---
title: "Depot 0.8.0"
description: "Role management, permissions for each remote access mode, every framework on every plan, recording off by default, and Linux packages."
url: "https://support.outpostplatform.com/releases/depot/0.8.0/"
product: "depot"
type: "release-note"
status: "draft"
ai_summary: "Depot 0.8.0 adds role management and per-mode remote permissions. 0 turns off session and idle limits. Every framework is on every plan and none requires recording, which is off until a profile turns it on. Plan checked every 15 minutes, 72 hours offline. Live chat follows the service desk, remediation alerts on Home Lab and Essentials, passkeys in password managers, Linux .deb and .rpm."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/releases/depot/0.8.0.md"
license: "CC BY 4.0"
---

# Depot 0.8.0

Depot 0.8.0 tightens who can open remote sessions in which mode, makes every
plan rule match what each plan includes, opens every compliance framework to
every plan, and adds Linux packages. Existing roles keep the remote access
they have today. Session recording is off until a profile turns it on, so
check the upgrade notes if you rely on recorded sessions.

## Highlights {#highlights}

- **Role management.** Create and edit roles, restore built-in defaults, and
  change a person's roles from the console. See
  [Manage roles](/depot/manage-roles/).
- **Permission for each remote access mode.** Starting a session needs
  `remote:initiate` and the permission for the mode the endpoint's policy
  picks. See
  [Permission for each mode](/remote-access/access-modes/#mode-permissions).
- **Time limits you can turn off.** Set a session or idle time limit to `0`
  to turn it off. A limit no profile sets keeps its default.
  See [Limit session length](/remote-access/access-modes/#limit-session-length).
- **Every framework on every plan.** SOC 2, HIPAA, PCI DSS 4.0, CJIS,
  NIST SP 800-171, NIST SP 800-53, CMMC Level 2, ISO/IEC 27001, DISA STIG, the
  Microsoft security baseline, and CIS Benchmarks are available on Home Lab and
  Essentials too. See
  [Compliance framework baselines](/compliance/framework-baselines/).

## Added {#added}

### Linux packages

**Enroll a device** offers **Debian / Ubuntu x64 (.deb)**, **Debian / Ubuntu
arm64 (.deb)**, **RPM Linux x64 (.rpm)**, and **RPM Linux arm64 (.rpm)**. Each
download is a `.zip` with the package, the enrollment configuration, and
installation steps. The package installs the agent and the tray app. The
tarballs are still offered. See
[Install and enroll the agent](/agent/install-and-enrollment/).

### Compliance remediation alerts

On Home Lab and Essentials, which do not include the service desk, a
control's page offers **Create remediation alerts** instead of a ticket. Each
selected endpoint gets one alert for the setting, and the alert closes the
next time the endpoint reports the setting as compliant, or an approved
exception covers it. See
[Create remediation alerts](/compliance/compliance-overview/#remediation-alerts).

### Role management

**Settings** > **Roles** lets you create, clone, edit, and delete roles. Edit a
role's permissions by area and review what you are adding and removing before
you save. Built-in roles other than **Owner** can be edited and have **Restore
defaults**. **Owner** always holds every permission. Someone who is not an
owner cannot give a role, or a person, permissions they do not hold, and a
refusal names the permissions involved. On **Settings** > **Team**, **Roles**
on a person's row changes the roles they hold. Only an owner can give, take
away, disable, or enable the **Owner** role. See
[Manage roles](/depot/manage-roles/).

### Documentation on every plan

Home Lab, Essentials, and Enterprise can design asset layouts and write
process templates for their own organization, under **Documentation** >
**Asset layouts** and **Process templates**. MSP keeps its practice library.
See [Assets and asset layouts](/documentation/assets/) and
[Vendors, licenses, and processes](/documentation/vendors-licenses-processes/).

## Changed {#changed}

### Compliance

- No framework baseline requires session recording. The recording floor is
  removed from the SOC 2, HIPAA, PCI DSS, CJIS, NIST SP 800-171, NIST SP
  800-53, CMMC Level 2, and ISO/IEC 27001 baselines. Outpost's reading of
  these frameworks found no control that requires session recording, so
  declaring one no longer depends on a plan that records sessions. See
  [Baseline settings by framework](/compliance/framework-settings/).
- Every framework can be declared on every plan, Home Lab and Essentials
  included. Before 0.8.0, those plans offered only DISA STIG, the Microsoft
  security baseline, and CIS Benchmarks.

### Remote access

- Session recording is off by default on every plan. Before 0.8.0,
  `remote_access.recording_required` defaulted to on, so Enterprise and MSP
  recorded every session no profile turned it off for. In 0.8.0, sessions are
  recorded only where a profile turns recording on. See
  [Record remote sessions](/remote-access/session-recording/).

