LoginSign Up
← Back to all sparks
M

Mattermost

COLLAB
Velocity6.3

Open-source secure collaboration platform for technical teams.

mattermost.com ↗

Mattermost v12.1 puts bots and burn-after-reading messages under the same access rules.

access controlzero trustdefenseself-hostedbotscompliance
◆Current state
Mattermost v12 shipped in parts: agents limited to the requesting user's access, Cross Guard for transfers across security domains, and user, device and channel attributes in access policy. A November 9 partnership pairs v12 with Arqit's quantum-safe device trust. v12.1 on November 13 extends attribute-based access control to bot accounts and to Burn-on-Read permissions, and Desktop v6.4 fixes Boards on subpath deployments.
◆Where it's heading
Each release closes another gap in one policy model for who and what can see a message: people, devices, channels, and now automation accounts and ephemeral messages. The audience stays defence and regulated buyers, and point releases are filling in v12 rather than starting new lines.
◆Prediction
Further v12.x releases likely apply the same attribute rules to more objects, such as files, plugins or AI agent actions, following the pattern of v12.1.

◆Recent moves

  1. 23h ago

    Mattermost v12.1: Control That Goes Beyond On and Off

    Bot attributes and Burn-on-Read permissions bring automation accounts and disappearing messages under v12's attribute-based access control. It is the first point release on v12 and fills gaps in the policy model rather than adding a new pillar.

    View source ↗
  2. 4d ago

    Your MFA Isn't Phishing-Resistant. Here's What Is, and What the Deployment Decision Actually Involves

    An explainer on why OTP and TOTP no longer meet federal phishing-resistant MFA rules, comparing CAC/PIV, FIDO2 and passkeys. Positioning content with no product change.

    View source ↗
  3. 4d ago

    Mattermost v12 pairs with Arqit for quantum-safe edge deployments

    A partner pairing that adds Arqit's quantum-safe device trust under v12's application-level access control. It extends the zero-trust story from the November 4 policy attributes to the device itself, for air-gapped defence use.

    View source ↗
  4. 9d ago

    Mattermost v12 adds device and channel attributes to access policy

    The third v12 piece extends attribute-based access control: policies can now consider device and channel context and attach to more places. It completes the zero-trust model the September identity series laid out, after the agent-permissions launch and Cross Guard.

    View source ↗
  5. 18d ago

    Mattermost v12 Cross Guard: managed cross-domain transfers

    Cross Guard is the second v12 piece after the agent-permissions launch: a managed path for moving messages and files across accredited cross-domain boundaries, replacing print-and-walk transfers. It extends the v11.11 data-spillage work into how classified teams actually move information.

    View source ↗
  6. 21d ago

    Mattermost v12: Agents Are Doing the Work. Now Control What They Can See.

    ⚡ SPARK

    After weeks of security essays, v12 is the product release they were setting up. It brings the data-spillage thinking behind v11.11's exposure report to AI agents: user-scoped access, private models and auditability for every agent action.

    View source ↗