ICP’s Status Visibility Switch Turns Canister Telemetry Into an Access Policy

The Internet Computer has added a new access-control decision to one of its most information-rich management calls: canister_status.

The 0.65.0 interface-spec changelog, dated August 3, 2026, introduces status_visibility. Its three modes are controllers, public, and allowed_viewers. The default is controllers; allowed_viewers can name up to 10 principals in addition to the canister’s controllers. The canister itself and subnet administrators retain access regardless of the selected mode. ICP Developer Docs

That matters because canister_status is more than a simple health check. The management-canister reference defines a response containing the canister’s running state, version, settings, module hash, memory information, cycles, reserved cycles, idle-cycle burn rate, and query statistics. The new setting therefore governs access to a broad operational snapshot, not just an “up or down” flag. ICP Management Canister Reference

For builders, the practical change is to treat observability as a policy choice:

• Use controllers when status data should remain an administrative detail.
• Use public when explorers, dashboards, or third-party tooling genuinely need unauthenticated status access.
• Use allowed_viewers when a monitoring service or auditor needs access without making the full operational profile public.

The distinction is especially relevant for production canisters. A public status response can help external tooling discover health and resource conditions, but it can also disclose information that an operator may prefer to keep private, such as module identity, memory footprint, cycle reserves, or query activity. This is an operational-security inference from the fields defined in the status response, not a claim that the protocol labels those fields sensitive.

The setting is part of the management-canister Candid interface as an optional status_visibility field, so deployment and administration tooling should preserve it when reading and writing canister settings. An update that omits the field leaves it unchanged; an update that supplies it changes the access boundary. The management-canister reference also shows that the field is represented as a variant with controllers, public, and allowed_viewers options.

One implementation detail deserves caution: the sources verify the 0.65.0 interface-spec entry and the documentation change merged on GitHub, but they do not by themselves prove that every subnet has already activated the setting. Teams should confirm support on their target network before making status_visibility a required part of an automated deployment policy.

The broader lesson is architectural. ICP is turning management data into separately governable surfaces: logs, snapshots, and now status each have visibility controls. Monitoring is no longer an all-or-nothing decision attached to canister administration; it can be granted to the smallest audience that needs it.