if you enable RBAC, the chart bootstraps the authorization model and creates the caipe-openfga store. There is no prior store to migrate from.
• Keycloak: the subchart is new. Enabling it initializes the caipe realm, the token-exchange clients, and optionally the upstream IdP broker.
• active_team JWT claim: no data migration; the claim is simply no longer issued.

One admin-run migration is registered for this release under Admin → Migrations (0.5.1). Run it if you adopt RBAC.

Verify

kubectl get pods -n <namespace>
# Send a test chat message and confirm a normal response

Rollback

helm rollback ai-platform-engineering <previous-revision> and restore your backed-up values file. Because every 0.5.0 addition is additive and disabled by default, a stock rollback needs no data changes.