Enterprise license

Everything needed to build, publish and operate agents is in the Community edition, licensed under the GNU AGPL-3.0, without limits. The Enterprise modules add what a company needs to run many agents with a security officer and an auditor involved. They are source-available under the Rikoo Enterprise License, and running them in production requires a signed license.

What the license unlocks

A license names the modules it grants, one by one.

Module	What it does
Single sign-on	OIDC and SAML, configured per organization
Human approval	A run pauses before a sensitive step and waits for a person to decide
Publication gates	A version is published only if its test suites pass their thresholds
Full audit	Complete audit trail, 365-day retention, CSV export
Source connectors	Knowledge ingested from a website crawl, Notion or Confluence
Several organizations	More than one organization on the same instance; Community allows one
Per-organization trace export	Each organization sends its traces to its own collectors, alongside yours

Without a license, or with one that does not grant a module, the instance runs as Community: it starts normally, and the Enterprise features answer that they need a license.

Requirements

The Enterprise modules are not in the Community images. Run Enterprise images:

• Docker Compose: set RIKOO_EDITION=ee in deploy/compose/.env and run make up, see Docker Compose.
• Kubernetes: deploy the Enterprise image tag provided with your license, see Kubernetes (Helm).

A license on a Community image grants nothing: the modules it names are not installed.

Activate a license

There are two ways. Use one, not both.

In the Studio

An Owner of the instance's first organization opens the license page of the Studio (/enterprise, linked at the bottom of the sidebar), copies the instance identifier shown there, and sends it to Rikoo. The license you receive is issued for that instance: paste it on the same page. It is stored sealed in the database and reaches the api and the worker within a minute, without a restart.

In the deployment

Set the license in the RIKOO_DEPLOYMENT_LICENSE environment variable of the api and the worker:

• Docker Compose: add RIKOO_DEPLOYMENT_LICENSE=<license> to deploy/compose/.env, then make up.
• Kubernetes: rikoo.license.deploymentLicense, preferably from a Secret.

The api and the worker check it when they start. The instance is then licensed by its configuration: the Studio's license page is hidden, and nobody can replace or revoke the license from it. A license meant for this path can be issued without an instance identifier. Use it when the configuration is managed as code.

How the license is checked

• Offline. The license is signed, and Rikoo verifies the signature against a public key built into the product. It never calls home to check it: an air-gapped instance activates the same way.
• Expiry. Validity is checked on every use. When a license expires, its modules stop and the instance continues as Community. A renewed license brings them back.
• Switching a module off. A licensed module can be turned off for the whole instance with a feature flag: RIKOO_FEATURE_SSO, RIKOO_FEATURE_HITL, RIKOO_FEATURE_GATES, RIKOO_FEATURE_CONNECTORS or RIKOO_FEATURE_OTLP_FANOUT, set to off. A flag only removes; it never grants what the license does not.

Check the status

For a license pasted in the Studio, its license page shows the edition, the modules granted and installed, and the expiry date.

In both cases the api logs the outcome under stable event names: license.deployment_accepted or license.deployment_rejected with the reason, license.activated, license.revoked.

Get a license

Enterprise licenses are issued under a commercial agreement. Contact us through rikoo.io/contact, with your instance identifier for a license pasted in the Studio.