>

Base Layer EP 06: Ari Shamash on Your Agent Shouldn't Have Your Password

 [Listen now]
Back to Changelog
SEPTEMBER 2026

AuthZed September 2026 Release

AuthZed Materialize is now generally available for AuthZed Dedicated. This release cycle also adds Terraform support for Materialize, Oso Cloud migration support in the spicedb-dev AI agent plugin, and a SpiceDB security fix.

AuthZed Dedicated

AuthZed Materialize Is Generally Available

AuthZed Materialize runs alongside SpiceDB and precomputes the permissions you configure it to watch. By precomputing selected transitive relationships in SpiceDB, AuthZed Materialize delivers consistent performance for the authorization logic keeping large scale AI and Enterprise workloads secure.

Materialize also powers Accelerated Queries, which uses Materialize's precomputed permissions store to answer the SpiceDB queries your application already makes, without changing how you call SpiceDB:

  • Speed up CheckPermission and CheckBulkPermissions.
  • Speed up LookupResources and LookupSubjects, especially when there is a large number of resources.

Existing AuthZed Dedicated customers can enable Materialize against their current commitment. Read the announcement or learn more about Materialize.

Terraform and OpenTofu: Materialize Deployments (v0.7.0)

The AuthZed Terraform and OpenTofu provider adds an authzed_materialize_deployment resource for managing Materialize deployments as code: watched permissions, templates, replica counts, and Accelerated Queries, with in-place updates, drift detection, and import. Rejected configurations now fail fast with the offending setting named, and API errors across all resources now include field-level detail.

This resource currently uses an internal API version without compatibility guarantees. See the provider documentation for details.

SpiceDB

Security Fix (v1.56.2)

If you collect SpiceDB traces and pass your datastore connection string as a command-line argument, those traces could include the connection string and its credentials. Upgrade to v1.56.2, and rotate your datastore credentials if this applies to you. Settings passed as environment variables were not affected. See GHSA-jf7w-wx43-32gc.

Reliability Fixes (v1.56.2)

  • Lower memory use on CockroachDB: memory no longer grows steadily over time on read-heavy workloads.
  • Less datastore load: schema caching works as intended again, so SpiceDB makes fewer trips to the database. Cache metrics now report correctly.
  • Schema fixes: type annotations (use typechecking) now work with prefixed definition names such as example/user.
  • Datastore fixes: Spanner respects the configured garbage collection window, MemDB returns consistent results for reads at a given revision, and readiness checks allow more time for databases in distant regions.

SpiceDB Operator

Rollout Status Fixes (v1.26.1 / v1.27.0)

Cluster status now accurately reflects rollout progress and shows errors when an update fails to apply. The operator also supports upgrading to SpiceDB v1.56.2.

Client Libraries

  • Go (authzed-go v1.11.0): updated to the latest AuthZed API, including support for resuming large relationship deletions that run in batches.

Developer Tools

spicedb-dev Plugin: Oso Cloud Migration and New Docs

The spicedb-dev plugin for AI coding agents adds an Oso Cloud conversion pack, so it can now help migrate from OpenFGA, Okta FGA, and Oso Cloud onto SpiceDB. A new Build with your AI agent guide in the docs covers installing the plugin in Claude Code or Codex CLI and using it to design, implement, and test SpiceDB authorization. The plugin is distributed through the AuthZed marketplace.