Release 2026.10-R3

Released October 12, 2026.

Dashboard access matches each role

The Dashboard now decides which pages and actions to show from the same permissions the Carriyo API checks for your role. Most users see no change. A few roles see different pages:

• Operators now see Products, read-only, and the Inventory pages. They can view inventory positions, import inventory snapshots and events, and delete positions, which their role already allowed.
• Viewers now see the System Logs of shipments, orders and return requests.
• Viewers and IT managers no longer see the Inventory pages. Their roles don't allow listing inventory positions, so the pages couldn't load them.
• Managers with access to every merchant can now manage account-level notification settings. Managers limited to some merchants still manage them per merchant.

Security: user management stays within your own access

As a security enhancement, you can now only manage users whose access is equal to or less than your own. When you add, edit or import users under Settings > Users, you can only give access you hold yourself: roles in every app, merchants, countries, locations and MCP access. You also can't change or remove a user who holds access you don't. If a change is refused, the message names the access you are missing.

MCP: see your access

The new get_access tool lists the tenants you can use through the Carriyo MCP server. For each tenant it returns the permissions you hold there and the merchants, countries and locations they cover. Agents can call it to learn which tenantId to pass to other tools and what those tools will allow.

Fixes

• Noon cancellations: when Noon cancels a shipment, the shipment now moves to cancelled_by_carrier. Before, Carriyo didn't recognize Noon's cancellation update, and the shipment kept its previous status.