[{"data":1,"prerenderedAt":868},["ShallowReactive",2],{"changelog-\u002Fchangelog\u002F2026\u002F06\u002Fdevice-agent-v4-released\u002F":3,"changelog-recent":204},{"id":4,"title":5,"authors":6,"body":8,"date":183,"description":184,"extension":185,"issues":186,"meta":188,"navigation":197,"path":198,"seo":199,"sitemap":200,"stem":201,"subtitle":202,"__hash__":203},"changelog\u002Fchangelog\u002F2026\u002F06\u002Fdevice-agent-v4-released.md","Device Agent v4 released",[7],"nick-oleary",{"type":9,"value":10,"toc":173},"minimark",[11,21,26,29,57,62,72,75,79,86,89,92,102,106,109,112,123,126,130,133,136,140,143,156,162,164],[12,13,14,15,20],"p",{},"Device Agent v4 is a major release. It brings a modern Node.js runtime, structured logging for production observability, a new authentication method, and a more secure container deployment model. There are breaking changes - check the ",[16,17,19],"a",{"href":18},"#upgrading-to-v4","upgrade notes"," before updating your remote instances.",[22,23,25],"h2",{"id":24},"nodejs-22-is-now-the-default-runtime","Node.js 22 is now the default runtime",[12,27,28],{},"The Device Agent installer and official Docker image now default to Node.js 22. Node.js 20 reached end-of-life in April 2026, and continuing to ship it as the default would leave devices running on an unsupported runtime without security patches. It is also the minimum version required by Node-RED v5.",[30,31,32,44,47,50,54],"caution",{},[12,33,34,38,39,43],{},[35,36,37],"strong",{},"Breaking change:"," The Device Agent Docker image tagged ",[40,41,42],"code",{},"latest"," now uses a Node.js 22 base image. If you do not pin your container image to a specific version tag, review your deployment configuration before upgrading.\n{% endcaution %}",[12,45,46],{},"We also continue to build, and tag, containers for a range of Node.js versions - 18, 20, 22 and 24.",[12,48,49],{},"If you use the Device Agent installer, it will now default to Node.js 22. Existing installations using the installer will need to download the latest version and re-run the installer.",[22,51,53],{"id":52},"containers-now-run-as-an-unprivileged-user","Containers now run as an unprivileged user",[12,55,56],{},"The Device Agent Docker container no longer runs as the root user. Following best practices, processes inside the container now execute as an unprivileged user.",[12,58,59,61],{},[35,60,37],{}," If your container deployment mounts volumes or relies on file permissions set for the root user, you'll need to update those permissions to match the new unprivileged user.",[12,63,64,65,71],{},"More details are available in the ",[16,66,70],{"href":67,"rel":68},"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fdevice-agent\u002Ftree\u002Fedf987872b7c93170b5ced56061b211619e7e106#docker",[69],"nofollow","Device Agent readme",".\n{% endcaution %}",[12,73,74],{},"This is a security hardening change with no functional impact on normal Device Agent operation.",[22,76,78],{"id":77},"structured-json-logging","Structured JSON logging",[12,80,81,82,85],{},"The Device Agent now supports a JSON logging format, selectable via the ",[40,83,84],{},"--log-format json"," CLI flag.",[12,87,88],{},"Previously, all agent output was plain-text - readable in a terminal but difficult to ingest reliably into log aggregation tools like Grafana Loki, Elastic, or AWS CloudWatch. Parsing unstructured log lines with regex is fragile and breaks whenever the message format changes.",[12,90,91],{},"With JSON logging enabled, every log entry is a machine-readable object with consistent fields. Pipe agent output directly into your existing observability stack without any custom parsing rules.",[93,94,99],"pre",{"className":95,"code":97,"language":98},[96],"language-text","device-agent --log-format json\n","text",[40,100,97],{"__ignoreMap":101},"",[22,103,105],{"id":104},"bearer-token-authentication","Bearer token authentication",[12,107,108],{},"The Device Agent now supports bearer tokens as an authentication method for HTTP endpoints, alongside the existing credential model.",[12,110,111],{},"This allows you to create HTTP endpoints in your Node-RED flows that can be accessed securely by other applications without needing to manually authenticate first. This is a capability we've had in Hosted Instances for a while - this release makes it available to Remote Instances as well.",[12,113,114,115,118,119,122],{},"You can configure the tokens via the FlowFuse dashboard for your remote