July 2026 Product Release Notes

Last updated: July 29, 2026

Theme: Policy Coverage Without the Manual Slog

Scaling access policy coverage by hand doesn't work past a few dozen apps. This month's release cuts the manual steps out of creating policies, getting them reviewed, and acting on access requests, wherever your team already works.

Highlights

  • Access Policies MCP: Create policies in bulk by asking Albus

  • Access Policy Sharing and Commenting: Get sign-off on a policy, inside Lumos

  • MS Teams: Approve access requests inline, without leaving Teams

  • Agent Skills: One playbook every Lumos agent can use

  • Access Request Agent in Slack [BETA]: @mention Lumos, describe what you need

  • Lumos API V1 [BETA]: Define approval and provisioning workflows

  • Activity Log: Search a large tenant's log in seconds

  • Resource Roles: Delegate admin per app, not org-wide

  • NHI Threat Hunter (GitHub) [BETA]: Machine-identity threat hunting extends to GitHub

🛡 Intelligence & AI

Access Policies MCP

Albus can now create and manage access policies for you. Model Context Protocol (MCP) tools let Albus handle the AppStore prerequisites and permission setup that policy creation depends on, so scaling role-based access control (RBAC) from a pilot to hundreds of apps no longer means clicking through the UI one app at a time. Every write action waits for your confirmation.

What's new:

  • Create, read, update, and delete access policies through Albus chat

  • Albus adds missing apps to the AppStore and configures referenced permissions

  • Prerequisite and conflict validation before any policy is written

  • Admin confirmation required on every write action

  • Reports which apps were included, which were excluded, and why

Benefits:

  • Scale RBAC from a pilot to hundreds of apps without clicking through each one

  • Turn role-mining output and access matrices into live policies

  • Skip the AppStore prerequisite work before a policy can exist

  • Keep an audit record of every change Albus makes

Available to Albus for RBAC customers. Reach out to your CSM to get started.

Agent Skills

A Skill is a reusable playbook for how an agent does something: a SKILL.md file plus any reference files and scripts it needs. Skills now live in the Knowledge Hub as first-class content that any Lumos agent can use, so an agent's know-how is something you can see and attach rather than something buried in code.

What's new:

  • Skills tab in the Knowledge Hub to browse and manage Skills

  • Lumos default Skills for NHI threat hunting and RBAC role mining

  • Agent Builder multi-select replaces the single Specialization picker

  • Slash-command invocation of a Skill in Albus chat

  • Directory structure with reference files and bundled scripts

Benefits:

  • See exactly what an agent knows how to do

  • Edit a playbook without waiting on an engineering deploy

  • Stop maintaining the same know-how in five places

No configuration required. Lumos default Skills appear in your Knowledge Hub automatically.

Identity Intelligence Agent Chat

Identity Intelligence agent runs are no longer one-shot. A chat interface inside the agents experience lets you question a finding, ask for the evidence behind it, and carry them into later runs instead of resetting each time.

What's new:

  • Ask follow-up questions about a specific finding or the overall analysis

  • Probe a finding to see the evidence behind it

  • Agent memory, so later runs account for what you already reviewed

Benefits:

  • Investigate a single finding instead of re-running the whole analysis

  • Track actions taken in chat as an audit trail

Available to invited accounts to start. Reach out to your CSM to participate.

NHI Threat Hunter (GitHub) [BETA]

Non-human identity (NHI) threat hunting extends to GitHub, alongside the existing Amazon Web Services (AWS) and Microsoft Entra ID coverage. The agent scans your GitHub environment for risky machine-identity configurations and surfaces them as prioritized findings.

What's new:

  • GitHub added as a scan target for NHI threat hunting

  • Findings surface in the Identity Intelligence issues dashboard

Benefits:

  • Extend machine-identity coverage to your source-control environment

  • Review GitHub NHI risk alongside AWS and Entra ID findings

Available in Beta. Reach out to your CSM to participate.

Access Request Agent in Slack, @Mention [BETA]

Employees already ask for access in Slack. This makes those messages do something. @mention the Lumos app or send it a direct message, describe what you need, and the agent walks you through confirming and submitting the request, with the same policy enforcement and audit trail as the web app.

What's new:

  • @mention the Lumos app in any channel, or send it a direct message

  • Agent classifies the request and asks at most one follow-up question

  • Structured request card to review before submitting

  • Confirmation with a request ID and a status link

  • Same approval workflow and audit trail as the web app

Benefits:

  • Capture access requests employees already make in Slack

  • Stop routing Slack messages into Lumos by hand

  • Skip the browser entirely for a routine request

Available in Beta starting August 14. Requires the Lumos Slack integration. Reach out to your CSM to participate.

🧱 Platform

Access Policy Sharing and Commenting

Policy review moves into Lumos. Owners and admins share a policy with the users or groups who need to sign off, and those reviewers comment directly on the policy version. Comments resolve in place and commenters stay with the policy as new versions publish, so the review conversation follows the policy through its lifecycle.

