> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # March 2026 Product Release Notes ## Theme: From Intent to Access This month, the Access Request Agent lets employees describe what they need in plain language and guides them to a least-privilege, policy-compliant request automatically. A new ADP connector and a wave of improvements across Google Workspace, Salesforce, GitHub, and more extend Lumos coverage across your stack. New workflow controls provide admins more precise automation options. *** ## AppStore ### Access Request Agent \[Beta] The Lumos AppStore now has a built-in AI agent that turns plain-language intent into structured, least-privilege access requests. Instead of browsing a catalog and guessing at permission names, employees describe what they need to do - and the agent maps it to the right app, entitlement, duration, and business justification before submission. **What's new:** * Conversational access request experience embedded directly in the Employee AppStore * Intent classification that maps task descriptions to the right app and entitlement * Automatic business justification generation based on the employee's stated need * Pre-submission validation for eligibility, duplicates, existing access, and policy conflicts * Least-privilege defaults - if multiple entitlements could satisfy a request, the agent recommends the safest option * Falls back to the standard request form if confidence is low - employees are never stuck * Mobile-friendly design with a refreshed AppStore UI * No admin setup required - inherits your existing catalog, approval policies, and provisioning workflows **Benefits:** * Employees get access faster - guided requests in under 5 minutes vs. 9+ minutes of catalog browsing * Approvers receive decision-ready requests with full context on the first try, cutting clarification loops * Fewer over-privileged requests - least-privilege defaults reduce security escalations and denial/resubmission cycles * Zero risk to your existing governance - requests flow through the same approval chains as always *This feature is in Beta. Reach out to your CSM to get started.* [Help Center Article](/kb/appstore/configuring-your-appstore/access-request-agent-beta) *** ## Lifecycle Management ### Flow Step: Wait Until Onboarding workflows can now pause until a specific date is reached - anchored to an employee's actual Start Date, not the moment the workflow fired. This means provisioning happens at exactly the right time, regardless of when your HRIS synced the record. **What's new:** * New "Wait Until" step type in the LCM workflow builder * Supports Lumos Expression Language (LEL) for date offsets: provision 3 days before start date with `subtract_days(start_date, 3)`, or 7 days after with `add_days(start_date, 7)` * If the computed date has already passed, the workflow proceeds immediately - no errors, no blocks * Configurable error handling if Start Date is missing: cancel the workflow or skip the step and continue * Full visibility in workflow run logs - shows pause state, computed resume timestamp, and outcome per run **Benefits:** * Provisioning fires on the employee's timeline, not the HRIS sync schedule * Security policies with time-sensitive access windows (like MFA enrollment periods) are reliably enforced * Supports split onboarding flows - immediate actions on identity creation, date-delayed actions anchored to start date * Available in the LCM workflow builder for all customers with LCM enabled - no additional setup required [Help Center Article](/kb/appstore/configuring-your-appstore/wait-until-step) *** ## Policy Mining ### Knowledge Hub The Knowledge Hub is a new home for the organizational context that shapes how Lumos AI makes decisions. Admins can now define, view, and manage the rules and guidelines their AI agents use - things like how your organization identifies contractors, which apps have access nuances, or what permissions are expected for certain roles. **What’s new:** * A centralized table of Knowledge Entries, each with a name, instructions, scope (global or product-specific) and tag (relevant apps) * Filter entries by use case: General Instructions, Access Reviews, Policy Mining, Albus Chat, or Access Requests * Audit trail tracking who created or modified each entry and when the entry was last updated **Benefits:** * AI recommendations reflect your organization’s actual policies and nuances - not generic defaults * Admins can see exactly what context is shaping AI decisions, building trust in recommendations * Every change is auditable, supporting compliance requirements ### *Available in the Lumos side nav for all customers.* Ask Albus \[Beta] Ask Albus, Lumos’s AI-powered policy mining assistant, is now visible to all customers directly in the side nav. Albus helps IT and IAM teams build accurate, data-driven access policies from real usage patterns, and automate Day 1 provisioning for new hires. **What’s new:** * “Ask Albus” now appears in the side nav for all customers * Ask questions like “What access should a new engineer have?” and get AI-generated policy recommendations based on how your organization actually uses its apps * Knowledge Hub context integration - Albus recommendations now incorporate your org-specific rules **Benefits:** * Build access policies in hours instead of weeks - no more spreadsheet-based role mapping * New hires get the right access on Day 1 instead of waiting weeks for IT to sort it out * Policies are grounded in real usage data, not tribal knowledge or guesswork * Reduce access request ticket volume with automated birthright provisioning *Interested in getting started? Reach out to your CSM.* *** ## Integrations ### New Connector: ADP Workforce Now \[Beta] Lumos now connects directly to ADP Workforce Now for end-to-end user and access management. **What's new:** * Sync users, roles, and custom attributes * Create and update users including custom attributes * Assign and unassign access to roles * Delete users * Can be scoped to read-only **Benefits:** * Direct provisioning actions in Lumos without leaving the platform * Deeper visibility into workforce data for lifecycle automation * Supports pre-IDP initiatives for customers managing identity directly in ADP *Available now in the Integrations page under the Available tab.* *** ### Connector Improvements This month includes enhancements across existing connectors. **Google Workspace - Offboarding Actions**: A major expansion of offboarding coverage for Google Workspace. Admins can now trigger the following actions directly from Lumos: * Mobile Wipe Device * Delete App Specific Passwords * Forward Emails to Manager * Update User * Hide User in Directory * Sign User Out * Revoke OAuth Tokens * Transfer Google Group Ownership * Remove From Google Groups * Remove From Calendar Events * Remove Shared Calendars *These actions are behind a feature flag. Reach out to Support to enable.* **Okta** * Sync Okta Admin roles and OAuth App Scopes for fuller visibility into privileged access **PowerShell \[GA]** * Run any custom PowerShell script directly from within Lumos - now generally available **Salesforce** * Sync Permission Set Groups and Queues as new entitlement types, automatically fetched in future syncs **GitHub** * Instance Admins are now synced as an entitlement type and will be automatically fetched in future syncs **Blackline** * Sync Team information as a new entitlement type, automatically fetched in future syncs **Active Directory** * Remove a user from all groups except the domain group, with optional filtering to exclude specific groups from removal **ServiceNow** * Sync and provision to HR Profile Custom Attributes when creating and updating accounts **Atlassian** * Assign site-based role access across all Atlassian products **Benefits:** * Deeper coverage for offboarding and deprovisioning workflows across your stack * More entitlement types visible in Lumos without manual configuration * Custom automation flexibility via PowerShell for unique business requirements *** ## Identities *Coming the first week of April.* ### Lumos Members Moved to Settings The Lumos Members page has a new home. You'll now find it under **Settings** instead of the Identities tab - with a cleaner table view showing name, email, employment status, delegation status, and access level, all filterable, sortable, and searchable. **Benefits:** * Easier to find and manage who has access to Lumos and at what level * Cleaner separation between identity data and member management * View and manage delegation and access levels all in one place *A banner will guide you to the new location if you're used to finding it under Identities.*