# Governance lifecycle stages, bias and fairness tests, and multiple project dashboards

Published: 2026-10-20

[Governance lifecycle stages](https://cdn.sanity.io/images/m9qfap23/production/17dd9297526aa877cf0ca5261c2c414d333e3769-2400x1534.jpg?w=1400&fit=max&auto=format)

Define the lifecycle stages a project moves through, assign reviewers to each stage, and get warned when an earlier stage's requirements stop being met. Three new built-in frameworks cover NYDFS Circular Letter No. 7, Colorado Regulation 10-1-1, and the NAIC AI Model Bulletin, and any framework now exports as an audit-ready compliance report.

[Read the docs →](https://www.openlayer.com/docs/governance/project-lifecycle)

## Bias and fairness tests {#bias-and-fairness-tests}

Four new test types check protected groups and their intersections for disparities in outcomes, scores, performance, and metrics. Each result opens with an Analysis tab of charts you can drill into and export to CSV.

[Bias and fairness test analysis](https://cdn.sanity.io/images/m9qfap23/production/c4932bdd93c875e3f93c50256f3177f300757df0-2400x1534.jpg?w=1400&fit=max&auto=format)

[Read the docs →](https://www.openlayer.com/docs/tests/catalog/bias)

## Multiple project dashboards {#multiple-project-dashboards}

Give each project as many dashboards as you need. Start from the default layout or a blank one, rename, duplicate, choose who can see each one, and switch between them from the breadcrumb or ⌘K. Dashboards also carry new mode-aware usage, cost, and judge-cost widgets.

[Multiple project dashboards](https://cdn.sanity.io/images/m9qfap23/production/373bf641f793b949b52c06b689b8778cd5f8d6ca-2400x1534.jpg?w=1400&fit=max&auto=format)

## Also new this quarter {#also-new-this-quarter}

- **EU data region. **Choose United States or European Union when you sign in or sign up, and your account and data stay in that region. [Learn more →](https://www.openlayer.com/docs/security/data-residency)
- **AI usage and security data sources. **Monitor how your organization uses AI with usage logs from OpenAI Compliance Logs, the Claude Compliance API, Microsoft 365 Copilot, and CrowdStrike Falcon Guardian. [Learn more →](https://www.openlayer.com/docs/integrations/overview)
- **Agent platform tracing. **Native tracing for ElevenLabs voice agents (with an audio view), Snowflake Cortex Agents, Databricks AI/BI Genie, and Palantir Foundry AIP Agents and Logic. [Learn more →](https://www.openlayer.com/docs/integrations/overview)
- **Custom columns. **Name a JSONPath into your structured outputs once and use it in tests, filters, and tables across the project. [Learn more →](https://www.openlayer.com/docs/monitoring/custom-columns)
- **Freshness tests. **Get alerted when a data source stops receiving data or a datetime column gets too old. [Learn more →](https://www.openlayer.com/docs/tests/catalog/freshness)
- **Gateway upgrades. **Routing by deployment, group, user, or key, model allow and block lists, `/v1/models` and `/v1/embeddings` endpoints, and multi-replica high availability. [Learn more →](https://www.openlayer.com/docs/gateway/overview)
- **API key expiry and MCP permissions. **Set expiry dates and rotate API keys automatically, and connect the remote MCP server with Full or Read-only access managed from a Connected Apps page. [Learn more →](https://www.openlayer.com/docs/workspace-and-projects/find-your-api-key)

Full feature, improvement, and fix lists are below.