instance under the ",[40,116,117],{},"Settings->Security"," section. Enable the ",[40,120,121],{},"FlowFuse User Authentication"," option, then you can create and manage the tokens.",[12,124,125],{},"This requires the FlowFuse v2.32 release, coming later this week, when running in a self-hosted environment, but already available on FlowFuse Cloud.",[22,127,129],{"id":128},"editor-theme-fix","Editor theme fix",[12,131,132],{},"A bug caused the FlowFuse editor theme to fail to load in certain configurations - particularly when switching between Node-RED 5 and legacy versions. This is now resolved. The correct theme loads regardless of which Node-RED version the device is running.",[134,135],"hr",{},[22,137,139],{"id":138},"upgrading-to-v4","Upgrading to v4",[12,141,142],{},"Before upgrading, check the following:",[12,144,145,148,149,151,152,155],{},[35,146,147],{},"Docker users:"," The ",[40,150,42],{}," container image now uses a Node.js 22 base and runs as an unprivileged user. Review volume mount permissions and update any configurations that assume a root user or an earlier Node.js version. Details available in the ",[16,153,70],{"href":67,"rel":154},[69],".",[12,157,158,161],{},[35,159,160],{},"Installer users:"," Download the latest version of the installer and re-run it if you want to stay aligned with the new default.",[134,163],{},[12,165,166,167,172],{},"Device Agent v4 is available now. Update via the ",[16,168,171],{"href":169,"rel":170},"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fdevice-agent",[69],"Device Agent installer"," or pull the latest Docker image.",{"title":101,"searchDepth":174,"depth":174,"links":175},4,[176,178,179,180,181,182],{"id":24,"depth":177,"text":25},2,{"id":52,"depth":177,"text":53},{"id":77,"depth":177,"text":78},{"id":104,"depth":177,"text":105},{"id":128,"depth":177,"text":129},{"id":138,"depth":177,"text":139},"2026-06-29","Device Agent v4 ships with Node.js 22 as the default runtime, structured JSON logging, bearer token authentication, and a hardened container security model. This is a major release with breaking changes - read on to know what to update before upgrading.","md",[187],"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fdevice-agent\u002Fissues\u002F650",{"tags":189,"excerpt":191},[190],"changelog",{"type":9,"value":192},[193],[12,194,14,195,20],{},[16,196,19],{"href":18},true,"\u002Fchangelog\u002F2026\u002F06\u002Fdevice-agent-v4-released",{"title":5,"description":184},{"loc":198},"changelog\u002F2026\u002F06\u002Fdevice-agent-v4-released","Updated Node.js, JSON logging, bearer token auth, and a more secure container runtime.","mRrZn5UeaJmKpfaxohewP2cLPJ9DJDE60u2H7OkSoYE",[205,263,329,393,466,794],{"id":206,"title":207,"authors":208,"body":209,"date":251,"description":252,"extension":185,"issues":253,"meta":255,"navigation":197,"path":257,"seo":258,"sitemap":259,"stem":260,"subtitle":261,"__hash__":262},"changelog\u002Fchangelog\u002F2026\u002F07\u002Fdevice-agent-onboarding.md","Getting started with FlowFuse straight from the terminal",[7],{"type":9,"value":210,"toc":249},[211,214,217,220,229,241],[12,212,213],{},"FlowFuse Device Agent allows you to remotely manage Node-RED instances running on your hardware, for example, devices on your factory floor.",[12,215,216],{},"Getting your own hardware into FlowFuse meant working backwards. You signed up, found the remote instance section, learned what the Device Agent was, created the instance in the platform, copied its connection details, and only then ran the installer with that code in hand.",[12,218,219],{},"Now you can start where the hardware already is. Run the installer from your terminal and it walks you through registering — including setting up an account if you need one — ending with your machine registered as a remote instance and ready to build on. If something's in the way — like port 1880 already being in use — the installer tells you up front instead of failing partway through.",[12,221,222,223,228],{},"Check the ",[16,224,227],{"href":225,"rel":226},"https:\u002F\u002Fflowfuse.com\u002Fdocs\u002Fdevice-agent\u002Fquickstart\u002F",[69],"Device Agent Quick Start guide"," to get connected.",[12,230,231,237],{},[232,233],"img",{"alt":234,"dataZoomable":101,"src":235,"style":236},"The installer running in a terminal, walking through sign-up and connection to FlowFuse","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fdevice-agent-install.gif","border: 2px solid #E5E7EB;",[238,239,240],"em",{},"Sign-up and registration happen in one uninterrupted flow — no jumping back to the platform.",[12,242,243,247],{},[232,244],{"alt":245,"dataZoomable":101,"src":246,"style":236},"The interactive registration takes you straight through to the Node-RED editor once connected","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fdevice-agent-registration.png",[238,248,245],{},{"title":101,"searchDepth":174,"depth":174,"links":250},[],"2026-07-30","Onboard a remote instance directly from your terminal with a new interactive setup",[254],"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fdevice-agent\u002Fissues\u002F678",{"tags":256},[190],"\u002Fchangelog\u002F2026\u002F07\u002Fdevice-agent-onboarding",{"title":207,"description":252},{"loc":257},"changelog\u002F2026\u002F07\u002Fdevice-agent-onboarding",null,"O2b8S8itC249DaAH2k624XwmRnP4G4UVFZIPzAg1SI0",{"id":264,"title":265,"authors":266,"body":268,"date":318,"description":319,"extension":185,"issues":320,"meta":322,"navigation":197,"path":324,"seo":325,"sitemap":326,"stem":327,"subtitle":261,"__hash__":328},"changelog\u002Fchangelog\u002F2026\u002F07\u002Fexpert-tables-automation.md","FlowFuse Expert Can Now Work With Your Tables",[267],"andrea-palmieri",{"type":9,"value":269,"toc":316},[270,273,280,289,300,313],[12,271,272],{},"FlowFuse Expert can now look up your FlowFuse Tables databases directly. Ask it to list the databases on your team, show you the tables in a database, or describe a table's schema, and it calls the right tools and reports back, without you needing to open the Tables view yourself. It can also preview a table's data: up to 10 rows, exactly as stored.",[12,274,275,276,279],{},"This is a fixed, read-only preview, not a query engine: there's no filtering, sorting, or paging through it, and no writes. For anything beyond that quick look, the Expert can help you build it as a flow with the ",[40,277,278],{},"tables-query"," node instead.",[12,281,282,286],{},[232,283],{"alt":284,"dataZoomable":101,"src":285},"The Expert listing the tables in a FlowFuse Tables database, grouped by schema","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fchat.png",[238,287,288],{},"The Expert listing a database's tables, grouped by schema",[12,290,291,292,295,296,299],{},"Alongside this, FlowFuse Tables now correctly supports tables that live in a schema other than ",[40,293,294],{},"public",". Previously, viewing data for a table outside the default schema could fail. Tables and their schema now show up correctly throughout the Tables UI: next to each table name in the list, and as ",[40,297,298],{},"schema_name.table_name"," (with a copy button) in the table detail view.",[12,301,302,306],{},[232,303],{"alt":304,"dataZoomable":101,"src":305},"The Tables explorer showing each table's schema next to its name, and the qualified schema.table name with a copy button in the header","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Ftables-view.png",[238,307,308,309,312],{},"The schema label beside each table name, and the qualified ",[40,310,311],{},"schema.table"," name with a copy button in the header",[12,314,315],{},"This feature is available to FlowFuse Hub and FlowFuse Edge customers on Cloud and Self Hosted from v2.33",{"title":101,"searchDepth":174,"depth":174,"links":317},[],"2026-07-28","The Expert can now list your FlowFuse Tables databases, inspect table schemas, and preview a sample of a table's rows on your behalf, and Tables now works correctly with schemas other than public.",[321],"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fflowfuse\u002Fissues\u002F7989",{"tags":323},[190],"\u002Fchangelog\u002F2026\u002F07\u002Fexpert-tables-automation",{"title":265,"description":319},{"loc":324},"changelog\u002F2026\u002F07\u002Fexpert-tables-automation","Cb4qhm3EjSp7AF9wlMBln0yMWtOiUVe7AmduedFo7a4",{"id":330,"title":331,"authors":332,"body":334,"date":382,"description":383,"extension":185,"issues":384,"meta":386,"navigation":197,"path":388,"seo":389,"sitemap":390,"stem":391,"subtitle":261,"__hash__":392},"changelog\u002Fchangelog\u002F2026\u002F07\u002Fteam-and-application-dashboards.md","A Dedicated Home for Your Dashboards",[333],"noley-holland",{"type":9,"value":335,"toc":379},[336,346,349,358,362,365,374],[12,337,338,339,342,343,345],{},"Your dashboards now have a home. A new ",[35,340,341],{},"Dashboards"," entry in the team navigation lists every dashboard across your hosted instances in one place. Open