Navin Enterprise
Enterprise sits above Team: quote-based pricing (no Stripe checkout), high execution limits, SSO config storage, append-only audit, and org RBAC.
Individual Free remains available with bring-your-own keys (BYOK).
Plan
- Defined in
site/src/lib/plans.tsasenterprise. priceUsd = 0,stripePriceEnv = null→ pricing UI shows Contact / Contact sales.- Limits via
enterpriseLimits()(high concurrent agents, devices, steps). - AI budget is contract-specific:
resolveEnterprisePlan(aiBudgetUsd).
Assign Enterprise manually from the site admin console (/admin → Attribuer un abonnement) or via /api/admin/assign with plan: "enterprise". Prefer sales-led onboarding; do not expose a self-serve Stripe path.
Database
Migration: site/supabase/2026-08-02-enterprise.sql
| Object | Role |
|---|---|
audit_events | Append-only audit log (org_id, actor_user_id, action, resource, metadata, created_at) |
audit_events_reject_mutation() | Trigger function blocking UPDATE/DELETE |
org_sso_configs | Per-org OIDC/SAML stub (provider, issuer, client_id, enabled, metadata) |
RLS: org admins can SELECT. Authenticated users cannot INSERT/UPDATE/DELETE audit rows; writes go through the service role (/api/audit, helpers).
APIs
| Method | Path | Who |
|---|---|---|
| GET | /api/audit?orgId= | Org admin (audit_read) |
| POST | /api/audit | Service (Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY) or org admin |
| GET | /api/orgs/sso?orgId= | Org admin (manage_sso) |
| PUT | /api/orgs/sso | Org admin (manage_sso) |
Helper: site/src/lib/audit.ts (appendAuditEvent, listAuditEvents).
Alias: /api/enterprise/sso re-exports the orgs SSO handlers (prefer /api/orgs/sso).
RBAC
site/src/lib/rbac.ts - roles admin | member | viewer.
| Action | admin | member | viewer |
|---|---|---|---|
| read | yes | yes | yes |
| write | yes | yes | no |
| invite / manage_members / manage_sso / audit_read / admin | yes | no | no |
Check: node site/scripts/test-rbac.mjs
SSO wiring (not implemented end-to-end)
Config is stored only. Choose one path later:
WorkOS
- Set
WORKOS_API_KEYandWORKOS_CLIENT_ID. - Create a WorkOS Organization with
external_id = organizations.id. - Enable SAML or OIDC; store
issuer,client_id, andmetadata.connection_idviaPUT /api/orgs/sso. - Add
/api/auth/sso/start→workos.sso.getAuthorizationUrl(...). - Callback: exchange code, upsert Supabase user, set session cookie.
Supabase SAML
- Dashboard → Authentication → SSO → Add SAML 2.0 provider.
- Map IdP Entity ID / ACS URL; keep domain mapping in Supabase.
- Persist domain /
provider_idinorg_sso_configs.metadata. - Login with
supabase.auth.signInWithSSO({ domain }).
Tool policy (runtime)
navin/enterprise/policy.py - org allow/deny lists for tools:
from navin.enterprise import check_tool_allowed
ok = check_tool_allowed("shell", {"allow": ["shell", "read_file"], "deny": ["browser"]})
Deny wins. A non-empty allowlist is fail-closed for unknown tools.
Evals harness
Offline golden prompts (mock model, no network):
python -m navin.evals.runner navin/evals/datasets/smoke.jsonl
python -m unittest navin.evals.tests.test_evals_harness
Admin note
When assigning Enterprise from /admin:
- Prefer after a signed quote (custom AI budget / seats).
- Enterprise is not self-serve Stripe; use assign or sales ops.
- Enable SSO and audit only for orgs on the Enterprise plan (product gate can be added later on top of these foundations).