- Before 0.8.0, `remote:initiate` was enough to open a session in any mode
  the endpoint's policy allowed. In 0.8.0, a session also needs
  `remote:unattended`, `remote:attended`, `remote:consent`, or
  `remote:escorted` for the mode the policy picks. A **Consent required** session to the sign-in screen also
  needs `remote:unattended`. Outpost checks again at each change of signed-in
  user, and records each refusal in the audit log.
- Before 0.8.0, a session or idle time limit of `0` meant the default. In
  0.8.0, `0` turns the limit off. With no profile setting a limit, the
  defaults are unchanged: 1 hour for a session, and 5, 10, and 30 minutes for the idle
  warning, pause, and end. A limit set by any other applicable profile still
  applies, and so do framework floors such as PCI DSS. See
  [Remote access policy settings](/remote-access/policy-settings/#time-limits).

### Plans

- Your Outpost checks your plan with the Outpost service every 15 minutes.
  When it cannot reach the service, it uses the last plan it verified for up
  to 72 hours. After that, plan-gated features are refused until it reconnects.
  See [How your plan is checked](/reference/plan-features/#plan-verification).
- Session recording follows the plan. On Home Lab and Essentials,
  `remote_access.recording_required` is hidden in the profile editor, and a
  profile that requires recording cannot be applied. A profile that already
  required recording keeps working: sessions run unrecorded, and the viewer
  says so. See
  [Session recording](/reference/plan-features/#session-recording).
- Live chat is part of the service desk, on Enterprise and MSP. On Home Lab
  and Essentials, people cannot start a chat or see past chats from the tray
  app. A chat already running when the plan changes can finish. See
  [Live chat](/service-desk/live-chat/).

## Fixed {#fixed}

- Password managers such as 1Password can save and use passkeys for the
  console. Before 0.8.0, adding or using a passkey could open the browser's
  own prompt, such as Windows Hello, instead of the password manager.

## Security {#security}

Remote sessions enforce the permission for each access mode, so a role
decides which modes its holders can use. Before 0.8.0, any technician with
`remote:initiate` could open a session in any mode the endpoint's policy
allowed, including unattended sessions. The update gives every role that
holds `remote:initiate` all four mode permissions, so no technician loses
access.

## Known issues {#known-issues}

- A relayed remote session with no time limit ends after about 24 hours.
  Sessions over a direct connection are not affected. To keep a long session,
  reconnect before then. See
  [Limit session length](/remote-access/access-modes/#limit-session-length).

## Upgrade notes {#upgrade-notes}

Outpost manages the hosted service update. Before it reaches you, check the
following.

- **Session recording.** On Enterprise and MSP, sessions that were recorded
  only because recording was on by default stop being recorded after the
  update. To keep recording them, turn on `remote_access.recording_required`
  in a profile assigned to those endpoints. A profile that already sets it,
  including one converted from a remote access profile, keeps its value. To
  check, open **Profiles** > **Effective config** for an endpoint. See
  [Choose which sessions are recorded](/remote-access/session-recording/#choose-which-sessions-are-recorded).

- **Remote access and roles.** The update grants `remote:unattended`,
  `remote:attended`, `remote:consent`, and `remote:escorted` to every role
  that holds `remote:initiate`, built-in or custom, so existing roles keep
  today's access. To narrow how technicians connect, remove mode permissions
  from their role in **Settings** > **Roles**, or set the modes an endpoint
  allows with `remote_access.allowed_modes` in a profile. See
  [Manage roles](/depot/manage-roles/) and
  [Configure access modes and consent](/remote-access/access-modes/).
- **Time limits set to 0.** When remote access profiles became ordinary
  profile settings, Outpost copied their time limits, including `0` values
  that meant the default. The update removes those copied `0` values, so the
  profiles keep the default limits. Any other `0` turns its limit off. Check
  **Profiles** > **Effective config** for an endpoint to confirm the limits
  that apply.
- **Agents older than 0.4.0.** An agent older than 0.4.0 ends a remote
  session that has no time limit 24 hours after the session starts. A change
  of signed-in user near that point can end the session slightly earlier on
  those agents. Update agents to 0.4.0 or later for sessions with no time
  limit. See [Agent 0.4.0](/releases/agent/0.4.0/) and
  [Agent updates](/agent/updates/).
- **Live chat in the tray app.** On Home Lab and Essentials endpoints with an
  agent older than 0.4.0, the tray app shows **Live chat is not available
  right now.** and suggests opening a ticket, rather than saying that live
  chat is not available on the computer.