Skip to main content
Theme: The Access Control Plane for AI This release extends Lumos governance and access control to AI agents, chat tools, and enterprise workflows, and adds a safety layer between policy creation and enforcement. Highlights
  • Access Request - MCP [BETA] — Request access from Slack, Glean, or any AI agent
  • Access Policy Drafts — Create, edit, and review policies before you publish
  • Agentic UARs on Account Reviews — AI Keep/Remove insights and suggestions on account reviews
  • Admin-Configured UAR Table Views — Curate reviewer views and columns
  • Onboarding on New Table Platform — Bulk-cancel runaway onboardings before they fan out
  • Sync Observability [available June 16th] — See every sync, every entity, every stage
  • Sync Circuit Breakers [BETA - available June 16th] — Stop bad upstream sync data at the door
  • File Attachments on Tasks — Attach evidence directly to access decisions
  • May Connector Improvements — Deeper Drata, StrongDM, Tableau, AD, Okta coverage

​
Intelligence and AI

Access Request - MCP [BETA] Lumos catalog intelligence, policy engine, and approval workflows are now callable through the Model Context Protocol. Any MCP-compatible AI agent, e.g., Glean, a Slack bot, an ITSM copilot, or a custom internal agent, can classify an employee’s intent, build a least-privilege access request, validate it against your policies, and submit it without the employee opening Lumos. What’s new:
  • classify_request maps natural-language intent to the right app and permission tier
  • construct_access_request builds a least-privilege draft with conversation-pulled justification
  • Eligibility checks run server-side: duplicates, entitlements, policy constraints
  • submit_access_request creates the record with full audit trail and returns approver ETA
  • Employee confirmation required before any AI-initiated submission
Benefits:
  • Cut context switching — employees request from the tool they’re already in
  • Deflect routine “Can I request this?” questions from your IT queue
  • Surface peer access data and justification to approvers automatically
  • Standardize on least-privilege defaults without retraining employees
Available in Beta — reach out to your CSM to participate. Help Center Article Developer Docs

