11 June, 2026

This release adds scoped permissions for flows, typed task APIs with related tasks on model pages, and gzip compression for faster API responses.

Scoped Flow Permissions

Flow @permission rules can now be scoped to specific actions using the actions argument, similar to how model permissions work. This lets you grant different roles access to different aspects of a flow — for example, allowing operators to run a flow while letting managers view its run history.

The available actions are:

• run — start a new flow run
• history — view run history, stats, and listing
• share — reserved for a future sharing feature

role Operator {
    emails {
        "ops@example.com"
    }
}
 
role Manager {
    emails {
        "manager@example.com"
    }
}
 
flow ProcessRefund {
    inputs {
        orderId Text
    }
 
    // Operators can run the flow
    @permission(actions: [run], roles: [Operator])
 
    // Managers can view run history and stats
    @permission(actions: [history], roles: [Manager])
}

Existing flow permissions without an actions argument remain fully backwards compatible — they continue to grant access to all actions.

Related Tasks on Model Pages

Tasks that reference a model now appear directly on that model's page in the Console, making it easy to see and act on related work without navigating away. Each task's field data is returned in API responses, giving you full visibility into task details.

The tasks API also gains two new capabilities:

• Filter by parent record — list tasks related to a specific record using foreign-key filters
• Pick up a specific task — claim and start a specific task by ID, with conflict detection if another user has already claimed it

model Order {
    fields {
        reference Text
    }
 
    actions {
        get getOrder(id)
    }
}
 
task ReviewOrder {
    fields {
        order Order
        priority Number
        dueBy Date?
    }
 
    @permission(expression: ctx.isAuthenticated)
    @orderBy(priority: asc)
}

Task API responses now include a typed data object with all field values, and the OpenAPI spec generates concrete per-task schemas for typed client support.

Gzip HTTP Response Compression

API responses are now automatically gzip-compressed when the client supports it (via the Accept-Encoding: gzip header). This applies to both deployed environments and local development with keel run, reducing response payload sizes for JSON-heavy endpoints with no changes needed on your side.

Flow Step Reliability

Two fixes improve the reliability of flow step execution under concurrent conditions:

• Flow steps are now atomically claimed before execution, preventing duplicate runs when multiple orchestrator invocations process the same step simultaneously
• Inconsistent flow step states (where a step has both a completed result and a pending execution) are now correctly detected and surfaced as errors

Fixes and Improvements

For a full list of fixes and improvements, check out our GitHub releases page (opens in a new tab).

For any issues or feedback, please contact us at help@keel.so.

Thank you for using Keel!