Skip to main content
​
Tool permissions in the dashboard
  • Governance → Tool permissions: owners block a tool or set its limits for the whole org or one role, without the API. The editor shows only the settings that affect the chosen tool, and each role’s row shows its limits once combined with the org’s. Tool policies →
  • The message length limit now covers Discord. max_message_length only checked Slack-style text, so a Discord message got past it; it now checks content too.
  • New endpoint GET /api/v1/governance/tool-constraints: which policy settings each tool takes.
​
Security fixes from an external review
  • Each run keeps its own credentials. Two people’s runs at the same moment could share a token: a run without its own GitHub, Slack, Jira or other credential could use the one another run had just applied.
  • API keys only do what their scopes say. Every endpoint now names its scope, a key can’t create or reactivate a key broader than itself, and password and MFA changes need you signed in. New scopes: workflows:write, secrets:*, api_keys:*, organizations:*. Existing keys with the standard scopes get them, so they keep working; a key you had limited to a few scopes doesn’t, and a call it now can’t make says which scope it needs. Scopes →
  • allowed_repos holds on links, searches and .. paths, not only on the repo parameter.
  • Jira credentials only go to JIRA_BASE_URL, over HTTPS; links to other sites are refused.
  • Agent sessions stay in their organization, and a member who leaves is denied on their open sessions.
  • A role can’t lift the org’s read_only.
  • Agent scripts count as egress once a session has read company data, so python -c "…upload…" is caught by egress rules like curl is, also when the program hides behind a variable, quotes or a wrapper. External agents →
  • New template Confidential data stays out of shared trackers (Jira issues, Trello cards).
  • Slack approval messages are retried once when Slack is briefly unavailable.
  • MFA users are no longer signed out at their first token refresh.
​
Approvals on Slack, and a permissions fix
  • Approvals reach people. With Slack connected, admins who can decide get a DM when something waits for approval, linking straight to it, and the requester gets a DM when it’s decided. Parameters never go to Slack. Governance → Who hears about it
  • The Approvals inbox and the dashboard badge refresh on their own.
  • Security fix: a member who saved their own token for a tool could get past their role’s limits on it (a role block, read-only, allowed channels). Role and org limits now apply whoever’s token is used.
​
Developer workflows
GitHub, Jira and Trello. A request like “get issue 23 in the abc repo, find the key issues and make a fix.md, send it to xyz, set a 1:1 with xyz and update the work in Trello” now runs end to end. Developer workflows →
  • GitHub reads: github_get_issue, github_list_issues, github_get_file, github_search_code, github_list_commits, github_list_pull_requests, github_get_checks. Repositories by name or link; issues as 23, #23 or a link. Issue text is labelled internal + untrusted.
  • Jira Cloud: read, search (JQL or plain filters), create, update (status via the right transition) and comment with attachments.
  • Trello: see boards, search, create, move between lists by name, comment with attachments.
  • Files travel: gmail_send, jira_add_comment and trello_add_comment attach a generated file (attachment_name + attachment_content). gmail_send takes to: "me".
  • Meetings without a time: google_calendar_create_event books the next business day at 10:00 in your calendar’s time zone, with an optional Google Meet link.
  • Templates resolve inside lists and objects ("attendees": ["{{input.email}}"]).
  • The generator sees every tool’s optional parameters, and asks for a person’s email as an input instead of inventing one.
  • Organization → Integrations → Developer tools walks through each setup.
​
Reaching people
  • Add to Slack: an org admin installs the Fibonacci bot once; runs in the org post as it.
  • Slack channels a workflow creates invite the person who ran it; channel: "@me" is a direct message.
  • Discord: discord_send_message (channel, #name or @me) and discord_create_channel (under one “Fibonacci” category).
  • Built-in dates: {{today}}, {{yesterday}}, {{now}}, fixed at the run’s start.
  • Web search is faster and cheaper (Haiku 5.5, up to 3 searches, with a fallback model).
  • Approving a step paused mid-run resumes the run; tools get their own timeouts (web search: 90s).
  • Rules match what people paste (Google links match file IDs); placeholders like <YOUR_ID> are rejected.
  • Tool errors say what to change, and failures that retrying can’t fix aren’t retried.
​
Governance for workflows and agents
  • Every tool declares a side effect (read / write / egress); read_only roles key off it.
  • Labels and rules: labels follow data along the workflow; action rules allow, deny or require approval; label rules add labels. Templates ship inactive.
  • Plan analysis refuses a run a rule would definitely deny (403) before anything executes.
  • Mid-run approvals: a held step pauses the run, and approval resumes it without re-running finished steps.
  • Receipts: GET /runs/{id}/authorization. The audit log is hash-chained and append-only; /audit-events/verify checks it.
  • External agents: POST /authorize, a Claude Code hook and an MCP gateway apply the same rules to agents Fibonacci doesn’t run, with a per-session kill switch. External agents →
  • Quota is enforced per plan (free: 60 runs/hour, 5 concurrent, 100 queued, $50/month).
  • Google tools use your Google sign-in.
  • Live run events over Server-Sent Events (GET /runs/{id}/events).
​
Reliability
  • Attach PDFs, Word, Excel and CSV files to a run; their text reaches LLM steps as {{input.uploaded_files}}.
  • A background worker runs queued workflows; GET /runs/{id} explains why a run hasn’t started.
  • Tools work as soon as you connect them; admins can still block or scope them.
  • file_reader is sandboxed to one folder.
​
Production hardening
  • Governance settings, quotas, tool policies, workflow versions and the registry; secrets backends; CLI updates.