Entitle August 2026 release notes
Role-based access control for Entitle administrators
Entitle now includes three new admin roles: manager, integration admin, and read-only admin, so you can delegate administration without handing out full admin rights. Grant integration admin to the users or teams that maintain integrations, manager to the people who are responsible for other users or teams, and read-only admin to auditors and reviewers who need visibility but no ability to change anything. Least privilege now applies to Entitle itself, not just the resources it governs.
For more information see: Entitle roles, Grant Entitle roles to users and groups
ServiceNow access management improvement
The ServiceNow integration now supports access management to access controlled resources (tables, views, scripts, processors, UI page, UX data broker, GraphQL).
For more information, see ServiceNow.
Support for MongoDB Atlas private link
Entitle now supports integrations to MongoDB Atlas when using private link, , so you can manage access to your databases without exposing them to the public internet.
Learn more Configure Atlas MongoDB API key
Filter Permissions table by risk and sensitivity
Entitle pulls risk and sensitivity scoring from Identity Security Insights and renders it directly on users. You can now filter the Permissions table according to risk and sensitivity, so you can narrow a large permissions list down to the identities that need attention first.
For more information, see Identify risky and sensitive users
Personal access tokens scoped to Entitle roles
Personal access tokens (PAT) now carry the permissions of the role held by the token's owner (see Entitle roles), so API calls are limited to what that user can do in Entitle. This maintains least privilege across automated or API based actions.
For example, an Integration admin's token acts only on the integrations they own, a Read-only admin's token can read but not change anything, and list endpoints return only the records the token's role is permitted to see.
Rotate Entitle agents token from the portal
You can now rotate Entitle agent tokens in Entitle, so you can easily meet your organization's secret-rotation policy.
For more information, see Entitle agent token.
Entitle agent installation - custom KV mount paths in HashiCorp Vault
You can now specify a custom mount path when you configure a HashiCorp Vault secret manager, giving you more control over where your secrets are stored. Custom mount paths are supported for KV version 2 secrets engines.
Learn more:
