Feature Availability by Tier
Tiers: Free Solo Teams
This page shows which features are available on each Control Zero for AI Governance tier. Use it as a quick reference when debugging access issues or planning an upgrade.
Core Platform
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Governed actions (monthly) | 5K | 50K | 250K |
| Projects | 1 | -- | -- |
| Policies per project | 3 | -- | -- |
| SDK (Python, Go, Node.js) | Y | Y | Y |
| Gateway proxy | Y | Y | Y |
| Local policy evaluation | Y | Y | Y |
| Immutable audit trail | Y | Y | Y |
| MCP server (local mode) | Y | Y | Y |
"--" means unlimited.
DLP and Scanning
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Bidirectional DLP scanning | -- | Y | Y |
| Custom DLP rules | -- | Y | Y |
| Locale pattern sets (6 sets: 4 geographic + 2 categorical) | -- | Y | Y |
API and Data
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Management API access | -- | Y | Y |
| Audit log retention | 7d | 90d | 365d |
| Audit export (CSV / JSON) | -- | Y | Y |
Notifications
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Telegram | Y | Y | Y |
| Slack | -- | Y | Y |
| -- | Y | Y | |
| Discord | -- | Y | Y |
| Webhook | -- | Y | Y |
Available in Teams
These features are available in the Teams tier:
| Feature | Free | Solo | Teams |
|---|---|---|---|
| Approvals (HITL, BETA) | -- | -- | Y |
| Browser extension | -- | -- | Y |
| Coding hooks | -- | -- | Y |
| Scout (shadow AI discovery) | -- | -- | Y |
| MCP server (hosted) | -- | -- | Y |
| RBAC | -- | -- | Y |
| SSO / SAML (COMING SOON) | -- | -- | -- |
| Fleet management | -- | -- | Y |
| Compliance reports | -- | -- | Y |
Approvals (human-in-the-loop) are BETA and run on every deployment, including hosted (SaaS). Free and Solo can read the approvals UI but cannot enable the flow -- it needs a separate approver, so enabling starts on the Teams tier. See Approve risky actions.
SSO / SAML is COMING SOON. The per-organization SSO configuration UI, tier gating, and the SAML / OIDC backend are built, but end-user SSO login is not yet self-serve-enabled on the hosted (SaaS) tier -- the login routes are an operator opt-in that must first be staged against a real identity provider. The table above shows it as not-yet-available rather than claiming it as shipped.
Overage Rates
| Tier | Behavior |
|---|---|
| Free | Hard-blocked at 5,000 actions |
| Solo | No hard cutoff. Planned $10 per 100,000 additional actions (not yet charged) |
| Teams | No hard cutoff. Planned $8 per 100,000 additional actions (not yet charged) |
Metered overage charging is not yet enabled (tracking: TODO-OVERAGE-1198). On Solo and Teams, usage above the included amount is metered but not billed today. The rates above are the planned prices for when metered billing ships (#1198).
Support
| Channel | Free | Solo | Teams |
|---|---|---|---|
| Community (Discord) | Y | Y | Y |
| -- | Y | Y | |
| Priority email | -- | -- | Y |
Related
- Pricing: Plan details and FAQ.
- Account Management: Deletion, downgrade, and data retention.
- Notifications: Channel setup instructions.