New in v2026.8.1

OpenIAM version 2026.8.1 introduces Privacy Management as a new platform module and delivers the next generation of identity risk configuration.

The Privacy Management module arrives in this release as a complete foundation: a canonical privacy schema tied to OpenIAM identities, a durable event backbone with delivery guarantees, an immutable consent ledger with live current-state projection, a governed registry of processing purposes and lawful authorities, evidence capture for every privacy action, and a dedicated Privacy Administration Console for day-to-day operations. Risk intelligence continues its evolution with a new Risk Factor Catalogue and per-population risk policies — different groups can now be scored by different factor sets — plus a new Membership-Duration risk factor and a rebuilt Risk Score Configuration screen. Access certification gains side-by-side entitlement comparison and risk-driven scoping improvements. The release also validates PostgreSQL 18 and ships a large wave of SoD and synchronization bug fixes.

New features

Privacy Management

OE-4606 – Privacy kernel: canonical schema, tenancy, and identity
The foundation of the Privacy Management module. Introduces the canonical privacy schema with tenant and identity relationships in the supported databases, establishing the identity kernel the other Privacy Management capabilities build on. Customers gain the underlying structure needed to manage consent, lawful purposes, and privacy events for their user population inside OpenIAM.

OE-4608 – Privacy event backbone
A durable event pipeline for privacy records, with delivery guarantees and reconciliation. Privacy events — a consent given, a purpose activated, an evidence item recorded — travel through a reliable envelope with retry and reconciliation. If a downstream consumer misses a message, the system can reconcile from source instead of losing the record.

OE-4609 – Consent ledger with current-state projection
An event-sourced ledger of every consent action, together with a live current-state view. Every grant, withdrawal, and modification of consent is appended to an immutable ledger; a projection derived from the ledger answers "what is this user's current consent state?" in real time. Consent events are only accepted where consent is actually the lawful basis for processing, so the full history of any consent decision is available on demand for regulator or subject-access requests.

OE-4610 – Purpose, activity, and lawful authority registry
A governed registry of processing purposes, the activities that use them, and the lawful authorities that justify them. Administrators register each processing purpose with owner, data categories, audience, permitted channels, and lawful authority reference. Processing activities are recorded with explicit associations to the purposes they serve. Lawful authorities — both consent-based and non-consent-based — are typed and carry validity windows. A governed lifecycle keeps a single active version per purpose or activity and auto-deprecates prior versions; non-consent authorities allow processing without consulting the consent ledger.

OE-4613 – Privacy evidence, audit, and reporting
Every privacy state change writes an evidence record with the actor, subject, purpose, and outcome. Records feed audit views inside OpenIAM and can be shipped to a SIEM, providing the audit trail needed for privacy compliance without a separate logging system.

OE-4620 – Privacy Administration Console
A new console area for privacy operators covering day-to-day management of purposes, consents, activities, and privacy events, plus operational health indicators. The console includes an operator queue for items that need attention — missing authority, reconciliation gaps — and health readouts for the event backbone.

Identity risk management

OE-4697 – Risk factor catalogue and per-population risk policies
A new risk configuration model that separates reusable risk factors from population-specific risk policies. Administrators maintain a catalogue of risk factors with their applicability rules, then attach chosen factors to a population — "contractors in Europe" or "privileged accounts" — so different groups are scored by different rules without duplicating factor logic. A factor test endpoint runs a draft factor against a sample subject before the change is saved. New administration screens are available in the Webconsole for both the catalogue and policies. See Risk factors configuration.

OE-4452 – Membership-duration risk factor
A built-in risk factor that raises the score of a grant based on how long a user has held it. Long-held roles and group memberships contribute more to a user's risk score than freshly granted ones. The factor is included in the standard factor catalogue and can be attached to any risk policy. See Risk factors configuration and Membership tags.

OE-4629 – Live risk during in-flight campaigns with factor explanations
When something that affects risk changes mid-campaign — a new grant, a role change, a dormancy update — affected review items update rather than showing the launch-time score. Reviewers can hover the risk shield on any item to see the individual factors that contributed to its score. See Risk factors configuration and Risk driven certification.

