# September 2026

> September 2026 release notes for Test Cloud in Automation Cloud.

## September 4, 2026

### Relay permissions for role-based access

Relay access is now controlled by dedicated **Relay** permissions instead of Test Cloud administrator group membership. Tenant Administrators can create, edit, and delete Relay Groups without an Organization Administrator role, and custom roles can grant granular Relay access: **Relay group** (View, Create, Edit, Delete), **Relay client** (Delete), and **Relay group config** (View).

Custom roles that previously granted Relay visibility through the **Centralized Access Administration page** permission no longer have access to Relay Groups. Those roles must be updated to include **Relay** > **Relay group** > **View**. Organization Administrators and Tenant Administrators are unaffected.

For details, see [Configuring a Relay group](../admin-guide/configuring-relay-group.md) and [Roles](../admin-guide/roles.md#tenant-administrator-role-permissions).

### Relay support for TCP-based connections

Relay now reaches supported on-premises systems that use protocols other than HTTP. The first supported connection is SAP BAPI, which uses SAP's RFC protocol over TCP.

Relay routes these calls through the on-prem executor, a Java process that the Relay client starts and supervises on the same host. The executor listens on the loopback interface only and accepts no connections from outside the host.

Using a TCP-based connection requires Relay client `26.4.3` or later, a Java 21 or later runtime on the Relay host, and the connector's libraries in a directory you provide. Arbitrary TCP passthrough is not supported, and the on-prem executor is not available when you run the Relay client as a container.

For details, see [Supported TCP-based connections](../admin-guide/using-relay.md#supported-tcp-based-connections) and [On-prem executor for supported TCP-based connections](../admin-guide/deploying-relay-client.md#on-prem-executor-for-supported-tcp-based-connections).