v0.1.15

Release v0.1.15: 2026-06-30

This release is a ground-up rebuild of policy and access control. It introduces Programmable Policy Engine v2 with signed, tamper-evident bundles, and a complete RBAC overhaul with granular permissions and self-service role management.

Included updates:

  • Apex Platform (v0.1.15)
  • Fystack UI (v0.1.15)

New Features

Programmable Policy Engine v2

A new policy engine evaluates withdrawal and contract-call actions against configurable rules, replacing the previous engine.

Highlights:

  • Evaluates withdrawal and contract-call actions against configurable rules
  • Conflict detection across rules
  • Full rule-builder UI for defining conditions, wallet targeting, and approval-group bindings

See Policies for the rule fields and condition syntax.

Signed Policy Bundles

Policy bundles and cache entries are now cryptographically signed and verified, so policy that is served or cached can be checked for tampering.

Highlights:

  • Policy bundles are cryptographically signed and verified
  • Cache entries are covered by the same verification
  • Served or cached policy can be checked for tampering

Custom Role Management

Admins can now define their own roles instead of choosing from a fixed list.

Highlights:

  • Create, edit, and delete custom roles from a new role management UI
  • Permission matrix prevents granting access above your own level

Granular Permissions

Workspace-level permissions were broken up so access can be granted per module rather than all at once.

Highlights:

  • Coarse workspace-level permissions split into per-module read/write permissions
  • Legacy implicit wallet-role system removed in favor of explicit wallet assignments
  • The guest role was retired in favor of viewer

Live Policy Reload

RBAC and policy changes now sync and reload without a service restart.

Summary

Apex v0.1.15 is the policy and access control release:

  • Programmable Policy Engine v2 evaluates withdrawals and contract calls against configurable rules, with conflict detection and a rule-builder UI
  • Signed policy bundles make served and cached policy tamper-evident
  • Custom role management lets admins define roles themselves, bounded by their own access level
  • Granular permissions replace coarse workspace-level access with per-module read/write control
  • Live policy reload applies RBAC and policy changes without a restart