>

Base Layer EP 06: Ari Shamash on Your Agent Shouldn't Have Your Password

 [Listen now]
Back to Changelog
JULY 2026

AuthZed July 2026 Release

This release cycle introduces an AI assistant in the SpiceDB Playground, an in-process embedded mode for SpiceDB, and a round of datastore reliability fixes.

Developer Tools

SpiceDB Playground Assistant

The SpiceDB Playground now includes an AI assistant. Describe the permissions model you want, and it writes and edits your schema, generates relationship data and assertions to test it, runs permission checks, and explains why a check was granted or denied, all without leaving the browser. It keeps a revision history for the session so you can roll back and try a different direction. Read the announcement.

spicedb-dev Plugin for Codex CLI

The spicedb-dev plugin for AI coding agents can now be installed through Codex CLI's own plugin marketplace, alongside Claude Code. See the AuthZed marketplace for install steps.

SpiceDB

Embedded Permission Checks (v1.56.0)

Go applications can now embed SpiceDB and run permission checks directly in-process, without deploying a separate SpiceDB server.

Faster Checks for Caveat-Heavy Schemas (v1.56.0)

Permission checks are faster on schemas that use caveats. SpiceDB now prepares each caveat once per schema version instead of on every check.

Reliability Fixes (v1.56.0)

  • Fewer stalled requests: a slow or dropped database connection no longer holds up other requests.
  • MySQL: write deadlocks are fixed, and reads perform more consistently.
  • CockroachDB: relationships removed by automatic expiration no longer appear as deletions in the Watch API.
  • Clearer errors: clients now receive descriptive error messages instead of raw database errors, with full detail kept in server logs.
  • Safer memory defaults: when SpiceDB can't detect its memory limit, as on AWS ECS, it now sizes its caches conservatively.
  • Other fixes: IP-range caveats (in_cidr) now match IPv4 addresses written in IPv6 form, several rare crashes are fixed, and a gRPC dependency is updated to address GHSA-hrxh-6v49-42gf.

A new metric also reports how many permission checks were granted.

SpiceDB Operator

Configurable PodDisruptionBudget (v1.26.0)

You can now configure the PodDisruptionBudget for SpiceDB clusters, to control how many pods Kubernetes may take down at once during maintenance. The operator also warns about common configuration mistakes and supports SpiceDB's new MySQL identifier migration.

Client Libraries