Access certification

OE-4437 – Risk-driven access certification configuration
Administrators can now set a minimum membership-risk threshold on a certification so that only grants at or above that level enter the review scope. Auto-certify rules act on the same risk view the reviewer sees, so items pre-approved at launch are consistent with what a reviewer would decide. The launched campaign captures the risk thresholds that were in effect, preserving an auditable record of the risk scope each campaign used. See Risk driven certification and Risk factors configuration.

OE-4507 – Side-by-side entitlement comparison during certification
Reviewers can now pick a baseline user — for example, a peer in the same job — and see a paged, side-by-side diff of direct and inherited role and group memberships for the reviewed user versus the baseline. Not-yet-effective and already-expired memberships are excluded, and historical review outcomes and revoker names are shown where available. See Campaign dashboard.

Access control

OE-4446 – Purpose-Based Access Control console
A new administration console for Purpose-Based Access Control (PBAC) with rollout controls and a simulation mode. Administrators can define PBAC policies and roll them out gradually — shadow mode (evaluated but not enforced), partial rollout by percentage, or full enforcement. A simulation runner shows what a policy would decide for a given user and request without changing anything and without writing audit entries. The decision log records which policies applied and the rollout mode they were in at the time.

OE-3717 – Disable delegate access request per application
Administrators can now turn off delegated access requests on individual applications from Managed System settings. End users requesting access to those applications no longer see the option to delegate the request on someone else's behalf — enforcing that access is always requested by the recipient, which is required for regulated and personal-account systems.

Enhancements and tasks

Identity risk management

OE-4453 – Rebuilt Risk Score Configuration screen
The Risk Score Configuration screen has been rebuilt against the new risk factor and policy model. The old single-scope configuration screen is replaced with catalogue-plus-policy screens. Administrators can configure factor parameters directly on the built-in factors without custom code. See Risk factors configuration.

Access certification

OE-4695 – Certified vs. revoked split on grouped review rows
Grouped rows in the UAR v2 User and Entitlement views now show how many items were certified versus revoked, not just how many are complete. Campaign managers can spot rows with a high revoke rate at a glance without opening every grouped row. See Campaign dashboard.

OE-4764 – Reviewer improvements in SelfService v2 certifications
Several refinements to the SelfService v2 certification reviewer experience: membership risk in the reviewer grid now stays current as risk is recomputed instead of being frozen at campaign launch; items auto-certified at launch are visible to the reviewer by default and marked with a system-preset indicator; and Dashboard "due today" and "past due" counts now match what the campaign search returns for the same filters.

Platform

OE-4628 – PostgreSQL 18 support
OpenIAM is now validated for use with PostgreSQL 18. Database schema migrations run cleanly on PostgreSQL 18, and reference container images used for testing and demonstration are updated accordingly.

OE-3817 – Refreshed localisation for nine languages
Updated translations for English, French, Spanish, German, Portuguese, Chinese, Japanese, Danish, and Swedish. Danish and Norwegian locale codes were corrected to their standard forms (da_DK and nb_NO), so the correct translation bundles resolve for those languages and Danish and Norwegian users no longer see the interface fall back to English.

Bug fixes

Segregation of Duties

OE-3579 – Stale violations cleared after a policy is removed
Fixed an issue where violations recorded against a deleted or deactivated policy kept appearing on the Violations tab indefinitely. A full detection sweep now confirms which violations still apply and clears the ones tied to policies that no longer exist or are no longer active.

OE-3582 – Clear error when a Hard SoD policy blocks a grant
Fixed an issue where adding a user to a role or group conflicting with a Hard SoD policy returned a generic "unknown error." The blocked grant now returns a clear message identifying the conflicting policy and is no longer recorded as an active violation for the user.

OE-3583 – Policy rename reflected on existing violations immediately
Fixed an issue where existing violation records kept showing the old policy name after a rename. The rename is now applied to violation records in the same operation that saves the policy, and deactivating a policy clears its violations at the same time.

