Skip to main content
August 31, 2026 Documentation correction Action required

​
Affects

Teams that configure Matcher authentication, multi-tenant deployments, or actor-mapping access.

​
What changed

The documentation now correctly states that Matcher accepts plugin-auth or disabled for AUTH_PROVIDER. The former workos provider is retired and Matcher rejects it. disabled turns off authentication and authorization and can expose actor-mapping PII; use plugin-auth when you need those protections. Actor-mapping permissions use hyphenated names such as actor-mappings-read and actor-mappings-write. The Console and API request up to 25 mappings per page. This is a documentation correction of the current runtime behavior; it does not announce a runtime release.

​
Impact

Classification: Action required.

​
What you need to do

  1. Replace AUTH_PROVIDER=workos if it appears in your Matcher deployment, and update actor-mapping role definitions to use the hyphenated permission names.
  2. Review clients that assume 20-item pages before the next deployment.

​
Deadline

Update affected configuration and access-control automation before the next Matcher deployment.