one and it loads right inside FlowFuse, not in a separate browser tab. Each application also has its own ",[35,344,341],{}," tab, showing just the dashboards from that application's instances.",[12,347,348],{},"Until now, dashboards were tucked behind an \"Open Dashboard\" button on individual instance pages. Finding the one you wanted meant hunting through instances, and each one opened in a new tab. Now you get one place that shows them all, at the team or application level.",[12,350,351,355],{},[232,352],{"alt":353,"dataZoomable":101,"src":354},"The Dashboards view listing all dashboards across the team","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fteam-dashboards.png",[238,356,357],{},"Every dashboard in the team, each showing whether its instance is currently running",[22,359,361],{"id":360},"switch-between-dashboards-in-place","Switch between dashboards in place",[12,363,364],{},"A drawer lets you switch to any other dashboard in a single click, without returning to the list. Jump from your \"Line 3 OEE\" dashboard to \"Energy Monitoring\" and back without losing your place. Instance status updates live in the drawer, so you can see at a glance which dashboards are ready.",[12,366,367,371],{},[232,368],{"alt":369,"dataZoomable":101,"src":370},"An embedded dashboard with the drawer open to switch between dashboards","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fdashboard-drawer.png",[238,372,373],{},"The drawer stays open alongside the dashboard, so switching doesn't cover what you're viewing",[12,375,376],{},[238,377,378],{},"This feature is available to all users of FlowFuse Cloud and all Self Hosted users from v2.33.",{"title":101,"searchDepth":174,"depth":174,"links":380},[381],{"id":360,"depth":177,"text":361},"2026-07-22","Browse and open every dashboard across your team from a new Dashboards view, without leaving FlowFuse.",[385],"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fflowfuse\u002Fissues\u002F7665",{"tags":387},[190],"\u002Fchangelog\u002F2026\u002F07\u002Fteam-and-application-dashboards",{"title":331,"description":383},{"loc":388},"changelog\u002F2026\u002F07\u002Fteam-and-application-dashboards","cJ_6FJG9x11-C52tpKQfl3bD7sCl4JAcJI72vUyRI3Q",{"id":394,"title":395,"authors":396,"body":398,"date":455,"description":456,"extension":185,"issues":457,"meta":459,"navigation":197,"path":461,"seo":462,"sitemap":463,"stem":464,"subtitle":261,"__hash__":465},"changelog\u002Fchangelog\u002F2026\u002F07\u002Fapplication-sso-groups.md","Application Roles from SSO Groups",[397],"ben-hardill",{"type":9,"value":399,"toc":453},[400,403,406,414,436,450],[12,401,402],{},"Application level Role overrides can now be managed by SSO Group membership.",[12,404,405],{},"As well as Team wide Role membership additional groups can be used to apply Role overrides to specific Applications.",[12,407,408,409,155],{},"This works for both SAML and LDAP based SSO, the documentation outlining the required group naming can be found ",[16,410,413],{"href":411,"rel":412},"https:\u002F\u002Fflowfuse.com\u002Fdocs\u002Fadmin\u002Fsso",[69],"here",[12,415,416,417,420,421,424,425,428,429,432,433,435],{},"For example for a Team with the slug ",[40,418,419],{},"development"," and an application called ",[40,422,423],{},"test"," a user in the following groups would have ",[40,426,427],{},"member"," level access to the Team and ",[40,430,431],{},"owner"," level access to the ",[40,434,423],{}," Application.",[437,438,439,445],"ul",{},[440,441,442],"li",{},[40,443,444],{},"ff-development-member",[440,446,447],{},[40,448,449],{},"ff-development[test]-owner",[12,451,452],{},"This is available to FlowFuse Cloud Teams now and will be available to Self Hosted customers from version 2.33.0 onwards.",{"title":101,"searchDepth":174,"depth":174,"links":454},[],"2026-07-15","Control Application level Role overrides from SSO Groups",[458],"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fflowfuse\u002Fissues\u002F7396",{"tags":460},[190],"\u002Fchangelog\u002F2026\u002F07\u002Fapplication-sso-groups",{"title":395,"description":456},{"loc":461},"changelog\u002F2026\u002F07\u002Fapplication-sso-groups","Ai8qxgCGkacybac36MZJ1JbjFUhFFKEU4WIGJ4DncKo",{"id":467,"title":468,"authors":469,"body":472,"date":785,"description":786,"extension":185,"issues":261,"meta":787,"navigation":197,"path":789,"seo":790,"sitemap":791,"stem":792,"subtitle":261,"__hash__":793},"changelog\u002Fchangelog\u002F2026\u002F07\u002Fexpert-enhancements.md","FlowFuse