Integrations
Lovable, Vercel and Claude Enterprise
Three new integrations, each governed for exactly what its API allows and nothing more.
Read the detailChangelog
Everything we ship, as we ship it
New integrations, governance changes and fixes, newest first. Written for the people who use Lutril, not for a release note.
October 2026
7 changes
Offboarding
Offboarding runs on apps that never had an admin API
Slack deactivation, Figma seats, Notion and Keycloak expose nothing for removing an access. Save a service account once and Lutril uses it for the account writes an OAuth token cannot make.
Read the detail
Integrations
Connect an application we do not support yet
Describe an HTTP or GraphQL admin API in a connector spec, and Lutril governs that application like any other: roster, access reviews, grants and removals.
Read the detail
MCP Governance
MCP Discovery, rebuilt around the decision
The discovery screens were rebuilt around the verdict rather than the inventory. Every server carries its risk band and its review state.
Read the detail
MCP Governance
See the MCP servers your teams are already running
A read only agent, deployed by MDM, reads the config files of the 17 MCP clients on every laptop. It never runs what it finds.
Read the detail
MCP Governance
Policy on the arguments of a tool call, not just the tool
The gateway already decided who may call which tool on which server. It now decides with what values.
Read the detail
MCP Governance
Secrets and personal data stop at the gateway
Nothing read the payloads crossing the MCP path before. A vendor response carrying a customer's email no longer goes into a third-party model's context unexamined.
Read the detailSeptember 2026
2 changes
MCP Governance
A kill switch for MCP access
MCP access tokens are stateless, so until now there was no way to stop one before it expired. A block refuses every token and refuses to mint new ones.
Read the detail
Access Graph
Who has access to what, as one grid
A people by applications matrix, with a graph view beside it, covering human and non-human identities together.
Read the detailAugust 2026
2 changes
Non-Human Identities
Service accounts and keys get an owner
Non-human identities now have their own surface: collected from AWS and Google Cloud, tiered by risk, and each one answerable to a named person.
Read the detail
Lu AI
Lu AI answers questions about your own access data
Ask who still has standing access, or which agents nobody owns, and get an answer from this tenant's real governance data rather than from documentation.
Read the detailJuly 2026
1 change
June 2026
2 changes
DLP
Sensitive files get flagged to the person who owns them
Shared files are classified and the owner hears about it where they already work, in Slack or in Teams, according to the tenant rather than the file's provider.
Read the detail
Shadow IT
The browser extension finds the apps OAuth cannot see
OAuth discovery surfaces every app somebody authorised with Google or Microsoft. It cannot see the ones they signed up for with a work email and a password.
Read the detail