Changelog

A reverse-chronological log of customer-visible changes shipped to the Nembl product.

September 2026

Every notification event type is now configurable

Settings → Notification Preferences now lists every kind of notification Nembl can send, not just a subset. Seven event types that used to arrive with no way to adjust them are now fully configurable, each with its own per-channel controls, priority filter, and schedule window:

• Workflow phase advanced — a workflow run moved to its next phase
• Workflow completed — a workflow run finished
• Workflow error — a run hit an error and needs attention
• Request cancelled — a request you are involved with was cancelled
• Escalation — a request or task was escalated to you
• Revision requested — you were asked to revise and resubmit a request
• Subprocess new version — a new version of a linked subprocess was published

Previously these always sent email, couldn't be turned off, and ignored your priority filter and schedule windows. Now they behave like every other notification — you decide whether, where, and when they reach you.

One default changed: Workflow phase advanced emails are now off by default. On a busy workflow this event can fire on every phase advance, so Nembl no longer emails it unless you opt in. Every other event type keeps its previous default, so nothing else about what you receive today changes.

New event types added to Nembl in the future appear in this list automatically, so no notification can ever again be un-adjustable.

See Notification Preferences.

Combine status lanes in the inbox filter

The status filter on your inboxes and request lists is now multi-select, so you can view several status lanes at once instead of one at a time:

• Pick any combination. Select To Do, In Progress, and Closed in any mix — for example, show To Do and In Progress together — without the list snapping back to a single choice.
• "All" means no filter. With nothing selected, the control reads All and shows every status. Choosing one or more lanes narrows the list to just those (an OR of your selections).
• The label shows your selection. The control reflects the active set (for example, "To Do, In Progress") so you can see at a glance what's filtered.
• It sticks and comes back. Your selection is remembered per browser and restored when you reopen or refresh the list — including an empty ("All") selection.

The same multi-select filter is available on your inboxes, queue inboxes, My Requests, and the admin Requests list.

See Managing Your Inbox and Tracking Requests.

Auto-refresh pauses in the background and catches up when you return

The refresh control on your inboxes and request lists is now smarter about tabs left in the background:

• Pauses while the tab is hidden. If you've set an auto-refresh interval and switch away to another tab, the list stops re-checking on its schedule — there's no point polling a list nobody is looking at.
• One catch-up refresh on return. The moment you switch back to the tab, the list does a single refresh to pull in anything that changed while you were away, then resumes auto-refreshing on your chosen interval. As always, your scroll position, selection, and active columns, filter, and sort are preserved — the list updates in place.
• Off stays off. If auto-refresh is set to Off, switching tabs changes nothing — the list still only refreshes when you click.

Live updates are unaffected: rows still update on their own as work changes. This change only makes the scheduled auto-refresh considerate of backgrounded tabs.

See Managing Your Inbox and Tracking Requests.

Task dependencies and ordered approval gates within a phase

A phase can now run as a sequence of checkpoints instead of a flat checklist. When one task depends on another finishing first, Nembl enforces it:

• Blocked tasks can't be completed early. A task whose prerequisites aren't done shows a lock icon in the task list and can't be marked Completed — Nembl asks you to finish the prerequisite task(s) first. Agents are held to the same rule: an agent won't complete a task whose prerequisites are still open. Previously this dependency state was shown but not enforced; now it's enforced on the server, so a gate can't be bypassed.
• Several approval gates per phase. Approving one gate releases the work sequenced after it while later gates stay locked until their turn — so a single phase can hold multiple sign-offs in order (deliver → approve → deliver → approve → advance). Unblocking the next step happens within the phase; it doesn't advance the phase, which still moves on only under the usual advance rule.
• Live and automatic. As soon as the last prerequisite completes, dependent tasks unlock on their own and the list updates live — no manual step.

The prerequisite ordering is authored in the phase's task-template configuration; a visual control for wiring dependencies in the workflow editor is on the roadmap.

See Ordered gates within a phase and Blocked Tasks.

