September 2026 Changelog

Monthly Cosmos platform change summary for September 2026

changelogmonthly

Updated 2026-09-28

Verified 2026-09-28

Verified Change Summary

Generated by the documentation refresh from registered service and consumer changes since 2026-09-01. Curated release highlights should be written above this generated block when a month needs user-facing notes.

Type	Changes	Services
Feature	84	ADK, Chat, Configurator, Email, Frontend, JumpStart AMS Backend, JumpStart AMS Frontend, JumpStart SAP Intelligence, JumpStart Workbench, MCP Tools Server, Observer, PII Redactor, RAGflow, Storage, TypeScript SDK, User Service, Voice
Bugfix	64	ADK, Configurator, Email, Frontend, JumpStart AMS Backend, JumpStart AMS Frontend, JumpStart SAP Intelligence, JumpStart Workbench, MCP Tools Server, Observer, RAGflow, User Service
Security	35	ADK, Configurator, Frontend, JumpStart AMS Backend, JumpStart AMS Frontend, JumpStart SAP Intelligence, JumpStart Workbench, PII Redactor, Python SDK, TypeScript SDK, User Service
Breaking	0	None
Ops	0	None
Docs	3	JumpStart Workbench, Python SDK, TypeScript SDK
Chore	51	ADK, Configurator, Frontend, JumpStart AMS Backend, JumpStart AMS Frontend, JumpStart SAP Intelligence, JumpStart Workbench, Observer, User Service

Service Change Backfill Coverage

Service	Feature	Bugfix	Security	Docs	Chore	Total
ADK	9	5	5	0	9	28
Chat	2	0	0	0	0	2
Configurator	10	2	3	0	2	17
Email	1	1	0	0	0	2
Frontend	10	5	2	0	4	21
JumpStart AMS Backend	8	2	2	0	7	19
JumpStart AMS Frontend	4	1	2	0	6	13
JumpStart SAP Intelligence	13	12	5	0	9	39
JumpStart Workbench	2	22	5	1	10	40
MCP Tools Server	2	2	0	0	0	4
Observer	8	6	0	0	1	15
PII Redactor	1	0	1	0	0	2
Python SDK	0	0	1	1	0	2
RAGflow	3	2	0	0	0	5
Storage	1	0	0	0	0	1
TypeScript SDK	4	0	2	1	0	7
User Service	5	4	7	0	3	19
Voice	1	0	0	0	0	1

Top feature areas by change count: General Service Changes (84), Frontend And Assistant UX (32), Observability And Metrics (29), Authentication And Authorization (26), Developer Tooling (19), SAP Workbench (19), Evaluation And Review (8), Storage And Files (5).

Highlights

Project RBAC — first-class project management lands across the platform. User Service introduces project-scoped roles, entitlements, and shadow-mode PDP logging. Configurator adds per-project resource enablement and ownership scoping. ADK enforces execution scopes on prompt-only mapped requests. The frontend ships a full projects UI with native RBAC alignment.
JumpStart native Cosmos RBAC — JumpStart SAP completes migration from local project membership to Cosmos-native project roles and entitlements, including entitlement backfill, journey-grant reprojection, and catalog reconciliation.
SDK service authentication — both TypeScript and Python SDKs add client_credentials grant support for service-to-service auth. TypeScript SDK adds acquireServiceToken() and fromServiceCredentials(). Python SDK adds ServiceAuthManager and from_client_credentials(). JumpStart SAP's manual service auth is replaced with the SDK.
Prompt caching refinement — ADK adds agent-scoped history-tail cache breakpoints (opt-in). Configurator persists prompt_caching config. Frontend adds KV caching toggle to agent details.
Headroom compression proxy — ADK, Configurator, TypeScript SDK, and Frontend collaborate on optional per-agent Headroom compression routing for Anthropic models.
Cosmos Code matures — session cost refresh, MCP operations in workspace mode, negotiated workspace-context capability, and strict resume behavior.
Azure Monitor migration — ADK, Configurator, MCP, Storage, and User Service migrate structured logging to Azure Monitor.
Offline evaluations — ADK adds experiment-run statistics. Configurator adds dataset stats with per-agent breakdown. Frontend ships one-call Apply flow for eval prompt suggestions.

