Editions & Licensing
The Navique AI Core Operator is open core. The operator that deploys and manages the platform is open source under AGPL-3.0 and runs fully without a license. Enterprise increments unlock with a signed, offline license.
What you are licensing
You are not licensing the underlying open-source tools — LiteLLM, Langfuse, and LibreChat are free and remain free. The license unlocks the automation, multi-instance/multi-tenant operation, cross-component auto-wiring, identity management, SSO/SCIM, audit, and the data-path PII guardrail that the operator layers on top.
The three editions
| Edition | For | Unlocks |
|---|---|---|
| Community (free, AGPL) | Evaluation, single-team use, OperatorHub adopters | The full platform deployment; one instance per type; single-tenant; manual wiring; no guardrail; community support |
| Professional | Self-hosters at real scale | Multi-instance, auto-wiring, the PII guardrail, audit logging, shared datastores, standard support — with multi-tenancy and the Stack umbrella as add-ons |
| Enterprise | Regulated / production | Everything in Professional plus identity management, credential rotation, and air-gapped licensing included — with SSO/SCIM and the management-plane audit export as add-ons; premium support |
The Community edition is genuinely usable for a complete, single-instance platform — there is no crippling. The paid editions add scale, governance, and compliance. See Tiers in detail for the exact included and optional features per tier.
Tiers in detail
Each tier bundles a set of included features (default-on, covered by the base price) and offers further optional add-on features (priced extras you can select). A feature is only selectable for a tier if it is included or offered as an add-on there.
Features by tier
| Feature | Community | Professional | Enterprise |
|---|---|---|---|
auto-wiring | — | ✅ Included | ✅ Included |
guardrail (PII data-path proxy) | — | ✅ Included | ✅ Included |
audit-logging | — | ✅ Included | ✅ Included |
identity-management | — | ➕ Add-on | ✅ Included |
managed-deployment (Stack) | — | ➕ Add-on | ✅ Included |
credential-rotation | — | — | ✅ Included |
sso-scim | — | — | ➕ Add-on |
management-plane-audit-export | — | — | ➕ Add-on |
✅ Included = on by default · ➕ Add-on = optional, selectable for an extra charge · — = not available in that tier.
Instance limits by tier
The license also caps how many of each resource you can run. Paid tiers ship an included allotment and can be raised in unit increments up to a maximum; the Community floor is fixed.
| Resource | Community | Professional (included → max) | Enterprise (included → max) |
|---|---|---|---|
| Gateways | 1 | 3 → 6 | 5 → 25 |
| Observability | 1 | 2 → 4 | 3 → 12 |
| ChatUI | 1 | 3 → 6 | 5 → 25 |
| Users (seats) | 10 | 50 → 150 | 100 → 2000 |
| Teams | 1 | 5 → 25 | 10 → 150 |
| Organizations | 1 | 2 → 8 | 5 → 60 |
| Stacks | — | 3 → 8 | 3 → 25 |
| Support hours | 0 | 20 (up to 120) | 40 (up to 500) |
The Users cap counts User seats (people) — one person is one seat regardless of how many backend Identity accounts they hold. Identity accounts themselves are uncapped.
Indicative pricing
Tiers, included allotments, optional add-ons, and extra-unit pricing are configured in the Navique customer portal (portal.navique.dev), which produces the signed license. Figures below are indicative (CHF, annual) — the portal generates the exact quote and encodes the chosen configuration directly into the license token.
| Tier | Base / year | Optional add-ons | Support |
|---|---|---|---|
| Community | Free | — | — |
| Professional | from 12,000 | identity-management (+4,800), managed-deployment (+3,600), extra instances per unit | 20 h included, then 180/h |
| Enterprise | from 42,000 | sso-scim (+7,200), management-plane-audit-export (+9,000), extra instances per unit | 40 h included, then 150/h |
Support hours are tracked off-cluster
The license states an includedSupportHours figure for reference only. Because the operator is air-gapped and never phones home, the support balance is tracked by Navique off-cluster — see Managing a License.
Feature flags
The license carries an explicit list of feature flags — there is no wildcard. Known flags include:
| Feature | Capability |
|---|---|
auto-wiring | Cross-component credential provisioning + injection |
multi-tenancy | Teams, organizations, and budgets |
identity-management | The User / Identity / Organization / Team resources |
managed-deployment | The Stack umbrella resource |
sso-scim | SSO and SCIM provisioning |
audit-logging | Audit log capture |
guardrail | The data-path PII / guardrail proxy (enforced at runtime) |
credential-rotation | Automatic rotation of operator-owned credentials |
custom-branding | Replace the Navique theme on a Wäg gateway with your own (white-label) — see Console branding. Currently a preview feature: also enabled by preview |
management-plane-* | Features consumed by the management-plane console |
preview | Opt-in to preview (not-yet-GA) capabilities — a master key that unlocks any feature still in preview (currently the service mesh and custom-branding) |
Preview features
Some capabilities ship before they are generally available so a selected test cohort can exercise them in real clusters. A preview feature is usable by a license that carries either the feature's own flag or the umbrella preview flag. Because not-yet-GA capabilities are not offered individually in the customer portal, preview is in practice the way to enable them today. When a feature graduates to GA it leaves preview and is gated solely by its own flag — no redeployment needed. The service mesh is currently in preview; without service-mesh or preview it is refused with a PreviewLocked status (the platform keeps running without mTLS).
Instance limits
Alongside features, the license carries quantitative limits — per-type instance caps such as {"gateways": 3, "langfuse": 1, "chatui": 2, "teams": 10}. Creating an instance beyond a cap is refused with a LicenseLimitExceeded condition; existing instances keep running. The Community defaults are one of each type.
How enforcement works (all offline)
There is no license server and no phone-home — verification is offline against a public key compiled into the operator, so it works air-gapped. Enforcement happens on three surfaces:
| Surface | Enforces |
|---|---|
| Operator reconcile | Instance/tenant limits + feature flags (refuses beyond entitlement) |
| Data-path proxy | The guardrail fails closed without a valid guardrail entitlement |
| Expiry | Graceful downgrade to Community on lapse |
Expiry → graceful downgrade
On non-renewal or expiry, a Professional/Enterprise deployment gracefully downgrades to Community:
- Paid features switch off (the guardrail gate fails closed).
- Instance caps drop to the free level.
- The base platform keeps running.
There is no hostile outage — just a clear, non-destructive reason to renew. Re-applying a valid license restores the entitlements immediately.
The open-core boundary
- The open core (the operator) is licensed under AGPL-3.0.
- The proprietary components — the guardrail / PII data-path proxy, the enterprise feature modules, and the management-plane console — ship as separate, license-gated container images. The guardrail is enforced at runtime in the request path, so it is genuinely unbypassable regardless of the open core.
- A commercial license also lifts the AGPL obligations (dual licensing) for the customer.
The commercial and licensing entity is Navique (formerly Scigility).
Next
Get a license — a trial, a purchase, or a download of an existing one — from the Navique customer portal at portal.navique.dev. See Managing a License to apply, inspect, and renew it.