Refresh control on your inboxes and request lists

Every list that uses the shared list view — your inboxes, My Requests, the admin Requests list, queue inboxes, and workflow instance lists — now has a refresh control at the top-right, so you can keep the view current on your terms:

• Refresh now. Click the refresh icon to pull the latest items into the list immediately. Your scroll position, selection, and active columns, filter, and sort are all preserved — the list updates in place rather than reloading the page, so you never lose your place.
• See how current it is. A label beside the icon reads "just now" right after a refresh and counts up to "Refreshed X minutes ago", updating on its own.
• Auto-refresh on a schedule. Choose an interval — Off (the default), 30 sec, 1 min, 5 min, or 10 min — and the list re-checks for new items on that cadence. Your choice is remembered per list, per account, and reapplied next time — across devices.

This works alongside the live updates these lists already get: rows still update on their own as work changes, and the refresh is an extra, on-demand way to be sure you're seeing the very latest.

See Managing Your Inbox and Tracking Requests.

August 2026

Customizable list views across your inboxes and request lists

The Product Backlog inbox, My Requests, and the admin Requests list now render through one shared, redesigned grid — so they look and behave the same everywhere — and you can tailor each list to how you work:

• Show or hide columns. Open the Columns menu (the sliders icon above the list) and check only the fields you care about.
• Reorder columns. Drag a column by its grip handle to move it left or right.
• Resize columns. Drag a column's right edge; each column has sensible minimum and maximum widths so the layout stays readable.
• Switch density. Toggle between comfortable and compact to fit more rows on screen.
• Rank and Request ID stay put. These two always lead the list, pinned on the left — they can't be hidden, moved, or reordered, so you never lose your place.
• Your layout is remembered. Every change is saved for you, per list, and reapplied next time you open it. A Reset button restores the original default view whenever you want a clean slate.
• Lists stay live. When a request you're looking at is created, updated, re-ranked, or changes status or priority, the list updates on its own — no manual refresh needed.

This is the foundation for a consistent list experience across the product. Grouping, board view, saved filters, and per-column sorting build on the same view model and arrive in upcoming releases; for now these lists open in their default order (processing order for an inbox, newest-first for request lists).

See Managing Your Inbox and Tracking Requests.

Requests now close automatically when their workflow finishes

Previously, a request whose workflow reached its final approved step could stay stuck showing Open in your inbox even though every task was done and the work was delivered — the underlying workflow had finished, but the request record itself didn't follow. Requests now move to Completed automatically the moment their linked workflow reaches a successful end step, matching what Request Lifecycle has always described. No action needed — this applies to every workflow going forward.

July 2026

Least-privilege variable visibility for agent seats

Agent-executed workflow phases now receive a filtered projection of workflow variables instead of the entire instance's variable store:

• The dispatching phase's own namespace variables — unchanged.
• Global variables, only when their variable definition explicitly sets exposeToAgents: true. Globals default to not exposed.

Variables scoped to other phases' namespaces, and any local/internal variables, are never included. This applies to every agent backend (MANAGED, CUSTOM, and EXTERNAL) via the dispatch envelope's variables field, so an agent seat only ever sees what its phase is meant to see — narrowing exposure of potentially sensitive workflow data by default.

Existing workflows keep working unchanged for namespace variables — agents still receive their phase's own namespace exactly as before. Global variables are the one behavior change to watch for: there is no workflow editor control yet to flag a global exposed, so if an agent-executed phase in your workflow previously relied on reading a global variable, that variable will no longer reach the agent until it's explicitly flagged.

See External Agent Contract.

June 2026

Self-serve subscription management

Customers can now manage their subscription directly from Admin → Billing → Subscriptions with a one-click Manage Billing button. The button opens a secure Customer Portal session in a new tab where you can:

• View and download invoices and credit notes
• Update the payment method on file
• Change billing email and address
• Cancel the subscription (with optional reason feedback)
• See upcoming renewals + next charge details

Changes you make in the portal are reflected in Nembl within seconds, and your access continues through the end of your paid term. No more support email for routine billing changes.

See Subscriptions.

