Captivo Access sürüm notları — 2026 · Sayfa 7 / 13

What changed

• New: Split policy settings into per-category cards (Connectors promoted)

What changed

Fixes and refinements — see the changelog below for details.

What changed

• New: Search on the sessions, sites, and live tables
• New: Search + status filter on the invites table
• New: Search + status filter on the grants table
• New: Search + status filter on the connectors table
• New: TextMatch client-side table search helper

What changed

• New: Refined-hairline table style (Direction A) across all tables

What changed

• New: Auto-refresh the console home + sessions page every 10s

What changed

• Fixed: Header live-pill counts web-app sessions too

What changed

• New: Show web-app sessions in the /admin/live table too

What changed

• New: Render web-app live cards with Revoke access
• New: Merge gateway + web-app sessions into a LiveCard union
• New: ActiveAgo helper
• New: ListActiveWebSessions data-plane client
• New: Record web-app activity + /web-sessions endpoint
• New: Web-app activity tracker

What changed

• New: Show pending pairings with a delete action

What changed

• Fixed: Format compound connector commands into readable wrapped steps

What changed

• New: Bundle guacd on every connector; remove gateway-host distinction

What changed

• Fixed: Header chips use nav tokens so light theme doesn't show white blobs

What changed

• New: Admin-chain external anchor UI in the integrity panel
• New: Admin-chain anchor verify + token routes
• New: Anchor cron pins both access and admin chains
• New: AdminAuditAnchor model + generalized runAnchorFor/runAdminAnchor

What changed

• New: Mount LivePill in the top-nav (read_console only)
• New: LivePill component + styles
• New: Live session count endpoint
• New: LivePillView helper for the header live-pill

What changed

• Fixed: Normalize file-transfer path to a single leading slash

What changed

• New: File-transfer badge + filter in the access log table
• New: Kind=file filter for the access log
• New: Access-format transfer badge helper + verbs
• New: Emit file-transfer audit events from the tunnel
• New: File-transfer observer state machine

What changed

• New: Admin-chain verify route + integrity panel
• New: Idempotent admin-chain backfill + route
• New: Chain admin audit events via serialized locked append
• New: Admin chain canonicalize + hash + verify

Vendor portal — Requests & History

The vendor portal now has its full navigation — My access · Requests · History:

• Requests — every access request you've made, with its status (pending, approved, denied, withdrawn, expired) and a one-click Withdraw for pending ones.
• History — your past remote sessions (resource, protocol, date, duration), with load-more paging.

Session history is private to each user and never exposes recordings.

Admin audit — configuration changes

The admin action log (Audit log → Admin actions) now also records configuration and operational changes:

• SMTP, SSO, platform settings, session policy, directory settings and group mappings, update settings.
• Connector operations: egress policy, log level, repair — and log-level reset.
• Recording deletion.

Secret values (passwords, client secrets, bind credentials) are never written to the audit — each entry records who changed what and when, not the values.

Admin action audit trail

Security-critical changes made by admins are now recorded and reviewable under Audit log → Admin actions:

• Grants (create, update, approve, deny, revoke), live-session termination, auth-session revocation, user changes/deletion, invites (create, revoke), connectors (create, revoke, delete), and resources (create, update, delete, credential changes).
• Each entry shows who did it, when, the action, the target, and a short summary.

Recorded on a separate log — the tamper-evident access decision log is unchanged. Config-setting audit (SMTP/SSO/policy/etc.) will follow.

Terminate a session · Extend a grant

The security console is now actionable:

• Terminate — end a live RDP/SSH/VNC session immediately from the console or the Live sessions page (admin only, with a confirmation). The connected user is disconnected at once.
• Extend — give an expiring grant more time in one click (+1h / +1d / +7d) right from the console's Expiring soon list, within the configured maximum grant length.

Auditors and operators cannot terminate sessions.

What changed

• New: Terminate + Extend buttons on console and live sessions
• New: Terminate-session route + data-plane client
• New: Per-session terminate (hub closer + /sessions/terminate)
• New: NextEndsAt + extend options

New admin home: the Security Console

The admin home is now an at-a-glance operations console instead of a chart dashboard:

• KPI band — active grants, live sessions, pending requests, grants expiring within 24h, recordings in the last 7 days.
• Live sessions — cards for every active RDP/SSH/VNC/web session, with one-click Watch.
• Attention grid — approve or deny pending access requests inline, see grants expiring soon, connector health at a glance, and a live audit stream.

The analytics dashboard (trends, heatmap, charts) moves to its own Insights page, reachable from the top navigation.

Redesigned admin navigation

The admin console moves from a left sidebar to a top navigation bar:

• Primary tabs — Console, Access, Sessions, Recordings, Audit — with Infrastructure and People as grouped dropdown menus, so every page is one or two clicks away.
• Command palette (⌘K) search, notifications, theme switch, and your account menu sit on the right.
• Everything stays role-aware: operators and auditors see only what they can use.
• Fully responsive — on narrow screens the nav collapses into a drawer.

This is a look-and-feel change only; all pages and permissions are unchanged.

Vendor portal — a home of their own

Vendors (and other connect-only users) now land on a dedicated, light-themed portal instead of the admin console:

• My access home — every resource you've been granted, each with a live time-remaining bar (amber when under a day left), and a one-click Open into the session.
• At a glance — a security summary (passkey, session recording, VPN-less), upcoming access windows, and your recent sessions.
• Request access right from the home page.

Admins and operators keep the full console unchanged.