Enterprise

almyty is open core. Everything you’ve read about so far — agents, tools, gateways, memory, runners, approvals, spend budgets, the basic audit log — is Apache-2.0 and free forever. A small set of enterprise features lives under backend/ee/ in the same repository under a commercial license (see LICENSING.md ).

One image, gated at runtime

There is no separate enterprise build to deploy. The official almyty/api Docker image ships with the enterprise modules compiled in; every enterprise route is gated at runtime by a license check. Without a license the platform runs as the community edition and enterprise endpoints return HTTP 402 Payment Required:


{
  "statusCode": 402,
  "error": "Payment Required",
  "message": "This feature requires an enterprise license",
  "requiredEntitlements": ["sso"]
}

402 is deliberate — it means “unlicensed”, distinct from 403 “unauthorized”.

License keys

Set your license token via the ALMYTY_LICENSE_KEY environment variable on the backend. Tokens are Ed25519-signed and verified offline against a public key baked into the build — no phone-home, no license server, air-gap friendly. An invalid or expired token fails safe to the community edition (logged, never a crash).

Check what your deployment is entitled to:


curl /licensing/entitlements
# → { "edition": "enterprise", "entitlements": [...], "limits": {...}, "expiresAt": ... }

Entitlements

Entitlement	Feature	Docs
`sso`	SAML/OIDC single sign-on + SCIM provisioning	SSO & SCIM
`advanced_rbac`	Custom roles with wildcard permissions + ABAC policies	Advanced RBAC
`audit_export`	Audit log export (JSON/CSV) + SIEM streaming	Audit export
`approval_policy`	Multi-step, conditional, and quorum approval policies	Approval policies
`compliance_pack`	Org-enforced guardrail policy + compliance posture report	Compliance pack
`chargeback`	Per-team cost attribution + spend forecast	below
`byo_kms`	Customer-managed KMS keys	not yet available (endpoint returns 501)

The free tier is a floor, not a trial: core roles (owner/admin/member, team leads), the basic audit log, single-gate approvals, and spend budgets all stay in the open-source edition. Note that an organization’s plan (free/pro) is billing metadata — enterprise features are gated by the license, never by the plan field.

Chargeback

With the chargeback entitlement, one endpoint turns the open-source spend data into an internal billing report:


curl "/chargeback/report?period=month&granularity=day&forecastPeriods=1"

Returns total spend for the window, per-team and per-agent attribution, a spend timeseries, and a linear forecast for the next period(s). Admin/owner only. It layers on the same spend pipeline as cost governance — no separate metering.