## Features

- EU data region — choose United States or European Union on the sign-in and sign-up screens; your account and data stay in the region you pick
- Project lifecycle stages — define the stages a project moves through, assign reviewers to each, and get warned when an earlier stage's requirements are no longer met
- Three new built-in frameworks — NYDFS Circular Letter No. 7 (2024), Colorado Regulation 10-1-1, and the NAIC AI Model Bulletin
- Audit-ready framework export — export a report of your compliance with any framework
- Custom intake and risk-assessment forms, with AI-assisted completion
- Redesigned framework activation — pick projects explicitly, add criteria for future projects, review the tests a framework will create before they are created, and set a custom framework's rules while creating it
- Governance registry and framework endpoints in the public API and SDKs, writable with a workspace API key
- Bias and fairness tests — four test types check protected groups and their intersections for outcome, score, performance, and metric disparities, with an Analysis tab for charts, drill-down, and CSV export
- Freshness and Column freshness tests — alert when a data source stops receiving data or a datetime column gets too old, with manual or automatic thresholds
- Custom columns — a named JSONPath into structured outputs, defined once per project and usable in tests, filters, and tables across every data source and development commit
- Prompt injection tests — choose the detector and a sensitivity level (multilingual included), see why a detection fired, and pick the judge model
- Jev-as-a-judge test scores every row in the window and explains its score on demand
- Per-step evaluation — evaluate tests on each trace step with `evaluationScope: step`
- Automatic thresholds can be upper-only or lower-only
- Development-mode test results show a result-over-time graph, and development-mode tests can be paused
- AI-powered insights controls — workspace and project admins can turn insights on or off, override the judge model, and lock the settings
- Duplicate a test or a set of tests into other projects, and export test configs as JSON from the results page
- Workspace-wide project tags with names and colors, and test tags set from a pushed `tests.json`
- Revamped onboarding — guided post-signup setup, per-project mode visibility, and per-agent skill install tabs including GitHub Copilot and VS Code
- Multiple dashboards per project — start from the default layout or blank, rename, duplicate, delete, set visibility, and switch from the breadcrumb or ⌘K
- Mode-aware usage, cost, and judge-cost widgets on the project dashboard, token consumption on the workspace dashboard, and provider grouping in cost by model
- LLM cost table — view and edit token costs, with workspace overrides
- Observations view — inspect and compare steps across traces
- Row comments — threaded replies and @mentions on rows, plus a Feedback filter on the rows table
- Custom metric run logs and errors shown in the UI
- Recover monitoring data after a project is deleted
- ElevenLabs voice agents — native data source with a session Audio view (waveform player, transcript, call analysis), including data-residency accounts
- Snowflake Cortex Agents — native data source for agent traces
- Databricks AI/BI Genie — discovery and monitoring, with table and column pickers
- Palantir Foundry — AIP Agents tracing with OAuth2 client credentials, and AIP Logic monitoring where each Logic run becomes a trace with steps and model costs
- Claude Code and Claude Desktop telemetry — Claude Code OpenTelemetry spans mapped, OTLP/JSON accepted, and the developer's email used as the user ID
- AI usage-log data sources — OpenAI Compliance Logs (ChatGPT and Codex), the Claude Compliance API (Claude Code sessions and claude.ai chats, one row per user turn with steps and cost), and Microsoft 365 Copilot interaction export
- CrowdStrike Falcon Guardian — prompts, tool calls, and model usage from AI coding agents, one project per agent product
- Microsoft Agent Framework tracing, with an example and integration guide
- Azure OpenAI for development commits with Entra ID auth, and service-account JSON auth for Gemini and Vertex AI judges
- Google ADK tracing records agent handoffs and supports google-adk 2.x
- Remote MCP connector — Full or Read-only permission levels, a connection notification email, workspace-scoped OAuth2 tokens, a Connected Apps page, and judge explanations returned with failed rows
- API key expiry dates, automatic rotation, and full API key management
- `openlayer tests delete` — archives by default, `--force` deletes
- `openlayer init` supports Copilot CLI and Gemini CLI, custom CA bundles, a "debug with an agent" option when setup hangs, and `.openlayerignore` for smaller uploads
- CPNI and telecom guardrail — recognizers for IMEI, IMSI, ICCID, EID, and cell IDs
- Gateway routing by deployment, group, user, or key, with narrowest-match precedence
- Gateway model access allow and block lists, scoped to key, user, group, or deployment
- Gateway `GET /v1/models` (per key) and OpenAI-compatible `/v1/embeddings` endpoints
- Gateway "All traffic" observability destination that publishes every request
- AWS ECS Fargate reference deployments for Openlayer and the Gateway, with Terraform and a guide
- The Gateway Helm chart supports Istio and Gateway API routing
- The Helm chart supports external or managed Redis, and the remote MCP server image ships on Docker Hub