Expert Enhancements",[470,471,267],"stephen-mclaughlin","serban-costin",{"type":9,"value":473,"toc":774},[474,478,481,491,499,507,516,520,523,540,543,547,550,553,562,566,569,574,577,583,609,612,621,625,628,631,642,652,661,665,668,671,691,694,703,715,724,758,767,769],[22,475,477],{"id":476},"insights","Insights",[12,479,480],{},"With the release of device-agent 4.0.0 and FlowFuse 2.32.0, FlowFuse Expert Insights Agent can now work with Remote Instances and Self Hosted Instances.",[30,482,483,488],{},[12,484,485],{},[35,486,487],{},"Important:",[12,489,490],{},"In order to achieve Insights on Remote Instances and Self Hosted Instances,  we had to modify how data is routed through the platform. Your old Hosted Instances on FlowFuse Cloud will require an update to the latest Launcher Version (2.23.0 or greater) to continue working.",[12,492,493,497],{},[232,494],{"alt":495,"dataZoomable":101,"src":496},"Resource from Hosted and Remote Instances can now be selected","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Finsights-1.png",[238,498,495],{},[12,500,501,505],{},[232,502],{"alt":503,"dataZoomable":101,"src":504},"Insights querying a Remote Instance","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Finsights-2.png",[238,506,503],{},[12,508,509,513],{},[232,510],{"alt":511,"dataZoomable":101,"src":512},"Insights in an action","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Finsights.gif",[238,514,515],{},"Insights in an action - querying a Remote Instance",[22,517,519],{"id":518},"platform-automations","Platform Automations",[12,521,522],{},"The Expert can now take action on your FlowFuse platform directly. Instead of telling you which buttons to click, it can create instances, register devices, take snapshots, and manage applications on your behalf. You can ask the Expert to:",[437,524,525,528,531,534,537],{},[440,526,527],{},"Create hosted instances with the right type, stack, and template, optionally starting from a flow blueprint",[440,529,530],{},"Register remote instances (devices) and assign them to applications",[440,532,533],{},"Take and list snapshots of both hosted and remote instances",[440,535,536],{},"Create applications, list what's running inside them, and check their audit logs",[440,538,539],{},"Look up live status and logs for any hosted instance, or query a remote instance's state over MQTT",[12,541,542],{},"Behind the scenes, FlowFuse exposes over 30 automation tools covering instances, devices, applications, snapshots, teams, and configuration. When you ask the Expert to do something, it picks the right tools, calls them with your permissions, and reports back.",[22,544,546],{"id":545},"better-formatted-replies","Better Formatted Replies",[12,548,549],{},"Expert replies now render markdown more fully in the chat panel. Tables, ordered lists, blockquotes, and checklists all display with proper formatting instead of falling back to plain text, making longer, more structured answers much easier to scan.",[12,551,552],{},"Tables come with a copy button that copies the contents as tab-separated values, ready to paste straight into a spreadsheet.",[12,554,555,559],{},[232,556],{"alt":557,"dataZoomable":101,"src":558},"An Expert reply showing a formatted table, ordered list, and checklist","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fmarkdown-rendering.png",[238,560,561],{},"A formatted reply with the tab-separated copy button in the table's top-right corner",[22,563,565],{"id":564},"support-agent","Support Agent",[12,567,568],{},"We have added three ways to stay in control of what the Expert does while it works alongside you in the editor.",[570,571,573],"h3",{"id":572},"plan-mode","Plan Mode",[12,575,576],{},"The Expert can now propose a plan before it changes anything, so you can review the approach before it touches your flows.",[12,578,579,580,582],{},"Turn on ",[35,581,573],{}," with the toggle in the chat composer. Instead of acting straight away, the Expert lays out what it intends to do as a plan you can read through. From there you can:",[437,584,585,591,597,603],{},[440,586,587,590],{},[35,588,589],{},"Approve",": the Expert proceeds with the plan.",[440,592,593,596],{},[35,594,595],{},"Edit",": open the plan in the composer, adjust the wording yourself, and send it back.",[440,598,599,602],{},[35,600,601],{},"Request changes",": describe what you would like to be different, and the Expert proposes an updated