Invitation flow improvements

Two refinements to the email-invitation experience:

• Smarter email body. When you invite someone who already has a Nembl account (Individual or another Company), the email now says "Sign in to Accept" rather than "Create Account" — and the body explicitly notes that accepting will add your Company to their existing account without touching their personal tenant or any other memberships.
• Cleaner accept path for existing users. Clicking the link from such an invite now routes through the sign-in screen instead of the signup screen, preserving the invitation token through the sign-in flow end-to-end so the user lands on a one-click "Accept" page immediately after signing in. Previously, existing users could hit a dead-end at signup and have to manually navigate back.

The send-time detection means the email content matches what the recipient will actually experience when they click — important for trust on the first impression.

See Members & Invitations.

Security posture tightening

The app's HTTP response posture has been tightened to align with modern browser-platform best practices and improve standing with automated security scanners (typical input to enterprise vendor questionnaires):

• Cross-origin window isolation — cross-origin windows can no longer share state with the Nembl session, blocking a class of side-channel attacks.
• Strict transport security with preload eligibility on nembl.ai — forces HTTPS for the entire domain on every visit, even before TLS negotiation, and is now eligible for inclusion in browser preload lists.
• Server-fingerprinting reduced — generic response headers replace software-stack identifiers, denying passive scanners and threat classifiers an easy fingerprint signal.

No customer-visible behavior change — existing protections (strict CSP with frame-ancestors 'none', X-Frame-Options DENY, X-Content-Type-Options nosniff, strict Referrer-Policy) remain in place.

May 2026

"Hide closed over" filter on list pages

A unified "Hide closed over" filter ships on every list page that mixes open and closed items: Tasks, Requests, Workflows, Workflow Instances, and the Inbox. The default — "Hide closed over 2 weeks" — keeps the list focused on actionable work while still surfacing recently-resolved items as easy context.

Options: 1 day, 3 days, 1 week, 2 weeks (default), 1 month, 3 months, 6 months, 1 year, or All time. Per-page sticky — your preference for each list page is remembered locally (in your browser, per Company) and applied next time you visit.

See Tracking Requests and Managing Your Inbox.

Workflow editor polish + public status page

• The canvas vocabulary now matches the published workflow events: phase nodes labeled Begin and End (formerly "Start" and "Completed"), pairing cleanly with workflow.begin / workflow.end. Phase-level events stay phase.start / phase.stop.
• End nodes get a filled green disc inside a concentric ring — paired visually with the Begin node, distinct from it.
• Sub-process nodes get a thick BPMN call-activity border + a nested-workflow corner badge so they're obvious at a glance vs plain Process steps.
• Blank workflows now open with a publishable Begin → End skeleton instead of an empty canvas.
• Connection handles auto-hide on view / runtime canvases and gain a show/hide toggle in the editor toolbar.
• A public status page is live at status.devopspolis.com (opens in a new tab) — incident history + service uptime, linked from the docs footer.

External AI agents — plug in your own via webhook or MCP

You can now register a third-party AI agent — your own code, a LangChain / LangGraph deployment, an MCP server, or any HTTPS endpoint — and treat it as a first-class participant in a Nembl workflow phase. Same RACI engagements, same recommendation review, same audit trail as the built-in agents.

What this enables for you:

• Use any agent framework you want. If your agent can receive an HTTPS POST or expose an MCP tool, it works. No SDK to install, no framework lock-in — Nembl signs each request and maps your response back into the workflow.
• Strong authentication out of the box. Bearer tokens, API-key headers, or HMAC-signed requests with a 5-minute replay window. The auth secret lives in your existing Nembl vault; rotating is one click.
• Workflow-shaped contract. Your endpoint receives the dispatch envelope (workflow context + variables + the actions your agent is allowed to propose) and returns a structured result: an analysis, optional reasoning, and a list of proposed actions (add_comment, create_task, update_variables, etc.). Anything outside your declared capabilities is dropped server-side.
• Health monitoring. Nembl probes registered endpoints every 15 minutes; three consecutive failures pause dispatches and notify your admins. First success after failure flips you back to active automatically.
• Capability declarations. Pick which workflow actions an external agent is allowed to propose. Endpoints stay scoped to what they were registered to do.

To set one up: register a connection under Admin → External Agent Connections, then create an agent (Admin → Agents → New Agent), choose the External backend, and link your connection. Available on Starter and above.