## Improvements

- Gateway high availability — safe on multiple replicas with health endpoints and graceful shutdown; admin changes and usage limits apply within seconds; fast, retryable errors when a guardrail is loading or the database is unavailable
- Gateway admin UI matches the Openlayer design system, "Teams" are now "Groups", guardrail evaluations are cached, and the docs gain an error reference
- OpenTelemetry GenAI tracing follows the current semantic conventions, with Agent Span support
- PII redaction and the Personal Data test scan text inside JSON values, honor the project's languages, and number placeholders per value
- Test result filters and the open row stay in the URL, so reloads and shared links restore them
- Trace details label each LLM-judge score with its test's name
- Exports map score columns to the tests that produced them, in both the monitoring export and the CLI
- Governance test-setup rules explain failures in plain sentences, and non-LLM projects no longer fail LLM-only rules
- SSO — sign-in recovery for SAML-only workspaces, pending invites reconciled with membership, directory-sync failures surfaced, and invites disabled for directory-sync workspaces
- Refreshed sign-in and full-screen layouts, including a full-screen multifactor flow and the region selector
- Find a project by pasting its ID, the last used mode is remembered, more keyboard shortcuts with a reference in the help drawer, and search in the monitoring setup guide
- Settings — environment variables grouped by provider in tabs, sortable and searchable member dropdowns, job role in account settings, a redesigned API key page, and the permission matrix in Members settings
- Enabled integrations show in the project UI, refreshed integrations and agent-builder settings pages, and the Register project flow explains "Code you own" vs "Vendor AI"
- Dashboard polish — animated charts, updated widget layout, consistent bar graphs, and compliance review time in days
- Collapsible AI summary sections, clearer paused, deactivated, and archived rows, downloads that keep running while you navigate, clearer export and background task progress, and easier evidence uploads
- Custom metrics start faster
- Row deletes are asynchronous, batched, and idempotent, with a new batch-delete endpoint
- Failing `tests` commands show the HTTP status and body behind the error
- New and updated guides for Google ADK OpenTelemetry export, Open WebUI, Azure AI Speech voice agents, and A2A distributed tracing across projects
- The self-hosted Gateway Helm chart runs safely with multiple replicas, and the bundled ClickHouse uses persistent storage
- Documented pip mirror settings for air-gapped installs, and a clear message when SAML SSO is turned off
- openlayer-guardrails is now Apache-2.0 licensed

## Fixes

- OpenTelemetry Collector traces were dropped when compressed, and an `error.message` attribute could drop a whole export — fixed, along with duplicate rows, missing costs, prompts shown as database statements, and orphaned scores for base64 IDs
- Google ADK traces arrived without inputs, outputs, or cost estimates — fixed
- LangChain cost tracking priced some providers at $0 — fixed
- AI summaries could ignore metric direction or lose their content on refresh and navigation — fixed, and they now work on more providers
- Scoring fixes — Harmfulness verdicts follow metric direction, failed rubric and judge rows no longer count as passing, binary Jev criteria score correctly, session-level judge scores are bounded, and Ragas tests ignore timestamp columns
- The Personal Data test passed with 0 rows on structured outputs, and character-length tests skipped them — both fixed, with the length shown per row
- The Data tab hid failing rows for LLM-judge tests, filter suggestions were empty for quiet data sources, and JSON sub-key and numeric filters errored — fixed
- Exports of filtered subsets, XLSX files with control characters, archive downloads, and JSON exports over 4 GiB failed — fixed
- Insights failed silently on subpopulation-filtered data — fixed
- Removed members couldn't rejoin a workspace, the SSO callback and members page could error, and the create-workspace screen had no way out — fixed, and built-in frameworks now appear right away
- The compliance review time chart plotted one point per upload, and filtering rules by active showed deactivated rules — fixed
- Adding ground truth to an existing trace failed, and the usage and cost widget didn't render for development mode — fixed
- Vertex AI connection tests failed after a credential update, Databricks data sources were blocked by empty predictions, and the Enable button on integration cards did nothing — fixed
- Numeric subpopulation filter hashes didn't parse, and a `tests.json` from `openlayer tests -o` didn't push back cleanly — fixed
- MCP test evaluation is now marked as destructive, so clients ask before running it
- Valid telecom identifiers were flagged as credit card numbers by guardrails — fixed
- Gateway guardrail hit counts and deep links were off, moving a key to another group didn't apply its rules right away, and usage events could be lost on a failed flush — fixed
- Some LLM cost service prices were wrong, notification email footers were hidden by Gmail, and the starter guide's guardrails step only checked the newest project — fixed
- Login could fail behind a proxy or air-gapped, a misconfigured admin caused a crash loop, the image didn't run under an arbitrary UID, and data source locks ignored Redis credentials and TLS — fixed