Skip to content
Docs

Plans & Feature Access

Plans let an operator offer different editions of AgentWatch to different tenants. A plan carries seat and usage limits and — new in 2.0.351 — the list of console features its tenants can use. Restrict a plan to Observe Platform, Budget Management, Model Catalog and Audit Export, and a tenant on it sees exactly those four sections and nothing else.

Which plans are included?

Section titled “Which plans are included?”

Five plans are created automatically, matching the AgentWatch price list. Each includes everything in the plan before it.

Plan Seats Console features (starting set)
Personal 1 Observe Platform, Budget Management, Model Catalog, Audit Export, API Docs
Professional 1 Personal + Usage Insights, API Key Management, Employee Management, Team Management, Company Settings, Settings (with Enrollment Portal)
Team ~25 Professional + Routing Rules
Business ~250 Everything (unrestricted)
Data Center / Sovereign Negotiated Everything (unrestricted)

These are starting points: every plan’s features, prices and limits can be changed, and you can create as many further plans as you need in Platform Admin → Plans → Create Plan. Professional is deliberately not called “Pro”: installations that predate 2.0.351 already have a plan named Pro, and it is left exactly as it was.

How do I choose a plan’s features?

Section titled “How do I choose a plan’s features?”

Settings → Features → Plan Features (super admin), or the Features button on a plan in Platform Admin → Plans.

  1. Pick the plan.
  2. Turn on Restrict this plan. While it is off, the plan includes every console feature — including ones added in future releases.
  3. Switch on the features the plan includes (grouped as Analytics, Management and Settings), then Save Plan Features.

Gateway Routes, Schema Validation & Plugins and WAF Protection are not plan features: they are super-admin consoles that a tenant never sees, whatever its plan.

How does the Settings group work?

Section titled “How does the Settings group work?”

Settings is the tenant’s Settings menu. Its General page is part of it and always comes with it, so it is not listed separately. Everything else in that menu is a sub-feature listed underneath it:

Sub-feature What it opens
Routing Rules Per-tenant routing rules — pin a team to a model, routing modes
Complexity Routing The complexity-routing configuration (model map, strategy, Test a prompt)
Routing Playground Try a prompt and see which model routing would choose
Single Sign-On OIDC / SAML providers and group mapping
Enrollment Portal Enrollment portal branding and installer signing
API Docs OpenAPI documentation for the gateway routes

Turning Settings off turns off everything under it. The sub-features are greyed out in Plan Features, they disappear from the tenant’s sidebar, and their APIs answer 403 FEATURE_NOT_IN_PLAN. Turn Settings back on and each sub-feature returns to what it was. Turning off Complexity Routing stops a tenant from editing routing; requests sent with "model": "auto" are still routed, because the gateway itself is never restricted by a plan.

Tenants on the plan see the change on their next page load. Every change is recorded in Platform Admin → Audit Logs as platform.plan_features_updated with the before and after values.

To put a tenant on a plan: Platform Admin → Tenants → (tenant) → Plan → Apply.

Can I switch off individual Observe apps and tabs?

Section titled “Can I switch off individual Observe apps and tabs?”

Yes (2.0.357). Under Observe Platform each app — AI, Services, Fleet, Optimize, Business, Security, Insider Risk, Delivery, Logs — has its own switch, and the tabs inside AI (Explorer, Prompts, Agents topology, Evaluations) and Insider Risk (Risk indicators, Enforcement, Data access, Cases) have switches under their app. An app’s Overview tab comes with the app. Switching a parent off switches off everything beneath it; switching it back on restores what was there.

What does a tenant on a restricted plan experience?

Section titled “What does a tenant on a restricted plan experience?”

  • The sidebar shows only the included features. If Observe Platform is not included, the tenant lands on the first section the plan does include.

  • Excluded features are refused by the server too, not only hidden. Their admin APIs answer:

    HTTP/1.1 403
    { "success": false, "code": "FEATURE_NOT_IN_PLAN", "feature": "mcp-proxy",
      "plan": "Personal", "error": "MCP Proxy is not included in your plan (Personal)." }

  • API Docs is normally visible only to super admins; on a restricted plan that includes it — and includes Settings — the tenant’s admin sees it too. The Personal plan lists API Docs without Settings, so its tenants do not see it; add Settings to Personal to offer it (that also brings the General page).

Check what any signed-in user’s plan allows:

Terminal window
curl https://<your-gateway>/api/plan-modules/me -H "Authorization: Bearer $TOKEN"
# {"success":true,"data":{"planName":"Personal","restricted":true,
#   "modules":["observe","budget-management","model-catalog","audit-export"], ...}}
# `modules` is what takes effect: a Settings sub-feature appears only while
# "settings" is included too.

What is never restricted?

Section titled “What is never restricted?”

A plan changes what the console offers. It never weakens protection or locks anyone out:

  • signing in, account recovery and each employee’s own My Dashboard;
  • the gateway itself (/v1/*) — use Settings → Features → Extended APIs for per-endpoint API switches;
  • DLP enforcement, guardrails, budgets and audit recording, which keep running for every tenant;
  • super admins, who always see everything (they assign plans);
  • tenants with no plan, and plans with Restrict this plan off.

Is it safe to upgrade a running server?

Section titled “Is it safe to upgrade a running server?”

Yes. Upgrading to 2.0.351 changes nothing for existing tenants: no existing plan is restricted, and a starting feature set is only ever written to a plan that has no feature settings yet and no subscribers. Nothing hides until a super admin restricts a plan that a tenant is actually on.

Good to know

Section titled “Good to know”
Situation What happens
A feature’s sidebar entry is hidden but a related screen still loads data Screens share some data (employee list, model list, company settings); only data unique to a feature is refused
A plan restricted to no features Allowed after a confirmation; tenants on it see only their own dashboard
The plan lookup itself fails (e.g. a database blip) The request is allowed. This is a commercial control, not a security boundary, and it must not lock a paying customer out
A plan is deleted Its feature settings are removed with it

Sources and references

Section titled “Sources and references”