Entitlements and policies

Entitlements are organization-level product limits and capabilities. Policies are deterministic decisions about a specific actor, organization, environment, provider, resource, action, risk, time, approval and plan.

Common entitlements

Key	Controls
cloud.live	Live provider mode
provisioning.plan / provisioning.apply	Plan and apply stages
agents.live	Real on-prem agent operations
pipelines.live	Real CI/CD operations
ai.execute / ai.destructive	AI execution and destructive tools
provider.limit.*, seat.limit, resource.limit, ai.quota	Usage bounds

The API evaluates entitlements server-side on every operation. The UI reads them for presentation only. A missing entitlement returns ENTITLEMENT_MISSING with the requested key.

Policy examples

The policy engine denies demo live actions, cross-tenant references, public admin ingress by default, unencrypted storage where detectable, destructive production changes without elevated approval, disallowed regions, quota overages, unapproved modules and protected-branch direct changes. Every allow or deny returns a decision ID and structured reasons, and is persisted for audit.

Policy is evaluated before approval and again before execution. An AI response cannot create a policy decision, waive a denial or supply authorization.