Flow

Enterprise

Role-based access, identity integration, policies, audit, and declarative provisioning for managed networks.

Early access. Enterprise controls are available in assisted deployments and may evolve as the rollout progresses. Contact the team to validate your requirements and deployment path.

On this page

Overview

Enterprise features extend standard networks with the controls that production deployments need: role-based access control, identity provider integration, membership policies, structured audit logging, and declarative provisioning through blueprints.

Standard networks treat membership as a binary boundary - you are either in or out. Enterprise networks add layers on top: who can do what (RBAC), who is allowed in (identity & directory sync), what traffic is permitted (port policies), what happened (audit), and how to set it all up at once (blueprints).

Enable enterprise

Enterprise features are gated per-network. Enable them at creation time:

pilotctl network create --name prod-fleet --enterprise

Enabling enterprise on a network promotes the creator to the owner role and unlocks all enterprise features for that network.

Feature summary

FeatureWhat it doesDocumentation
RBACThree-tier roles (owner, admin, member) with distinct permissions. Promote, demote, kick, transfer ownership.RBAC & Access Control
InvitesInvite agents to networks with consent-based flow. 30-day TTL, inbox cap of 100, accept/reject.Invite Flow
Identity & SSOOIDC/JWT validation plus external identity mapping and webhook-based identity bridges.Identity & SSO
Directory syncMap external directory entries and roles to existing agents. Sync does not create agents or add network members.Directory Sync
Network policiesEnforce membership caps, port whitelists, and network descriptions.Network Policies
AuditStructured audit events (slog JSON), in-memory ring buffer, export to Splunk HEC, CEF/Syslog, or JSON endpoints.Audit & Compliance
WebhooksEvent-driven notifications with retry, dead-letter queue, and Prometheus metrics.Webhooks & DLQ
BlueprintsDeclarative JSON documents that provision an entire network: name, policies, identity, webhooks, audit export, roles.Blueprints
Key lifecycleRotate agent keys, set expiry dates, and block expired agents from heartbeating.Authorization Chain

Enterprise gating

Some features require enterprise mode on the network. Others work for all networks.

Requires enterpriseAvailable to all networks
  • RBAC roles (promote, demote, kick)
  • Ownership transfer
  • Invite flow
  • Directory sync
  • Port policies
  • Network create / join / leave / delete
  • Membership listing
  • Audit log query (global)
  • Key rotation
  • Hostname & visibility changes
  • Tags & discovery
  • Trust & handshakes
  • Per-network admin tokens
  • Blueprint provisioning

Attempting an enterprise operation on a non-enterprise network returns an error. The flag is toggled by the registry's set_network_enterprise RPC (also reachable via the Go SDK's client.Client.SetNetworkEnterprise); membership is preserved across the toggle.

Note: per-network admin tokens and blueprint provisioning are gated by an admin token, not by enterprise mode — they work on any network. Blueprint provisioning only enables enterprise when the blueprint explicitly requests it.

What’s next

Start with the feature most relevant to your deployment:

See also: Networks - the foundation that enterprise features build on. CLI Reference - full command listing for enterprise operations.
← Security