Feature Availability by Tier
Tiers: Free Solo Teams
This page shows which features are available on each Control Zero for AI Governance tier. Use it as a quick reference when debugging access issues or planning an upgrade.
Core Platform
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Governed actions (monthly) | 5K | 50K | 250K |
| Projects | 1 | -- | -- |
| Policies per project | 3 | -- | -- |
| SDK (Python, Node.js) | Y | Y | Y |
| Gateway proxy | Y | Y | Y |
| Local policy evaluation | Y | Y | Y |
| Append-only audit trail | Y | Y | Y |
| MCP server (local mode) | Y | Y | Y |
"--" means unlimited.
DLP and Scanning
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Bidirectional DLP scanning | -- | Y | Y |
| Custom DLP rules | -- | Y | Y |
| Locale pattern sets (6 sets: 4 geographic + 2 categorical) | -- | Y | Y |
API and Data
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Management API access | -- | Y | Y |
| Audit log retention | 7d | 90d | 365d |
| Audit export (CSV / JSON) | -- | Y | Y |
Notifications
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Telegram | Y | Y | Y |
| Slack | -- | Y | Y |
| -- | Y | Y | |
| Discord | -- | Y | Y |
| Webhook | -- | Y | Y |
Available in Teams
These features are available in the Teams tier:
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Approvals (HITL, BETA) | -- | -- | Y |
| Browser extension | -- | -- | Y |
| Coding hooks | -- | -- | Y |
| Scout (shadow AI discovery) | -- | -- | Y |
| MCP server (hosted) (COMING SOON) | -- | -- | -- |
| RBAC | -- | -- | Y |
| SSO / SAML (COMING SOON) | -- | -- | -- |
| Fleet management | -- | -- | Y |
| Compliance reports | -- | -- | Y |
Approvals (human-in-the-loop) are BETA and run on every deployment, including hosted (SaaS). Free and Solo can read the approvals UI but cannot enable the flow -- it needs a separate approver, so enabling starts on the Teams tier. See Approve risky actions.
SSO / SAML is COMING SOON. The per-organization SSO configuration UI, tier gating, and the SAML / OIDC backend are built, but end-user SSO login is not yet self-serve-enabled on the hosted (SaaS) tier -- the login routes are an operator opt-in that must first be staged against a real identity provider. The table above shows it as not-yet-available rather than claiming it as shipped.
The hosted MCP server is COMING SOON. The MCP server itself is available today in local mode on every tier (see the Core Platform table above); the managed, cloud-hosted endpoint is not yet live. The table shows it as not-yet-available rather than claiming it as shipped. See Hosted MCP Server.
Overage Rates
| Tier | Behavior |
|---|---|
| Free | Hard-blocked at 5,000 actions |
| Solo | No hard cutoff. Planned $10 per 100,000 additional actions (not yet charged) |
| Teams | No hard cutoff. Planned $8 per 100,000 additional actions (not yet charged) |
Metered overage charging is not yet enabled (tracking: TODO-OVERAGE-1198). On Solo and Teams, usage above the included amount is metered but not billed today. The rates above are the planned prices for when metered billing ships (#1198).
Support
| Channel | Free | Solo | Teams |
|---|---|---|---|
| Community (Discord) | Y | Y | Y |
| -- | Y | Y | |
| Priority email | -- | -- | Y |
Related
- Pricing: Plan details and FAQ.
- Account Management: Deletion, downgrade, and data retention.
- Notifications: Channel setup instructions.