Session tracking + force sign-out

Every signed-in session is now tracked as a first-class entity from sign-in through sign-out. The session record holds the active context (personal account vs. Company), the sign-in method (SSO or credentials), the user-agent, the IP address, and a continuously- updated "last seen" timestamp.

What this enables for you:

• Live session visibility — see who is signed in across your Company, where, and what they're doing, with a real-time list that updates as people sign in, switch context, or sign out.
• Force sign-out — when a device is lost, a contractor's access ends, or a credential needs rotating, administrators can revoke an individual session (or every active session for a user) in one click. Revocation takes effect on the user's next request — within about a minute even if their browser is still open.
• Audit trail — every sign-in, sign-out, and Company-switch writes an audit row keyed to the session, so post-incident forensics can reconstruct exactly which session did what, when, and from where.

The same mechanism is what lets administrators in Plan Admin watch a live "Active Sessions" view, scope by recency (5 min / 30 min / 1 hour / …), and drill into any session for full provenance — including sign-in attempt history from the federated identity provider.

What used to be called "Secrets" is now Vaults throughout the UI. The underlying entity is unchanged — same storage, same scoping, same connector bindings — but the name better reflects that vaults can hold more than just short string credentials (certificates, structured config, ARN references on the roadmap).

The permission model split too: secret:read grants metadata access (name, tags, last-rotated date, bound resources) and secret:reveal grants decrypted value access. A "Reveal" button on the vault detail page is gated on secret:reveal. The permission identifiers stay secret:* for back-compatibility.

See Creating & Managing Vaults and the Glossary entry.

Subprocess composition

Subprocess phases shipped with a typed contract: child workflows declare their inputSchema and outputSchema on the workflow's Interface card, parents map variables to those declared inputs/outputs with autocomplete and type-checking. Each subprocess END phase gets its own handler block on the parent with a per-END outputProjection — so different exit handlers can pull different child variables back to the parent.

Tier-aware variable references (phase.*, instance.*, system.*, global.*) replace the older flat namespace. Cross-version compatibility checking warns when changing the linked workflow version breaks existing mappings.

onError / onCancellation / onTimeout handlers each take a strategy (transition | pause | fail) to control parent behavior when a child errors, gets cancelled, or runs over its timeout.

See Subprocess Workflows.

Request types + REQ-N reference IDs

Every request now carries a human-readable Reference ID in the form REQ-1247 — usable in conversations, emails, and external systems. Per-company sequence; no collisions across tenants.

Forms can also set a request type discriminator (STANDARD default plus special types like ESCALATION, INCIDENT). The type drives downstream behavior: inbox routing rules can require specific types, analytics dashboards segment by type, and DECISION phases can branch on request.type.

See Tracking Requests and Forms.

Inbox processing order (FIFO / LIFO / PRIORITY)

Each inbox now has a configured processing order that sets the default sort: PRIORITY (urgent first, date as tiebreaker — the SLA-friendly default), FIFO (oldest first — fairness-sensitive intake), or LIFO (newest first — when stale items lose value). Admins configure it on the inbox settings page; workers can still re-sort manually with the column headers.

See Managing Your Inbox.

Workflow versioning: "Retired" status

Workflow versions you've taken out of circulation are now labeled Retired (formerly "Deprecated"). Same lifecycle, same semantics — RETIRED versions are hidden from the offering picker but in-flight instances continue running on them.

See Workflow Versioning.

Responsibility Matrix snapshots + per-run customization

Workflow instances now capture a snapshot of their effective matrix at launch time. The instance viewer always shows who was Responsible / Accountable / Consulted / Informed when that specific instance started — even if the source matrix has been edited since.

The Run Workflow modal gained a "Customize for this run" option that opens the matrix in DRAFT mode for that single instance — swap principals, adjust notification toggles, change assignments without affecting the source matrix or any other instance.

See Responsibility Matrices.

Real RAG for AI agents

AI agents can now retrieve from your company's prompt-document corpus on-demand via the retrieve_documents MCP tool. Semantic search is fast and accurate over your full corpus, with per-document tag-based access policies enforced at retrieval time.

