v4.1.0

Released November 10, 2026

Strengthens account security with an option to require multi‑factor authentication and automatic retirement of unused API keys, and adds new models.

Forward‑only upgrade. This release includes database changes and cannot be rolled back to the previous version once applied. Self‑hosted and Ask Sage Edge deployments should plan accordingly; managed (SaaS) tenants are upgraded by Ask Sage.

Action required for some deployments. API keys unused for 30 days are now revoked automatically, and model‑list endpoints now require credentials. See For API users and Before you upgrade below.

Confirming this release. API key owners receive an email reminder before an unused key is retired, where MFA is required, users without it are asked to set it up at their next sign‑in, and GPT‑6.1 Terra, Fable 5.2, Grok 4.7 Gov, and Gemini 4 Carbon appear in the model picker where they’re enabled. Confirm your deployment’s version with your Ask Sage administrator.

🔐 Account security

Require multi‑factor authentication (MFA). MFA can now be required for an organization or for an entire deployment. Users who haven’t set up MFA are taken to MFA setup the next time they sign in, where they choose an authenticator app, a security key or passkey, or (where available) a CAC/PIV card before they can continue. Users who sign in with single sign‑on (SSO) or a smart card (CAC/PIV) aren’t affected. This is off by default. Administrators can require it for their organization through the organization policy API, or by contacting Ask Sage support.
Unused API keys are retired automatically. An API key that hasn’t been used for 30 days is revoked. All of an account’s API keys are also revoked when the account is deactivated for inactivity, and re‑enabling the account doesn’t restore them; create new keys instead. Key owners get an email 7 days and 1 day before a key is revoked, and a notice when it happens.
- Grace period on upgrade: keys that already have 30 days of inactivity when retirement first runs after the upgrade get one week of warning before they’re revoked. Using a key during that week keeps it active.
Clearer sign‑in options. In Settings › Security, the options are now named for what they set up: Authenticator app (any authenticator app works) and Security key or passkey. The sign‑in screen shows a matching option for each method you’ve set up.
Password changes with MFA. Where your deployment requires periodic password changes, you’re asked to update your password after completing MFA sign‑in when a change is due.

🚀 New models

GPT‑6.1 Terra. OpenAI’s GPT‑6.1 Terra is now available to eligible customers via Azure AI Foundry, with a context window of about 1M tokens. It’s flagged for CUI data controls.
Fable 5.2 (Anthropic). Anthropic’s Fable 5.2 is now available to eligible customers via AWS Bedrock GovCloud, with a 1M‑token context window. It’s flagged for CUI / ITAR / EAR data controls.
Grok 4.7 Gov. xAI’s Grok 4.7 is now available to eligible customers via AWS GovCloud, with tool calling and a context window of about 512K tokens. It’s flagged for CUI / ITAR / EAR data controls.
Google Gemini 4 Carbon. Google’s Gemini 4 Carbon is now available in early access to eligible customers via Google Vertex AI, with a 1M‑token context window shared by input, reasoning, and output; image, video, and audio input; and configurable reasoning effort. It’s flagged for CUI / ITAR / EAR data controls.

New models appear only where they’re enabled for your deployment, within your compliance boundary, and for your organization. If you don’t see one, contact your Ask Sage administrator.

🔌 For API users

Model lists require authentication. /openai/v1/models, /openai/v1/models/{id}, and /anthropic/v1/models now require the same credentials as the matching completion endpoints (an API key or access token). Tools that list models before signing in need to send credentials.
Password‑based tokens and MFA. Where MFA is required and the account already has a factor set up, the password‑based token endpoint (/get-token) no longer issues a token; it returns the code mfa_required. Where MFA is required but the user hasn’t enrolled yet, /get-token returns a setup‑only token: account endpoints respond with mfa_enrollment_required, and other API endpoints don’t accept it until the user enrolls. Use an API key for programmatic access.
API key errors. When exchanging an API key for a token (/get-token-with-api-key), unknown, revoked, and expired keys now all return the same message: “API key has been revoked or expired.”

Before you upgrade (self‑hosted and Ask Sage Edge)

Schedule API key retirement. Inactive API keys are retired by a daily scheduled job. Make sure it’s scheduled in your deployment.
Requiring MFA for the whole deployment is a deployment setting and is off by default. To require it for a single organization, use the organization policy API or contact Ask Sage support.

🔒 Security & platform

This release also includes additional security hardening across the platform.

Ask Sage services are delivered as FIPS‑hardened, digest‑pinned, and cosign‑signed images within the FedRAMP Class D certification boundary, and are continuously rebuilt against the latest patched base images as part of Ask Sage’s continuous‑monitoring commitment.