Tiers and Capabilities
OSS, Developer, Team, and Enterprise tier capabilities and gates.
Overview
AgentTrust uses a five-tier subscription model. Each capability (validation check, adapter, audit feature) maps to a minimum tier. The SDK reads your tier from the API key JWT and silently skips capabilities above your tier.
Tier order (ascending): oss → free → developer → team → enterprise
Why It Matters
Knowing your tier prevents confusion when features appear disabled, adapters refuse to initialize, or gateway responses omit certain fields.
Prerequisites
- API key from
agentrust init(or OSS mode without key)
Step-by-Step Guide
Tier summary
| Tier | Price | Key capabilities |
|---|---|---|
| OSS | Free | Schema validation only; no API key required |
| Free | Free | Evidence, tool trust, auto-decision, local audit |
| Developer | $29/mo | Confidence engine, risk scoring, built-in policy packs, MCP adapter |
| Team | $149/mo | Framework adapters, custom policies, analytics, review queue, webhooks |
| Enterprise | Contact sales | LLM judge, trust chain, SSO, hash-chain audit, SOC2 export, self-hosted |
Capability matrix (selected)
| Capability | Min tier |
|---|---|
| Schema validation | OSS |
| Tool trust check | Free |
| Auto decision | Free |
| Local audit | Free |
| Confidence engine | Developer |
| Risk scoring | Developer |
| Built-in policy packs | Developer |
| MCP adapter | Developer |
| LangGraph adapter | Team |
| CrewAI adapter | Team |
| AutoGen adapter | Team |
| Claude Agents adapter | Team |
| OpenAI Agents adapter | Team |
| Custom policies | Team |
| Policy sync | Team |
| Central audit | Team |
| Analytics | Team |
| Review queue | Team |
| Alert engine | Team |
| Webhooks | Team |
| Trust chain | Enterprise |
| LLM judge (Claude/Ollama) | Enterprise |
| Hash chain audit | Enterprise |
| SSO/SAML | Enterprise |
| SOC2 export | Enterprise |
| Self-hosted | Enterprise |
Check your tier
agentrust whoami
agentrust statusProgrammatic tier check
from agentrust_sdk import Tier, Capability, is_allowed, allowed_capabilities
tier = Tier.TEAM
print(is_allowed(Capability.LANGGRAPH_ADAPTER, tier)) # True
print(is_allowed(Capability.TRUST_CHAIN, tier)) # False
print(allowed_capabilities(tier))Upgrade
agentrust upgrade # opens upgrade pageExamples
OSS — no API key:
from agentrust_sdk import AgentTrustClient
client = AgentTrustClient() # no key → OSS tier → schema onlyTeam — LangGraph adapter:
from agentrust_sdk.adapters.langgraph import AgentTrustNode
# Below Team tier this raises RuntimeError at construction — NOT TierGateError.Framework adapters do not silently no-op below their tier: every one of them raises a
plain RuntimeError prefixed [AgentTrust] from its constructor. TierGateError is a
different, much narrower thing — the SDK raises it in exactly one place (passing
parent_envelope_id without the trust_chain capability) and only when you opt in with
raise_on_tier_gate=True.
Best Practices
- Use OSS/embedded for development; use Developer+ for policy calibration
- Team tier required before production framework adapter deployment
- Enterprise for regulated environments requiring SSO, trust chain, and SOC2 export
- Self-hosted gateway with
AUTH_ENABLED=trueenforces tiers authoritatively
Common Mistakes
- Installing
[langgraph]extra without Team API key - Assuming self-hosted with
AUTH_ENABLED=falsereflects production tier behavior - Expecting LLM judge on Developer tier (Enterprise only)
Troubleshooting
| Symptom | Cause |
|---|---|
RuntimeError: [AgentTrust] … requires … tier | A framework adapter was constructed below its tier |
TierGateError | Only from parent_envelope_id without trust_chain, and only with raise_on_tier_gate=True |
| Adapter raises at construction | Tier below minimum; check agentrust whoami |
| Missing confidence in response | Developer tier required |