Skip to main content

​
Genesis v1.19.66 Release Notes

June 12, 2026 BigQuery connectivity, Snowflake Restricted Caller’s Rights for same-account PrivateLink, per-agent connection scoping, a structured wiki Data Estate overview, and broad reliability improvements across connections, the Context Graph, Genesis Apps, and agent security.

​
Data Connections and BigQuery

New warehouse support and clearer connection governance make it easier to register data sources and control how agents use them.
  • Google BigQuery is now a supported connection type. Operators can authenticate with a service-account key or per-user Google Sign-In (OAuth), run Test Connection, and let agents query datasets through the standard database tool.
  • Jira configuration is consolidated under Config → Connections alongside other integrations, replacing scattered setup paths.
  • Personal connections are scoped more strictly so users only see and use connections they are authorized to access.
  • Connection default scope is clearer: implicit system-wide defaults are removed, and explicit system defaults display correct metadata in the connections list.
  • The connections list updates reliably after save, and row layout stays uniform when connection titles include badges.
  • Connection creator attribution is preserved across updates instead of being overwritten on edit.
  • LiteLLM proxy OAuth header forwarding is preserved through save and test flows, so delegated auth continues to work when connections are re-saved.
  • Non-UTF8 CSV files load correctly instead of failing on encoding errors.

​
Snowflake Restricted Caller’s Rights (RCR)

Snowflake deployments on PrivateLink can now run queries with each user’s own Snowflake privileges on same-account connections.
  • A per-connection toggle enables Restricted Caller’s Rights for same-account Snowflake connections in SPCS deployments.
  • An inline setup wizard provides copyable caller-grant SQL, a link to the Security tab in Snowsight, and guidance to confirm same-account status with Test Connection.
  • Test Connection returns an advisory when RCR is enabled, confirming same-account routing or warning when the connection targets a different account.
  • Same-account RCR connections skip unnecessary external-access endpoint registration on save, and the wizard clears stale state on copy retry or failure.
  • Caller tokens propagate correctly through async query paths so RCR queries use the freshest per-user credentials.
  • PrivateLink deployments resolve region-scoped Snowsight URLs correctly when opening Snowflake admin links from the dashboard.

​
Agent Connection Scoping

Admins can narrow which database connections each agent can reach and signal read-vs-modify intent.
  • A new Data Access tab in the Agents Center lets admins assign named connection profiles to agents and optionally restrict them to only that profile’s connections.
  • Connections can be labeled read-only, read-modify, or unspecified; non-unspecified labels appear as badges in the connections UI and inform the agent at thread start about intended usage.
  • Declared intent is a guidance hint — database roles and secret permissions remain the enforcement boundary.

​
Context Graph and Wiki

The wiki and Context Graph experience gained a structured estate overview and more reliable lineage discovery.
  • A Data Estate top-level wiki page is now the default landing view in the Context Graph wiki pane, with a systems inventory, areas index, and optional interpretive overview synthesized after each scan.
  • Estate overview content is grounded in scanned subgraph documents rather than presenting a raw inventory.
  • Thread-level provenance persists through materialization, and wiki librarian filtering prefers metadata over re-parsing thread content.
  • Context Graph scans on Cortex in SPCS use correct Bearer-token authentication, and provider switches during credential refresh are detected so pre-scan LLM configuration stays in sync.
  • Lineage tool dispatch is more reliable, and git-based Context Graph scans tolerate malformed nested list output from model responses.

​
Genesis Apps

App authoring and library browsing are faster and more reliable.
  • The Apps Library loads faster on first visit without forcing a cache-busting refresh on every open.
  • Screenshot sandbox images remain inline when an app is finalized instead of being dropped from the preview.
  • Genesis Apps that bind to datasets no longer hit intermittent authentication failures when loading data through the app proxy.

​
Agents, Security, and Administration

Agent access control and platform hardening improved for governed deployments.
  • Tool access checks are hardened to fail closed on errors.
  • High-risk and coding-agent tool denial messages point to the correct admin location for granting access.
  • Duplicate MCP server startup issues under concurrent initialization are resolved.
  • Container images received additional security hardening.
  • A security update bumps the pyarrow dependency.

​
Blueprints, Search, and File Tools

Blueprint configuration, web search, and file operations gained fixes operators may notice during agent workflows.
  • Blueprint LLM tier selection propagates correctly when creating missions from blueprint templates.
  • Tavily is available as a first-class web search provider alongside existing options.
  • The file write tool exposes a top-level is_base64 parameter so agents can write binary content without schema confusion.

​
Configuration Schema

The llm and providers sections of the YAML config have been redesigned and significantly expanded. Existing configs remain fully supported — no immediate changes required. An updated example config reflecting the new schema is available under Config → Config Profiles in the Genesis UI.

​
Upgrade Notes

  • BigQuery: Under Config → Connections, add a BigQuery connection with your GCP project ID and either a service-account JSON key or Google OAuth client credentials. Run Test Connection, then ask an agent to query a known table. If using per-user OAuth, each user must complete Google Sign-In once before querying.
  • Restricted Caller’s Rights: On SPCS with PrivateLink, open a same-account Snowflake connection, enable the RCR toggle, follow the inline wizard to grant caller rights in Snowsight, and confirm Test Connection reports same-account status. Run a short agent query and verify results reflect the calling user’s privileges.
  • Agent connection profiles: In Agents Center → Data Access, review each agent’s reachable connections. Assign a connection profile where you want to narrow scope, and label connections with read-only or read-modify intent where appropriate.
  • Data Estate wiki: Open the Context Graph wiki pane after a scan and confirm the Data Estate page shows your systems inventory and areas index. If content looks stale, trigger a Context Graph rescan or ask an agent to regenerate the estate overview.
  • Config schema: No action required — existing YAML configs are fully backward compatible. To explore new fields, download the updated example config from Config → Config Profiles.
  • Validate after upgrade: Re-save any LiteLLM proxy OAuth connections and confirm Test Connection still succeeds; open the Apps Library and confirm apps load without authentication errors; send a blueprint-based mission and verify the intended LLM tier is used.
— The Genesis Team