Platform-wide authorization and a shared SDK across every portal

This release changes how MagOneAI decides who can do what. Instead of a mix of separate settings, every action on the platform now goes through one permissions system. Admins get a single console to manage it, and many access gaps are closed as a result.

Highlights

Platform-wide authorization

Every action in MagOneAI, from viewing a workflow to changing an organization's settings, is now checked by one permissions system. It's built from a few simple pieces:

• Actions: the individual things a person can do, listed in one central registry.
• Roles: named bundles of actions, such as "Project editor".
• Groups: sets of people who share the same roles.
• Per-person overrides: exceptions for one person. If an override denies something, the denial always wins.

It's switched on by default and replaces the platform-wide switches that used to make these decisions.

Why it matters: Permissions now work the same way everywhere, so who can do what is controlled in one place and is easy to audit.

Learn more: Access control overview · Action reference

Access Control console

Superadmins get a new Access Control console. Create roles and groups, start from ready-made presets, or copy an existing role and adjust it. An effective access grid shows exactly what each person can do, worked out the same way the permissions system itself decides.

Roles can now be granted for a single project, so access earned on one project doesn't spill over into others.

Why it matters: You can build roles and check exactly what they grant on one screen, without guesswork.

Learn more: The Access screen · Roles · Groups

Who can see a run is now a permission

A run is visible only to the person who started it, plus admins. This is now decided by the permissions system instead of one on/off switch for the whole platform, because a single switch can't vary by person, role or project.

Apps Catalog

MagOneAI has several portals, including MagOneAI Studio, MagOneAI Hub and the Superadmin portal. Superadmins can now register each portal, with its own web address, in the Apps Catalog. Access is decided by which portal a request comes from. A Superadmin can set a portal's address from its card and choose a use case from a list instead of pasting an ID.

Learn more: Apps catalog

Run code as a built-in tool

Agents and Tool nodes can now run code as a built-in tool, safely isolated in a sandbox, with the same editor as the Code node.

Learn more: Code node

Improvements

• Clear "no access" messages. If you don't have access to something, you now see a clear refusal instead of an empty list or a misleading "unlimited" reading.
• One login, back to where you were. The shared login returns you to the portal you came from.
• Shared building blocks across portals. MagOneAI Studio, MagOneAI Hub and the Superadmin portal now share one set of underlying components instead of three separate copies, so they stay consistent and improve together.
• Agent trajectory capture is opt-in. Recording every step an agent takes, added in the previous release, is now off by default for the whole platform. The per-workflow setting only appears when it's switched on.
• Documents keep their order. Content from PDF, Word and PowerPoint files stays in the correct order when added to a knowledge base.
• Accurate Save buttons. Save buttons on the canvas only light up when something has really changed, and unsaved edits are kept as you move between panels.

Bug fixes and security

Moving to one permissions system let us close a number of access gaps:

• Suspended accounts are denied access, and the human-task inbox works again.
• Chat no longer hints that conversations you aren't allowed to see exist.
• Offboarding someone removes all their access, and access granted to specific people no longer reaches anyone else. See Offboarding.
• You can no longer grant access you don't have yourself.
• Two issues that could have let data cross between organizations were fixed.
• Six permission checks that weren't being enforced now are, and a run you're not allowed to see can no longer be exported.
• Refreshing your sign-in can no longer leave a session less secure than before.
• Only organization owners can change integrations.
• Menus show only what you can actually open, and permission errors are shown instead of a blank screen.
• A sign-in edge case that could lock people out is fixed.
• Two ways around portal access rules were closed, and an organization can no longer switch off its own access controls.
• "Not allowed" messages display correctly again.
• Fresh installations of MagOneAI set up cleanly again.