Feature Availability by Tier
Tiers: Free Solo Teams
This page shows which features are available on each Control Zero for AI Governance tier. Use it as a quick reference when debugging access issues or planning an upgrade.
Core Platform
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Governed actions (monthly) | 5K | 50K | 250K |
| Projects | 1 | Unlimited | Unlimited |
| Policies per project | 3 | Unlimited | Unlimited |
| SDK (Python, Node.js) | Y | Y | Y |
| Gateway proxy | Y | Y | Y |
| Local policy evaluation | Y | Y | Y |
| Append-only audit trail | Y | Y | Y |
| MCP server (local mode) | Y | Y | Y |
Reading these tables: Y means available on that tier, -- means not
available on that tier, and a number or a word (5K, 90d, Unlimited) is
the limit that applies. Anything not yet shipped is labelled in the row itself.
DLP and Scanning
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Bidirectional DLP scanning | -- | Y | Y |
| Custom DLP rules | -- | Y | Y |
| Built-in pattern packs (12 packs: 8 locale + 4 category, 64 unique patterns) | -- | Y | Y |
API and Data
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Management API access | -- | Y | Y |
| Audit log retention | 7d | 90d | 365d |
| Audit export (dashboard CSV) | Y | Y | Y |
| Audit export (API: JSON, CEF, syslog) | -- | Y | Y |
Audit export has two surfaces. The dashboard Export CSV button on the Audit
Log page downloads the filtered trail as CSV, on every plan including Free --
it is built from the audit log query the page already runs, so no entitlement
gates it. The management API endpoint
GET /api/projects/{projectID}/export is gated by the audit_export
entitlement (Solo and above) and serves format=json (default), format=cef
(ArcSight Common Event Format), or format=syslog (RFC 5424-framed CEF) for
direct ingestion by Splunk, ArcSight, and QRadar. The API endpoint does not
emit CSV, and the dashboard button does not emit CEF or syslog.
Notifications
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Telegram | Y | Y | Y |
| Slack | -- | Y | Y |
| -- | Y | Y | |
| Discord | -- | Y | Y |
| Webhook | -- | Y | Y |
Available in Teams
These features are available in the Teams tier:
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Approvals (HITL, BETA) | -- | -- | Y |
| Browser extension (private preview) | -- | -- | Y |
| Coding hooks | -- | -- | Y |
| Scout (shadow AI discovery) | -- | -- | Coming soon |
| MCP server (hosted) (COMING SOON) | -- | -- | -- |
| RBAC | -- | -- | Y |
| SSO / SAML (COMING SOON) | -- | -- | -- |
| Fleet management | -- | -- | Coming soon |
| Compliance reports | -- | -- | Y |
Approvals (human-in-the-loop) are BETA. The request path works on every
deployment: when policy marks an action approval_required, the SDK raises an
approval request and pauses, and an administrator turns the flow on per scope
(org, project, or API key) under Settings -> Approvals. Enabling needs a
separate approver, so it starts on the Teams tier.
The approver-facing pages are not reachable yet. The approvals inbox and request
detail routes redirect to the dashboard in every shipped deployment, and the
notification deep link points at that same path, so no tier -- Teams included --
can resolve a request from the UI today. A request nobody resolves runs to its
deadline, and the SDK then raises HITLTimeoutError with a synthesized deny, so
the original deny stands and the action does not run. See
Approve risky actions.
The browser extension enforces on the covered chat UIs (claude.ai, chatgpt.com, gemini.google.com, perplexity.ai): a deny rule cancels the paste, a mask rule replaces the matched value in the composer before it lands, and a send carrying an error-severity finding is blocked outright. If the scan itself throws, the send is blocked rather than passed through.
A secret-category match is escalated to error severity on the send path,
so a secret rule written as detect or mask still stops the send and opens
the review interstitial. Scope that guarantee accurately before relying on it:
the escalation applies to the send gate only -- it is not applied on paste, so a
secret rule with action detect pastes into the composer and is logged rather
than blocked. The send gate itself is behind blockOnSend, a user-facing toggle
in the extension popup that is on by default but has no admin override; and the
"send anyway" override (allowOverride) defaults to on, requires a typed
justification, writes an audit row, and has no shipped surface that turns it
off. Treat the extension as a strong default that an individual user can still
step around, and put the SDK or gateway in the path when a secret must not be
able to leave at all.
Two limits are worth knowing. It is not published to a browser store yet -- Teams admins distribute the org-configured bundle from the dashboard and developers load it unpacked. And if its DLP rules have not loaded, it does not scan and does not block; it records that non-enforcing state in the audit trail with a distinct reason and warns the user once per session, so a disarmed extension is distinguishable from a clean one.
Compliance reports are Teams-only and generate on demand. The OWASP AI Top
10 report works today, with the caveat that five of its ten checks are platform
attestations rather than measurements of your configuration. The SOC 2 report
reads an audit-log store that hosted deployments do not currently wire, so it
returns AUDIT_STORE_NOT_AVAILABLE instead of a report built on missing data.
The compliance page has no sidebar entry yet; reach it at
/governance/compliance. See Compliance reports.
SSO / SAML is COMING SOON. The per-organization SSO configuration UI, tier gating, and the SAML / OIDC backend are built, but end-user SSO login is not yet self-serve-enabled on the hosted (SaaS) tier -- the login routes are an operator opt-in that must first be staged against a real identity provider. The table above shows it as not-yet-available rather than claiming it as shipped.
The hosted MCP server is COMING SOON. The MCP server itself is available today in local mode on every tier (see the Core Platform table above); the managed, cloud-hosted endpoint is not yet live. The table shows it as not-yet-available rather than claiming it as shipped. See Hosted MCP Server.
Overage Rates
| Tier | Behavior |
|---|---|
| Free | Hard-blocked at 5,000 actions |
| Solo | No hard cutoff. Planned $10 per 100,000 additional actions (not yet charged) |
| Teams | No hard cutoff. Planned $8 per 100,000 additional actions (not yet charged) |
Metered overage charging is not yet enabled (tracking: TODO-OVERAGE-1198). On Solo and Teams, usage above the included amount is metered but not billed today. The rates above are the planned prices for when metered billing ships (#1198).
Support
| Channel | Free | Solo | Teams |
|---|---|---|---|
| Community (Discord) | Y | Y | Y |
| -- | Y | Y | |
| Priority email | -- | -- | Y |
Related
- Pricing: Plan details and FAQ.
- Account Management: Deletion, downgrade, and data retention.
- Notifications: Channel setup instructions.