Service Changes

ADK

Type	Change
feat	Native execution-scope enforcement for prompt-only mapped requests
feat	Project-scoped PDP dispatch for agent execution (V1 + V2)
feat	Agent-scoped history-tail prompt cache breakpoint (opt-in)
feat	Experiment-run statistics endpoint with per-agent breakdown
feat	Optional Headroom proxy routing for Anthropic (per-agent, fail-open)
feat	Inert `project_id` plumbing for future project-scoped enforcement
fix	Project-scoped PDP dispatch for agent execution (V1 + V2)
fix	Rename and enhance subject user ID resolution for OBO
ops	Migrate ADK logs to Azure Monitor

Chat

Type	Change
feat	Forward `project_id` / `project_name` to ADK via header and body field
feat	Migrate chat logs to Azure Monitor

Cosmos Code

Type	Change
feat	Negotiated Cosmos workspace-context capability and strict resume
feat	Thread `cosmosProjectId` through the Cosmos runtime
fix	Allow session cost refresh and MCP operations in workspace mode
fix	Stop the Cosmos route from inventing answers on tool timeout
fix	Use secure randomness for Checkmarx findings
security	Resolve 27 Dependabot alerts and all 3 code-scanning alerts

Configurator

Type	Change
feat	Per-project resource enablement, ownership scoping, and shadow-mode PDP
feat	Dataset stats endpoint with per-agent breakdown
feat	Persist per-agent Headroom compression preference
feat	Apply Suggestion candidate-graph and in-place updates for offline eval
feat	Add LLM provider and model fields to graph; enhance activity events
fix	Dispatch `tool_view`/`skill_view` to project-shaped PDP
fix	Restore service token compatibility
ops	Migrate configurator logs to Azure Monitor

Frontend

Type	Change
feat	First-class projects UI with native RBAC alignment and UUID migration
feat	Unlock route/nav gates via project-scoped permissions
feat	Persisted Headroom compression dropdown in agent config
feat	One-call Apply flow for offline-eval prompt suggestions
feat	KV (prompt) caching toggle in agent model config
feat	Dataset and experiment-run stats retrieval
feat	Metrics table enhancements
fix	Persist `prompt_caching` through resource-based agent save/load
fix	Add reasoning parameters to agent configuration
chore	Rename "Expenses" surfaces to "FinOps"

MCP

Type	Change
feat	Guardrails, knowledge graphs, and analyzer support for agent MCP tools
fix	Preserve array input types in API tools
fix	Remediate Mend direct-library findings
ops	Migrate MCP logs to Azure Monitor

Observer

Type	Change
feat	Price prompt-cache read discount and write premium
feat	Retire online-eval review routes; harden Kafka delivery
feat	Route platform events by `agent_id` sentinel
fix	Honour per-user session-limit override on the write path
fix	Remediate Aquasec CVE findings

Storage

Type	Change
ops	Migrate storage logs to Azure Monitor

User Service

Type	Change
feat	First-class project RBAC, entitlement management, and shadow-mode PDP
feat	Static read routes for Configurator project data
feat	Canonical graph permissions
feat	`write_logs` permission for frontend diagnostics
feat	Cosmos Quality Platform permission codes
feat	Limit-increase-request multi-scope notifications
fix	Project-scoped PDP dispatch for Guest-org-role + project-role users
fix	Allow blank `target_resource_type`/`target_external_ref` on entitlement create
fix	Grant `cosmos-jumpstart-ams-v1` ADK agent execute and chat initiate
fix	Allowlist `cosmos-observer-v3` for configurator reads

TypeScript SDK

Type	Change
feat	`acquireServiceToken()` — OAuth2 `client_credentials` grant
feat	`fromServiceCredentials()` — long-lived service client factory
feat	Optional `projectId` support in `CosmosClient`
feat	Persist Headroom settings in registry APIs
feat	`prompt_caching` in `AgentConfiguration` type
feat	Cost notices and limits client
fix	Make `audience` optional in `acquireServiceToken()`

Python SDK

Type	Change
feat	`ServiceAuthManager` — `client_credentials` token lifecycle
feat	`CosmosClient.from_client_credentials()` — service client factory
docs	Service credentials documentation

JumpStart SAP Intelligence

Type	Change
feat	Complete native Cosmos RBAC migration (project roles, entitlements)
feat	Entitlement backfill, journey-grant reprojection, catalog reconciliation
feat	Offload project membership/roles to native Cosmos projects
feat	SAP ATC with any system check variant and post-activation verify
feat	Save classic ABAP + DDIC objects from GUI journey
feat	`$TMP`/package save target with package and transport inputs
refactor	Replace manual service auth with SDK `acquireServiceToken()`
fix	Derive JumpStart role from capabilities when actor roles absent
fix	Propagate trusted journey context to connector tools
security	Remediate Wiz dependency CVEs

Summary

Metric	Count
Active services	19
Total commits	163
Features	68
Bug fixes	18
Security	8
Ops/infra	6