​
Access Reviews

Agentic UARs on Account Reviews Agentic User Access Reviews (UAR) now extend from entitlement-based reviews to account-based reviews. Reviewers see AI Insights and an AI Suggested decision — Keep or Remove — for every account in scope, so they spend their time on cases that need judgment instead of rubber-stamping the rest. What’s new:
  • AI Suggests column recommends Keep or Remove on every account
  • AI Review Insights column surfaces categorized rationale (inactivity, unusual access, role alignment, etc.)
  • One-click accept on suggestions or override with your own decision
  • Enabled by default via the existing AI Insights toggle
Benefits:
  • Finish account reviews faster across the largest part of your program
  • Make more confident, defensible Keep/Remove decisions
  • Extend AI assistance to 100% of your reviews, not just entitlement reviews
  • Catch inactive and anomalous accounts at a glance
Help Center Article Admin Configured UAR Table Views [Releasing June 5th, 2026] Lumos Admins, Access Review Admins, Campaign Owners, and Access Review App Admins can now configure which columns reviewers see on entitlement-based reviews, and in what order. The configuration applies to every reviewer of that app and persists across review stages and campaigns. Reviewers can still apply local tweaks and click Reset to return to the admin-saved view. What’s new:
  • Configure column visibility and order per app from the review table
  • Save Layout applies to every reviewer across all campaigns for that app
  • Each stage has its own saved view; later stages inherit from earlier ones
  • Reviewers can override locally and Reset back to the admin-saved layout
  • Save Layout works at any time during a review
Benefits:
  • Give reviewers the right context to decide instead of figuring it out
  • Standardize the reviewer experience per app
  • Make room for AI Insights and AI Suggests by curating which columns earn the space
Help Center Article
Lifecycle Management Onboarding on New Table Platform The Onboarding workflow table moves to the new Lumos table platform, completing the lifecycle management migration alongside Movers and Offboarding. The headline addition: bulk cancel onboarding workflows — including in-progress onboardings, which previously could not be cancelled at all. What’s new:
  • Cancel in-progress and scheduled onboardings as a single-row or bulk action
  • Search workflows by identity name with full filter/sort parity
  • Consistent UX with Movers, Offboarding, Apps, and Access Reviews
  • Cancel safety: new subflow steps halt, completed steps stay, non-cancellable rows skip cleanly
Benefits:
  • Stop a bad onboarding batch before it fans out into downstream access requests
  • Resolve cleanup yourself instead of opening a support ticket
  • Triage faster with the same patterns you use on Movers and Offboarding
  • Get full parity across all three joiner/mover/leaver tables
Help Center Article Access Policy Drafts Access policies no longer go live the moment they’re created. New policies — manual or Albus-drafted — land in a Draft state and stay unenforced until you explicitly publish them and make them Active. You get a review stage between creation and enforcement, with a clean separation between what’s live and what’s pending. What’s new:
  • Manual policy creation defaults to Draft and does not enforce
  • Albus creates policies in Draft by default for admin review
  • New Drafts and Published tabs on the Access Policies page
  • Publish CTA converts a draft into published policy
  • Multiple overlapping drafts allowed; uniqueness validated at publish
Benefits:
  • Keep broken or incomplete policies out of production
  • Let security, IT, and app owners weigh in before policies publish
  • Adopt Albus policy creation with a safety net
  • Stage policy migrations and publish on your timeline
No configuration required — newly created policies default to draft once rollout reaches your domain. Existing policies are unchanged.
Platform File Attachments on Tasks Approvers and requesters can now attach supporting files — signed approvals, justification memos, control attestations, screenshots — directly to AppStore access request tasks. Attachments live on the same record an auditor opens, so evidence stays connected to the decision it backs. What’s new:
  • Upload CSV, PDF, PNG, JPEG, or DOCX files up to 15 MB on a task
  • Attachments appear in the task drawer alongside comments and activity
  • Uploads and deletions written to the audit trail with reviewer name and timestamp
Benefits:
  • Keep audit evidence on the same record an auditor already opens
  • Cut audit prep by removing reconciliation with external storage
  • Capture justification once, at the moment of the decision
  • Reduce approver context-switching to email or shared drives
Available on AppStore and Lifecycle Management tasks at launch. UAR task support follows later as that surface migrates to the new task framework. Sync Observability [available June 16th] A new Sync Status surface on every integration’s Integrations tab shows every sync from the last 7 days. In-progress runs update in place with a LIVE indicator. Toggle between Entity view (Accounts, Identities, Entitlements) and Pipeline view (Acquiring, Installing, Coalescing) to see exactly where a sync is and how long each stage took. What’s new:
  • Sync Status UI on every integration page with 7 days of history
  • LIVE indicator on in-progress runs with elapsed time updating in place
  • Entity view and Pipeline view toggle
  • Per-entity stage timing and record counts
  • Visibility into Data Acquisition, Transformation, Installation, and Coalesce stages
  • Open prior-day runs to walk through stage durations
Benefits:
  • Answer “did the sync run?” yourself instead of filing a ticket
  • Triage stale-data questions in seconds with concrete timing context
  • Trust data freshness for downstream reviews, requests, and audits
  • Cut sync-related escalations to support
No configuration required — Sync Observability activates automatically for customers on Lumos Full Integration Sync. Help Center Article Sync Circuit Breakers [BETA - available June 16th] A validation layer that checks sync data against Lumos managed thresholds before it’s written to Lumos. When a breaker fires under ENFORCE, the offending pipeline is marked Blocked, downstream stages move to Waiting, and the run surfaces an inline Expected / Actual / Threshold callout. Vendor outages and integration regressions stop at the door instead of mirroring into Lumos and your downstream systems. What’s new:
  • Lumos managed thresholds on mass deprovisioning, entitlement deletion, identity spikes, critical field updates
  • Four modes — DISABLED, SHADOW, ALERT_ONLY, ENFORCE — to ramp on your timeline
  • Blocked syncs surface inline with Expected / Actual / Threshold callouts
  • Downstream stages move to Waiting until the block is investigated
  • Alerting-only breakers for anomalies that warrant attention without blocking
Benefits:
  • Stop accidental mass-deprovisioning before it propagates to Okta, Active Directory, AWS IAM, Workday, or any other systems
  • Catch integration regressions at the boundary, not after damage spreads
  • Expand Lumos coverage into more provisioning-sensitive flows with confidence
  • Give audit and security teams an explicit data-correctness guarantee
Available in Beta — reach out to your CSM to participate.
Integrations May Connector Improvements Continued investment across existing connectors so customers can model more of the configurations they actually run. What’s new:
  • NHI Integrations
    • AWS IAM
    • Github
    • Entra ID
  • ADP Workforce Now
    • Additional custom attribute support
  • Active Directory
    • Re-hire provisioning support
    • Specify which field is chosen for username in AD
  • AWS
    • Re-hire provisoning support
  • Slack
    • Re-hire provisioning support
  • Expensify
    • “Approves to” field added in Create Account action
  • Netsuite
    • Provisioning with custom attributes (create / update)
    • Role on Account Creation made optional
  • SAP Concur
    • Sync custom account attributes
  • Lucid
    • Sync and Provision Licenses
  • SCIM
    • Added application/scim+json content-type support
Benefits:
  • Cover more real-world configurations without custom workarounds
  • Model unique access patterns natively
  • Use connectors more deeply across your environment
Generally available at launch — new capabilities appear automatically on the relevant integrations.
Coming soon
  • Albus Chat GA on Enabled Syncs — Albus reaches general availability for sync-enabled customers
  • Integrations API [BETA] — Manage Lumos integrations through API and Terraform
  • Lumos API V1 [BETA] — General-purpose API for catalog, policies, and requests
  • AppStore Configuration MCP [BETA] — Configure AppStore approvers and policies via AI agents
  • Access Policy Insights — See how your policies are actually behaving to inform your maintenance and updates