plan.",[440,604,605,608],{},[35,606,607],{},"Reject",": discard the plan and start again.",[12,610,611],{},"This is ideal for larger or unfamiliar changes, where you want to agree on the approach before any work happens.",[12,613,614,618],{},[232,615],{"alt":616,"dataZoomable":101,"src":617},"The Expert proposing a plan, with Approve, Edit, Request changes, and Reject actions","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fplan.png",[238,619,620],{},"The Expert proposes a plan and waits for your approval before making any changes",[570,622,624],{"id":623},"clarifying-questions","Clarifying Questions",[12,626,627],{},"The Expert now asks clarifying questions when a request could go more than one way, rather than guessing and building the wrong thing.",[12,629,630],{},"When it needs more detail, the Expert presents up to four questions in a single turn, each as a set of options you pick from, either single choice or multiple choice. You answer them all together, and it uses your answers to get the result right the first time. For example:",[437,632,633,636,639],{},[440,634,635],{},"Which flow should this run in?",[440,637,638],{},"Should the incoming payload be stored, forwarded, or both?",[440,640,641],{},"Which of these nodes should trigger the alert?",[12,643,644,645,648,649,155],{},"You can revisit and change your answers before continuing, and you decide the pace: use the follow-up questions setting in the composer menu to have the Expert ask everything ",[35,646,647],{},"all at once"," or ",[35,650,651],{},"one at a time",[12,653,654,658],{},[232,655],{"alt":656,"dataZoomable":101,"src":657},"The Expert asking grouped clarifying questions with single and multiple choice options","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fquestions.png",[238,659,660],{},"The Expert asks clarifying questions and collects your answers before acting",[570,662,664],{"id":663},"human-in-the-loop","Human in the Loop",[12,666,667],{},"You are now in charge of exactly which actions the Expert is allowed to take on your flows, so no change happens that you did not permit.",[12,669,670],{},"When the Expert wants to run an action that needs your sign-off, it pauses and shows an approval card in the chat. The card names the action, whether it reads, writes, or deletes, and the exact details of what it will do, with four choices:",[437,672,673,682],{},[440,674,675,648,678,681],{},[35,676,677],{},"Allow",[35,679,680],{},"Deny",": approve or refuse this one action.",[440,683,684,648,687,690],{},[35,685,686],{},"Always allow",[35,688,689],{},"Always deny",": apply your choice to every matching action.",[12,692,693],{},"The Expert waits for your decision however long you need, and you can cancel a pending action at any time with the stop button.",[12,695,696,700],{},[232,697],{"alt":698,"dataZoomable":101,"src":699},"An inline approval card showing the action, its type, and Allow, Always allow, Deny, and Always deny choices","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fapproval-card.png",[238,701,702],{},"The Expert pauses and asks for approval before running an action that needs your sign-off",[12,704,705,706,648,708,710,711,714],{},"An ",[35,707,686],{},[35,709,689],{}," you set from a card applies to the current chat only, and resets when you refresh or start over. If you want to keep it, click ",[35,712,713],{},"Make permanent"," to save that choice for future chats.",[12,716,717,721],{},[232,718],{"alt":719,"dataZoomable":101,"src":720},"Clicking Make permanent on a granted action to save it for future chats","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fmake-permanent.gif",[238,722,723],{},"Make a per-chat permission permanent so it carries over to future chats",[12,725,726,727,730,731,734,735,738,739,742,743,734,746,749,750,753,754,757],{},"You can also set your permissions ahead of time. Open ",[35,728,729],{},"Tool permissions"," in the Expert settings and choose a default for ",[35,732,733],{},"Read",", ",[35,736,737],{},"Write",", and ",[35,740,741],{},"Delete"," actions: ",[35,744,745],{},"always allow",[35,747,748],{},"ask",", or ",[35,751,752],{},"always deny",". Out of the box the Expert can read freely but asks before it writes or deletes anything. Flow building and platform actions each have their own defaults, and you can expand ",[35,755,756],{},"Individual tools"," to override the default for a specific action, which then stays put until you reset it. These settings are saved for you and persist across