Back to the changelog

• Security

  Start requirements on every channel

  The **"Require entityRefId"** rule now applies on **every** creation channel (UI, API, event, Flow Agent, MCP), not just the API trigger — before, a Flow Agent start could create an item with an empty entity reference even when the flow required one. Both this and **"Validate the data payload"** are now presented as flow-level **"Start requirements"** at the top of the Activation tab, out of the "API trigger" block that wrongly implied they were API-only.

• Improvement

  Centralized create and transition paths

  Every point that creates an item or runs a transition (item POST, REST/extension transitions, Flow Agent, worker/MCP callbacks) now goes through a **single state-entry path**. As a result the **Data Gate**, the **AI safety net** (no AI run on empty data) and the **per-state iteration limit** apply uniformly everywhere, including agent starts.

• Integration

  AI start shared between Flow Agent and MCP

  The "Flow Agent" section of the Activation tab becomes **"AI / Agent start"** and makes clear it governs **both** the built-in Flow Agent **and** external AI agents via MCP. The **"when to use this flow"** hints (intent + sample phrases) are now **exposed to MCP agents** too: an external LLM listing the flows sees the same guidance as the built-in agent and knows which flow to start (and which not to).