What's new:

  • Assign users or groups as commenters on a policy

  • Bulk share multiple draft policies from the drafts table (admin only)

  • Comment directly on a policy version

  • Resolve comments, collapsed behind a "See Resolved" toggle

  • Commenters persist across newly published versions

Benefits:

  • Get stakeholder sign-off before a policy goes live

  • Keep the review attached to the policy instead of a Slack thread

  • Scope review access to one policy without granting broad permissions

  • Record who reviewed a policy and what was resolved

No configuration required. This release does not include notifications, so let reviewers know directly when you share a policy with them.

Help Center Article

Activity Log

The Activity Log is fast and searchable enough to use mid-investigation. Page loads meet their target latency on large tenants, and real search and filter let you scope to the events you care about instead of scrolling.

What's new:

  • P95 page load meets target on large tenants

  • Search and filter by integration, action type, status, time range, actor, target

  • Refreshed feed with cleaner drill-down into individual events

  • Net-new integration event logging

Benefits:

  • Open the log mid-investigation without waiting through timeouts

  • Scope to the exact events you need in one search

  • Answer operational questions without filing a support ticket

Available to all customers, with no setup required. Event coverage is unchanged apart from the new integration logs; broader coverage expansion comes later.

Resource Roles

Resource Roles are generally available. Where a Custom Org Role grants permissions across every resource of a type, a Resource Role applies only to the specific resources you assign it to, so a team lead can manage two apps without becoming an org admin.

What's new:

  • Resource Role type in the Role Builder, scoped to Apps

  • Assign a role to a user or group per app

  • Bulk condition-based assignment across multiple apps

  • Assignments recorded in the audit log

Benefits:

  • Delegate app management without granting org-wide admin

  • Reduce org admin sprawl and enforce least privilege

  • See which users hold elevated access to which apps

Turned on for all customers, with no impact on existing roles. Apps is the first resource type; Vendors and Access Reviews follow.

Lumos API V1 [BETA]

The V1 API exposes the workflow engine that powers the Lumos interface. Define approval workflows, configure provisioning and deprovisioning steps, and manage entitlements from code without opening the app.

What's new:

  • Define multi-stage approval workflows with conditions and assignees

  • Configure provisioning and deprovisioning steps, including manual and wait steps

  • List, grant, revoke, and audit entitlements at the app or account level

  • Manage requestable permissions without an AppStore dependency

  • Terraform provider and an expression language for conditional logic

Benefits:

  • Deploy access workflows the same way you deploy infrastructure

  • Automate entitlement changes instead of clicking through the interface

  • Version-control approval logic alongside the rest of your stack

Available in Beta, with enrollment required. V0 credentials carry over with no migration, and general availability is targeted for October. Reach out to your CSM to participate.

Help Center Article

Microsoft Teams Support for Access Requests

Access request notifications and approvals work in Microsoft Teams at full parity with Slack. Approvers get the request where they already work and act on it inline, so Microsoft-first organizations no longer need a parallel manual process.

What's new:

  • Access request notifications delivered in Microsoft Teams

  • Inline approve and deny from the Teams message, with no redirect

  • Requester and reviewer communication in-thread through the request lifecycle

  • Same policy enforcement and audit trail as Slack

Benefits:

  • Stop missing approvals because notifications land in the wrong tool

  • Cut the manual workaround for Microsoft-first organizations

  • Approve a request without opening the Lumos web app

Set up in Admin Settings → Notifications → Teams. Requires the Lumos App Store and a Microsoft Teams workspace.

Help Center Article

🔌 Integrations

Existing Connector Improvements

Provisioning and configuration improvements landed across nine connectors this month, so you can model more of your access use cases on integrations you already run.

What's new:

  • HashiCorp: account and entitlement provisioning

  • CrowdStrike: account and entitlement provisioning

  • Google Play Store and Apple App Store: account and entitlement provisioning

  • Adyen: email and SSO provisioning

  • LDAP: multiple connections to the same host

  • AWS: list all permission set and account combinations

  • JDBC: Windows authentication support

  • Active Directory: connect using group managed service accounts (gMSA)

Benefits:

  • Model more use cases on connectors you already run

  • Provision directly into more of your app portfolio

  • Cut manual account and entitlement work in these systems

Generally available at launch.

New Connectors

Two new integrations, including a generic connector for any REST-based system that doesn't have a purpose-built one yet.

What's new:

  • Universal REST Connector [BETA] for REST systems with a simple identity model

  • SAP GRC [BETA] surfaces segregation-of-duties (SoD) risk-violating users

  • SAP GRC [BETA] links violating access to business roles, technical roles, and applications

Benefits:

  • Cover apps that have no purpose-built connector

  • Bring SAP SoD violations into your access picture

  • Provision directly from Lumos to support pre-IdP work

Generally available at launch. Find both in the Available tab on the Integrations page, and note that SAP GRC syncs risk-violating users only, not all SAP GRC users.

Coming soon

  • Standardized Access Changes: One consistent path for every access change

  • ITSM Configuration: Configure your ticketing integration without support

  • Access Reviews and Lifecycle on the new platform: Account and entitlement removals, onboarding, movers, offboarding

  • Remediation Workflows: Agent-suggested fixes that run through Flows