Permissions and tenancy
This page states the console's access model as it actually is. The model today is simple: your session type and plan decide what the console will do, and your tenant API key decides whose data it does it with. There is no organization or role layer yet, and this page will say so rather than imply one.
The Account tab showing the current plan, its capabilities, and the upgrade path.
Session types and plans
| Guest | Standard | Pro | Enterprise | |
|---|---|---|---|---|
| Price | Free | $10 / month | $100 / month | Custom |
| Sign-in required | No | Yes | Yes | Yes |
| Assistant queries | 10 total | Unlimited | Unlimited | Unlimited |
| Assistant model | Constellation Basic | Constellation Standard | Constellation Pro | Constellation Enterprise |
| Prediction fidelity | None (general baseline only) | Bronze, all domains | Bronze, silver, and gold | All tiers plus custom-trained models |
| Live fleet API | No | Yes | Yes | Yes |
| Deployment | Shared | Shared | Shared | Dedicated tenant stack; AWS, Azure, GCP, GovCloud, or on-prem |
| Extras | Demo fleet, globe, simulation | Fleet charts and timeline tools, email support | Priority inference queue | SSO, dedicated support, federation settings |
Notes on how this behaves in practice:
- Guests get the full globe, demo fleet, simulation, and ten assistant messages, with no account. Predictions fall back to the keyless general baseline described in Telemetry and predictions. Guest work lives in the browser only.
- Fidelity tiers are plan entitlements, enforced in the console and by the key. The console will not request a tier your plan excludes; asking for gold on Standard yields a plain upgrade hint, not a cryptic error. The same domains exist at every paid tier; what changes is model fidelity and confidence.
- Plan changes take effect in the session; entitlements gate the prediction panel, the assistant's model, and the ML tools uniformly.
Tenant API keys and data scope
Data access is scoped by per-tenant API keys, not by user identity alone:
- Your key reads your tenant's topology and telemetry and writes to your tenant's store. One key, one tenant, no cross-tenant reads.
- The fleet the console shows is a single operator's fleet (the tenant behind your key) plus whatever you add yourself: uploads, chat imports, synthetic assets, and read-only catalog and GSaaS layers.
- Tokens are created and scoped (for example topology read, telemetry write) in Settings, and their origin (server-issued versus local placeholder) is always labeled.
Tenant isolation is treated as a product guarantee: a leaked key must never become a window into another operator's fleet, and the platform's storage tiering is designed around that boundary.
What does not exist yet
Honesty section. Today there are no organizations, no shared workspaces, no per-user roles, and no RBAC: every signed-in user of a tenant operates with the same console capabilities, differentiated only by plan. Organization accounts with roles and per-role permissions are on the enterprise roadmap.
Until then, the practical guidance is:
- Treat tenant API keys as the security boundary and scope tokens narrowly per integration.
- Use separate tenants where separation actually matters; that boundary is real today.
- Do not rely on the console for read-only user enforcement inside a tenant, because it does not exist yet.
Enterprise: dedicated tenant stacks
Enterprise is not just a bigger plan; it is a different deployment shape. An enterprise tenant runs on a dedicated stack (its own data plane and API), deployable to commercial cloud, GovCloud, or on-prem and air-gapped environments, with SSO and custom-trained model tiers. Sovereign and regulated programs get physical and administrative separation rather than logical-only isolation. See Enterprise overview.
Common workflows
| Task | How |
|---|---|
| Evaluate without an account | Guest mode; demo fleet and ten assistant messages |
| Run daily operations | Standard; bronze forecasts across every domain |
| Do anomaly and mission analysis | Pro; silver and gold fidelity, Pro reasoning model |
| Meet sovereignty requirements | Enterprise; dedicated stack in the required environment |
| Scope an integration safely | Dedicated token with only the scopes the pipeline needs |
Example scenarios
Choosing a tier by the question being asked. A two-person ops team on Standard runs fleet health and bronze SNR forecasts happily for months. When they begin flying tighter link margins and need confidence bounds they can defend in review, the gold-tier forecast is the concrete thing Pro buys, and the plan table above is the whole decision.
A regulated program. A government customer cannot share infrastructure or send telemetry offshore. Enterprise gives them a dedicated stack in GovCloud, SSO against their identity provider, and custom models trained on their fleet, while their operators use the identical console surface documented everywhere else in this section.