chats within the team you are working in; switching to another team starts from the defaults again.",[12,759,760,764],{},[232,761],{"alt":762,"dataZoomable":101,"src":763},"The Tool permissions panel in Expert settings, with default Read, Write, and Delete permissions for flow building and platform tools","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Ftools-permissions.png",[238,765,766],{},"Set default permissions per action type, and override individual tools where you need to",[134,768],{},[12,770,771],{},[238,772,773],{},"All of these new features are available to FlowFuse Cloud users and Self-Hosted users from v2.32.",{"title":101,"searchDepth":174,"depth":174,"links":775},[776,777,778,779],{"id":476,"depth":177,"text":477},{"id":518,"depth":177,"text":519},{"id":545,"depth":177,"text":546},{"id":564,"depth":177,"text":565,"children":780},[781,783,784],{"id":572,"depth":782,"text":573},3,{"id":623,"depth":782,"text":624},{"id":663,"depth":782,"text":664},"2026-07-02","FlowFuse Expert now supports Insights on your devices, Platform automations, Plan Mode, Human in the Loop and more...",{"tags":788},[190],"\u002Fchangelog\u002F2026\u002F07\u002Fexpert-enhancements",{"title":468,"description":786},{"loc":789},"changelog\u002F2026\u002F07\u002Fexpert-enhancements","xAyhVzS9-iTHEPKGJdpA4yMFu6zcTml5E1qGtHl8hGc",{"id":795,"title":468,"authors":796,"body":797,"date":785,"description":786,"extension":185,"issues":859,"meta":861,"navigation":197,"path":863,"seo":864,"sitemap":865,"stem":866,"subtitle":261,"__hash__":867},"changelog\u002Fchangelog\u002F2026\u002F07\u002Fscoped-pats.md",[471],{"type":9,"value":798,"toc":853},[799,802,806,809,812,816,819,823,826,829,833,836,842,845],[12,800,801],{},"Personal Access Tokens now support fine-grained scoping. You can restrict a token to specific teams, limit it to read-only operations, or control whether it\ncarries admin privileges. This is especially useful when handing tokens to AI agents or MCP clients, where you want to limit what the token can reach.",[22,803,805],{"id":804},"team-scoping","Team scoping",[12,807,808],{},"You can now scope a token to one or more teams. A scoped token can only access resources within those teams. If you don't select any teams, the token works\nacross all teams you belong to, same as before.",[12,810,811],{},"When you're added to a new team, scoped tokens don't automatically pick it up. You need to explicitly add the new team to any token that should have access.",[22,813,815],{"id":814},"read-only-mode","Read-only mode",[12,817,818],{},"A new toggle lets you mark a token as read-only. When enabled, the token can only perform read operations across all resources it has access to. Any write\noperation will be rejected.",[22,820,822],{"id":821},"admin-opt-in","Admin opt-in",[12,824,825],{},"Tokens created by admin users no longer carry admin privileges by default. When you create a new token, it behaves as a regular user token, using your team\nroles instead of full admin access. If you need the token to have admin capabilities, you have to explicitly check the admin opt-in option.",[12,827,828],{},"Existing admin-owned tokens have been migrated with admin opt-in enabled, so they continue to work as before. Only newly created tokens default to\nnon-admin.",[22,830,832],{"id":831},"how-scoping-works","How scoping works",[12,834,835],{},"These options allow you to narrow the scope of a token's permissions; you cannot create a token with more access than your user has.",[12,837,838,839,155],{},"You can create and manage your tokens under ",[35,840,841],{},"User Settings > Security > Personal Access Tokens",[12,843,844],{},"This feature is available to FlowFuse Cloud users as of now and Self-Hosted users from v2.33.",[12,846,847,851],{},[232,848],{"alt":849,"dataZoomable":101,"src":850},"Creating a new scoped Personal Access Token","\u002Fchangelog\u002F2026\u002F07\u002Fimages\u002Fscoped-pats.png",[238,852,849],{},{"title":101,"searchDepth":174,"depth":174,"links":854},[855,856,857,858],{"id":804,"depth":177,"text":805},{"id":814,"depth":177,"text":815},{"id":821,"depth":177,"text":822},{"id":831,"depth":177,"text":832},[860],"https:\u002F\u002Fgithub.com\u002FFlowFuse\u002Fflowfuse\u002Fissues\u002F7411",{"tags":862},[190],"\u002Fchangelog\u002F2026\u002F07\u002Fscoped-pats",{"title":468,"description":786},{"loc":863},"changelog\u002F2026\u002F07\u002Fscoped-pats","SWS24JifltxnWHGl4jp189QGuolpRZWqNjTO-4o1UpI",1785508485280]