Licence tiers and feature keys
Every licence FeatureKey, the tier that grants it, and what an appliance loses when it is absent.
- Type: reference
Every capability the product can sell, the tier that grants it, and exactly what an operator
loses when the key is absent. Regenerate with make docs-generate.
Entitlements resolve as union(payload.features, featuresOfTier(tier)), so a key added to a tier
after a licence was signed is still granted to that licence — an upgrade never silently revokes.
Tiers (3)
| Tier | Label | Aliases | Keys |
|---|---|---|---|
starter | Starter | — | 11 |
professional | Professional | medium | 13 |
enterprise | Enterprise | — | 17 |
Feature keys (17)
FeatureKey | Label | Group | starter | professional | enterprise | What it switches off | Pages |
|---|---|---|---|---|---|---|---|
chat | Chat gateway | core | ● | ● | ● | The chat gateway itself. Not gated key by key: refusing it would be refusing the product, which is what licence expiry already does to the whole appliance. | — |
proxy | API proxy | core | ● | ● | ● | Provider-passthrough API traffic. Same reasoning as chat — it is the product, not a module. | — |
icap | ICAP / inline proxy | core | ● | ● | ● | The inline-proxy / ICAP inspection admin surface: policy, attribution and proxy management. The /inspect/v1 data path is deliberately outside the gate. | /inspection |
ocr | Image OCR | core | ● | ● | ● | Image OCR inside image-analysis. A pipeline stage, reached only through endpoints chat/documents already cover. | — |
documents | Document analysis | core | ● | ● | ● | PDF/DOCX extraction inside document-analysis. Pipeline stage, as above. | — |
redaction | Redaction | core | ● | ● | ● | Image/document redaction. Pipeline stage, as above. | — |
ext.browser | Browser extension | core | ● | ● | ● | The browser extension end to end: enrolment, attestation, deployment, the firewall EDL, and the AI-usage feed the extension produces. | /browser-extension, /ai-usage |
cost.calculator | Token cost calculator | core | ● | ● | ● | Token cost and savings reporting, including the PDF export. | /cost-savings |
compliance | Compliance & GRC | core | ● | ● | ● | GDPR/HIPAA tracking, compliance findings, reports, snapshots, evidence packs and the GRC/CRQ simulator. | /compliance, /compliance-reports |
governance | AI governance inventory | core | ● | ● | ● | The AI asset inventory: shadow/unowned discovery, ownership, and EU AI Act risk tiers. | /governance, /governance/inventory, /governance/risk, /governance/ownership |
endpoint.agent | Endpoint agent fleet | core | ● | ● | ● | Fleet administration for the OS-level endpoint agent. Agents already enrolled keep enrolling, reporting and receiving policy without the key; only the administration screens go. | /endpoint-agent |
mcp.server | MCP server | addon | — | ● | ● | The read-only MCP server, a separate container started by its own compose profile. The gateway puts nothing in front of it, so the key is the commercial entitlement rather than a switch that closes a screen. | — |
cost.token_reduction | Token cost reduction | addon | — | ● | ● | Prompt compression ahead of the provider call. It runs inside the chat path rather than behind a screen of its own, so the key decides whether prompts are compressed at all. | — |
codesafety | Code Safety | enterprise | — | — | ● | Code Safety: repo tracking administration and the auditor model-redaction console. Without the key the detection path stops auditing code as well, not just the admin screens. | /repo-connector |
risk.detailed | Detailed risk analysis | enterprise | — | — | ● | The Risk Analysis findings store and review API. It has no page of its own — the dashboard reaches it from /llm-review, which risk.llm_review gates. | — |
risk.llm_review | LLM Risk Analyst | enterprise | — | — | ● | The LLM Risk Analyst: review pipeline, the knowledge base (attack patterns + the ATLAS/OWASP reference tables the analyst reasons over), and the group-leader view. | /llm-review, /knowledge-base, /analyst, /my-team |
integrations.siem | SIEM export | enterprise | — | — | ● | Outbound SIEM export (syslog/CEF + webhook). Configured from a pane under Settings rather than a page of its own; without the key nothing is exported, not merely hidden. | — |
Keys that gate nothing by design
chat, proxy, ocr, documents, redaction, mcp.server, cost.token_reduction switch no screen off on their own. They are pipeline stages, or the
product itself, reached through the chat and analysis endpoints rather than through a screen of
their own — so there is nothing for the key to hide. An expired licence still blocks them along
with everything else.