Replaces the older approach of concatenating every prompt document into the agent's system prompt. Documents are indexed on write so updates take effect on the next agent invocation.

See AI Agents — RAG and the MCP Server tool catalog.

Federated SSO + sign-out

Sign-in now flows through your federated identity provider with end-to-end sign-out — terminating a Nembl session clears the upstream SSO session too. Verify-before-login enforcement catches stale identity-provider state before letting a session complete.

Audit log coverage expansion

Filled gaps in the audit trail for IAM operations, B2B publishing, and service-publishing actions. Every administrative change now produces an audit row queryable from Admin → Audit Trail.

April 2026

Three managed agents shipped

Three Nembl-provided agents are now seeded INACTIVE on every company at creation:

• Inbox Triage — Queue Intake agent on Haiku, act_with_approval autonomy
• Phase Advisor — Workflow Phase agent on Sonnet, suggest-only, fires when assigned as a CONSULTED party
• Task Generator — Workflow Phase agent on Sonnet, act_with_approval, produces recommendations with create_task proposed actions

All three use BYOK — bind your own Anthropic or OpenAI API key via a Vault. The activation guard blocks INACTIVE → ACTIVE until a valid bound vault resolves.

See AI Agents and BYOK Setup.

MCP server expanded for inbox + workflow management

New MCP tools for human-or-agent-driven inbox and workflow operations:

• create_recommendation / list_recommendations / update_recommendation_status — agents propose actions; humans accept or dismiss in batch
• update_request, add_comment, set_request_tags — request mutations
• update_workflow_variables — workflow instance variable patching
• get_workflow_interface, list_invocable_workflows — discover reusable workflows and their typed interfaces

Per-action acceptor-permission gating: when a human accepts a recommendation, the system checks the accepting user holds the necessary IAM action for each proposed action before executing.

See MCP Server.

Agent runtime isolation

Agent LLM execution now runs on dedicated handler functions per supported provider, isolated from the app server. Result: agent invocations no longer compete for app server threads, agents can run longer prompts and tool loops without timing out, and the same envelope contract is reusable for future external-agent integrations.

True cancel semantics — pre-LLM checkpoint, mid-LLM abort, post-LLM checkpoint — guarantee that user-initiated cancels stop the in-flight inference cleanly.

Workflow execution engine consolidation

Workflow execution now runs on a single, consistent engine for all event types. The previous multi-component orchestrator was retired in favor of a unified event-driven model. Resulted in faster cold-start, simpler observability, and no state-machine quota limits.

March 2026

Responsibility Matrix system

Three-tier RACI model shipped: Accountable / Responsible / Approver / Consulted / Informed / Backup assignments per phase, with per-assignment notification toggles and a two-tier policy evaluation (inherited policies vs direct user policies). Direct Allow overrides inherited Deny.

Matrices are reusable bundles of assignments applied at the inbox, workflow, or workflow-instance level. The matrix detail page tracks every entity and instance currently referencing it.

See Responsibility Matrices.

Account types and plan restructuring

Two account-type lines, separately priced:

• Individual accounts (Free, Pro) — single-person plans
• Company accounts (Starter $49 / Growth $149 / Business $399 / Enterprise custom) — multi-seat plans

No free Company plan. Trial mechanics exist for paid Company plans.

Plan Administrator app

Super-admin web app for managing all Nembl accounts, subscriptions, plans, and feature flags from a single interface. Tailscale-only access via split-horizon DNS — admin operations never traverse the public internet.

Workflow MVP — templates, extensibility, and data phases

Templates library shipped with curated starter workflows. Data phases (filter, sort, aggregate, transform, enrich, validate, transpose) shipped as first-class phase types alongside the existing PROCESS / DECISION / PARALLEL / SUBPROCESS / TIMER / END phases.

Earlier 2026

Foundational phases: hierarchical entity model, nested queues, service catalog, BPMN-style workflow builder, IAM policy engine, CloudTrail-style audit logging, AI agents as first-class entities, B2B service registry, package add-ons. See the product vision (opens in a new tab) for the original scope.