Server and Python SDK 3.1.0

DeepIntShield Server 3.1.0 and Python SDK 3.1.0 - 8 October 2026.

This release aligns the SDK, gateway, and documentation reference at 3.1.0. Check the version and enabled capabilities of your own gateway and worker; installing a Python package does not upgrade them.

Agent workspace and registration review

Agentic → Agents brings Needs attention, Agent inventory, Denied agents, Discovery, and Shared assets into one workspace. The sidebar also exposes MCP Registry, Identities, Policy & Access, and Activity. Older Assets and MCP bookmarks redirect to their current surfaces.

The same agent review opens from the queue and inventory. Its checklist covers Identity & owner, Code & changes, Tools & access, Runtime access, Validate changes, and Review & decide. Approval applies to the completed current blueprint and the exact selected action/resource access. Saved drafts and readiness indicators do not grant unconditional future execution.

Local tool identities and grants are scoped to the owning agent. Legacy workspace-wide local-tool grants require the current discovery/review path; agent_tool_identity_review_required identifies that migration gate. Obsolete agents can be permanently retired with a preview and explicit confirmation while preserving registration and decision evidence.

See Agentic operations and Activity evidence.

Optional server-managed LangGraph execution

An enabled workspace can accept a supported standalone LangGraph program once, retain it through identity/runtime/code/access review, and run it in an isolated server worker. Pending setup exits the client before graph execution while preserving the saved submission. With a gateway and SDK that support submission IDs, running the unchanged script again starts a new execution under the existing approved registration; clients without submission IDs get the same saved job, including its terminal result.

Source and dependency capture is bounded. The pinned worker must already have every package the program imports; it runs its own SDK, Python and package releases, so the client’s versions never need to match. Unsupported contexts fail explicitly. During an active managed run, action approval can resume the held call within its bounded wait without replaying completed graph nodes. Terminal and uncertain runs are not automatically replayed.

This mode supports autonomous gateway-runtime LangGraph programs and requires an explicitly configured worker. Local execution remains the default. See Server-managed agent execution for the operator flow, limitations, states, and recovery.

SDK and workload identity

• Native framework invocations consult authenticated runtime configuration. Disabled Agentic Security preserves native execution; malformed or unavailable runtime configuration stops governed execution safely.
• Gateway runtime authentication binds approved SDK signing keys and optional native cloud proof to the workload. Entra runtime credentials remain on the gateway; identity provisioning, runtime proof, and access approval stay separate steps.
• Source capture includes application decorators and bounded helpers while excluding actual SDK instrumentation. Native Google GenAI automatic Python callable tools use the same fail-closed source and authorization boundary.
• The stable error catalog now includes managed-execution, runtime-key, retired-agent, and tool-isolation outcomes.

See SDK Agentic integration and Workload identities.

Guardrail configuration

Policies, AI Models, and Safety Providers now have distinct setup flows. Creating a supported provider creates its linked published input policy, which can be selected on the intended Virtual Key. Real model detectors are configured through AI Models; migrated metadata.detector_model selections must be removed before an enabled policy can be saved. See Guardrails and Safety Providers.

Upgrade

python -m pip install --upgrade "deepintshield==3.1.0"
# For LangGraph and gateway runtime identity:
python -m pip install --upgrade "deepintshield[runtime,langgraph]==3.1.0"

Deploy Server 3.1.0/UI and, if enabled, a managed worker image that contains every package your programs import through your deployment channel. The worker runs its own SDK, Python and package releases; client SDK versions are recorded as evidence and never need to match it. Preserve existing identity, encryption, authorization, and audit state during upgrade. Validate a representative governed workflow before switching production traffic.

For upgrades from 2.x, the 3.0.0 RAG migration still applies: acl_tags is removed, and application/retriever authorization must run before content safety evaluation. allow_with_redaction remains an allowed decision. Deprecated MCP compatibility shims remain available in 3.1.0; prefer the native session interfaces for new integrations.