OE-4118 – Consistent Hard SoD error in the classic user view
Fixed an issue where adding a conflicting entitlement via the classic user view returned an unhelpful generic error. The classic view now returns the same "blocked by policy X" message that the modern views produce.

OE-4119 – Same start and end date no longer bypasses the Hard SoD check
Fixed an edge case where setting identical start and end dates on an entitlement caused the Hard SoD check not to fire, allowing a conflicting grant through. The Hard SoD check now runs regardless of date shape.

OE-4134 – Deleted policies no longer listed on the Violations tab
Fixed an issue where deleted policies kept appearing as sources of violations long after removal. A full unscoped detection sweep now prunes violations belonging to deleted or recreated policies from every user's record.

OE-4579 – Hard SoD violations visible while the policy is active; no phantom entries after deletion
Fixed several related issues: Hard policy violations were never listed on the Violations tab while the policy was active; deleting the policy produced phantom entries; and saves carrying a "skip SoD check" flag could wipe a user's violation records for unrelated policies. Hard policies now show their violations while active, deletion no longer produces phantom entries, and skip-check saves no longer overwrite other policies' violations.

OE-4635 – Specific error message for invalid CSV uploads to the SoD Rule Set Catalog
Fixed an issue where an invalid CSV upload was rejected with "unexpected error." The catalog now returns a specific validation message identifying what was wrong — empty file, file too large, unsupported format, or too many rules. See Rule Set Catalog.

OE-4636 – Invalid JSON or XML rule sets explain the parse failure
Fixed an issue where an unparseable JSON or XML rule set silently reported "0 valid rules" with no explanation, and rule element names with different casing were rejected. Malformed uploads now explain what could not be parsed, and element names are matched flexibly. See Rule Set Catalog.

OE-4637 – SoD Rule Set Catalog activation buttons readable in all states
Fixed an issue where the "Activate Selected" and "Confirm Activation" buttons showed black text on a black background when disabled on hover. The disabled state now uses a contrasting label.

OE-4719 – Violations tab search filter returns correct results
Fixed an issue where filtering the Violations tab by a generated policy's rule key returned every policy in the rule set, and filtering by policy name could return no rows. The filter now matches on the actual policy name and rule key without over-matching or dropping rows.

OE-4754 – SoD rule set activation reports per-rule failures and runs atomically
Fixed an issue where a rule referencing an entitlement with no name aborted the whole activation with "Operation Failed" and left the catalog in a partial state. Rules needing attention are now reported per rule; name validation happens at save time; and activation runs in a single transaction. See Rule Set Catalog.

OE-4755 – Entitlements created during rule set activation carry the target managed system
Fixed an issue where entitlements created as a side effect of rule set activation did not carry the target managed system, so they appeared to belong to no system and did not show up in the expected views. See Rule Set Catalog.

OE-4792 – SoD detection sweep reports progress and no longer silently skips users
Fixed multiple silent failure modes in the SoD detection sweep: missing users were dropped without notice, one user's evaluation failure aborted remaining users, paging could skip users, and a locked run gave no indication. The sweep now reports users evaluated, violators found, entries cleared, and users skipped; single-user failures no longer abort the sweep; paging is deterministic; and a lock contention says so plainly.

OE-4843 – Failed SoD evaluation no longer deletes the user's violation records
Fixed an issue where a failed evaluation — caused by a broker or authorization-manager outage — produced an empty violation set that was treated as "no violations," silently deleting every affected user's records. Failed evaluations are now excluded from the stale-violation cleanup, and blocked Hard grants no longer produce active violation records.

OE-4845 – "Allow selected" hidden until exemption workflow is available
Fixed an issue where the Violations tab's "Allow selected" action referred to a policy exemption workflow that has not yet been reimplemented, so choosing it did nothing useful. The action is hidden until the exemption feature returns.

Access certification

OE-4724 – Original reviewer retains campaign visibility after delegating
Fixed an issue where a reviewer was removed from the campaign's reviewer set once their delegate finished, losing visibility of the items they had kept for themselves. Delegation now adds the delegate without removing the original reviewer.

OE-4725 – Certification reviewers see their campaigns in SelfService
Fixed an issue where users assigned as certification reviewers did not see any certifications listed under UAR in SelfService. Reviewers now see the certifications assigned to them in the SelfService UAR list.

OE-4741 – Whole-row certify in UAR v2 runs the risk and SoD gate
Fixed an issue where certifying a grouped row in one click bypassed the risk and SoD check that individual-item certification runs. Whole-row certify now shows the reviewer any risk or SoD warnings before the certification proceeds.

Synchronization

OE-4718 – CSV sync no longer drops all rows due to inverted empty-row filter
Fixed an issue where the filter meant to skip blank rows was inverted, causing every populated row to be skipped and every sync to produce an empty batch.

OE-4743 – Sync no longer drops records under concurrent writers
Fixed an issue where concurrent writers to the shared save buffer could overwrite each other, causing already-processed records never to reach the save call. Buffer access is now synchronised so every processed record is saved.

OE-4750 – Sync report complete under concurrent writers
Fixed an issue where concurrent writes to the sync report could overwrite each other, leaving entries missing from the final report. Report writes are now safe under concurrent access.

OE-4752 – Current State report complete on multi-node clusters
Fixed an issue where report chunks were written to local disk on whichever node produced them, so a report assembled on a different node was missing chunks. Report chunks now go to shared storage so any node can assemble the full report.

OE-4757 – Sync audit correctly attributes actions to the initiating user
Fixed an issue where overlapping sync runs could record one user's identifier against another user's login. The audit now verifies the cached requester belongs to the current run before reusing it; a service account without a default login is recorded as "UNDEFINED" and the batch continues.

OE-4768 – Unpaired sync records reported for all source types
Fixed an issue where unmatched source rows were only recorded in the sync report for CSV syncs; on connector, RDBMS, and LDAP sources they disappeared silently. Unpaired records are now reported for every source type with the specific reason they could not be matched.

Authentication and user management

OE-4413 – Reset password methods appear in the dropdown
Fixed an issue where the Reset Password Methods dropdown under Administration → System Configuration → Password displayed no methods.

OE-4721 – Forgot Password page shows available authentication options
Fixed an issue where the Forgot Password page loaded with an empty authentication section — no security questions, no OTP options. Available options are now displayed.

OE-4728 – Reconciliation runs when triggered from the console
Fixed an issue where reconciliation endpoints were not reachable, so reconciliation operations initiated from the console did not run.

OE-4729 – Removing a phone number syncs to Google Workspace
Fixed an issue where removing a phone number in OpenIAM did not clear the number in Google — the deleted value was still being sent. Removed phone numbers are now excluded from the update sent to Google.

OE-4745 – Template saves succeed with supervisor and email field configurations
Fixed two issues: saving with a supervisor field could fail even when the supervisor was set correctly, and templates that excluded the email field threw an error on save from the Webconsole. When a required field is missing the error message now names the field.

OE-4749 – New Hire Approval workflow completes after upgrade
Fixed an issue where in-flight approvals stored using pre-2022 class names failed to deserialize after upgrade. The workflow engine now recognises the old class names and reads persisted data using the current data types, allowing in-flight approvals to continue and complete.

OE-4790 – Forced first-login password change fires exactly once
Fixed an issue where users completing the forced first-login password change were redirected back to the change-password screen on every subsequent login. The forced-change state is now cleared once the user has changed their password and successfully re-authenticated.

Minor updates

• Privacy Management module introduced: consent ledger, purpose registry, lawful authority governance, privacy event backbone, evidence capture, and a dedicated Privacy Administration Console.
• Risk Factor Catalogue and per-population risk policies enable different scoring rules for different user groups.
• Membership-Duration added as a built-in risk factor; Risk Score Configuration screen rebuilt to match the new model.
• Side-by-side entitlement comparison available in certification reviewer views.
• PostgreSQL 18 validated; localization refreshed for nine languages including corrected Danish and Norwegian locale codes.
• Comprehensive SoD stability fixes across violation tracking, rule set activation, detection sweep reliability, and catalog upload error handling.
• Synchronization fixes: inverted row filter, concurrent write safety, multi-node report assembly, and audit attribution.