11 June, 2026

This release adds scoped permissions for flows, typed task APIs with related tasks on model pages, and gzip compression for faster API responses.

Scoped Flow Permissions

Flow @permission rules can now be scoped to specific actions using the actions argument, similar to how model permissions work. This lets you grant different roles access to different aspects of a flow. For example, you can allow operators to run a flow while letting managers view its run history.

The available actions are:

• run: start a new flow run
• history: view run history, stats, and listing
• share: reserved for a future sharing feature

role Operator {
    emails {
        "ops@example.com"
    }
}
 
role Manager {
    emails {
        "manager@example.com"
    }
}
 
flow ProcessRefund {
    inputs {
        orderId Text
    }
 
    // Operators can run the flow
    @permission(actions: [run], roles: [Operator])
 
    // Managers can view run history and stats
    @permission(actions: [history], roles: [Manager])
}

Existing flow permissions without an actions argument remain backwards compatible and continue to grant access to all actions.

Gzip HTTP Response Compression

API responses are now automatically gzip-compressed when the client supports it (via the Accept-Encoding: gzip header).

Flow Step Reliability

Two fixes improve the reliability of flow step execution under concurrent conditions:

• Flow steps can no longer run more than once if execution overlaps
• Flow steps that end up in an inconsistent state are now detected and surfaced as errors

For any issues or feedback, please contact us at help@keel.so.

Thank you for using Keel!