Docs Operate
Enterprise
What an auditor, a regulator or a second agent needs to rely on the record, and where each one is in the app.
Controls from a real evidence packFrom the shared demo workspace
Evidence pack, 1 Oct 2026 to 31 Dec 2026, generated 31 Oct 2026, 10:19 UTC
- 1,086 runs
- 1,081 rule checks
- 63 stopped
- 1,396 audit-log entries
- Intact
- Signed
| Control | Stopped | Last stopped |
|---|---|---|
| Disputed refunds over A$100 must be escalated to a personescalate-large-disputed | 27 | 31 Oct 2026, 07:11 UTC |
| Refunds on a disputed charge need approval | 16 | 31 Oct 2026, 06:19 UTC |
| Claim payouts over A$5,000 need a person to approve thempayout-over-a5000-needs-approval | 12 | 31 Oct 2026, 09:11 UTC |
The capabilities
Each needs the Enterprise plan, except where a row names its own.
| Capability | What it does | Where |
|---|---|---|
| Evidence pack | The period's signed report: runs, what rules stopped, audit log state, redactions. | Evidence |
| Regulatory export | Controls mapped across seven frameworks (EU AI Act, ISO/IEC 42001, NIST AI RMF, APRA CPS 230, GDPR, ISO/IEC 27001, APRA CPS 234), exported with their evidence. GET /api/regulatory/export. | Evidence › Frameworks |
| Control narratives | A written narrative per control, from the evidence behind it. Session only. | Evidence › Frameworks |
| Auditor access | A time-limited, read-only grant for an external auditor. Enterprise plan only; issued from a signed-in session. | Settings › Keys and access › Auditor access |
| Security findings | Your scanner posts findings to POST /api/security-findings with a security_findings-scoped key; a finding that names a run_id attaches to that run. The key can do nothing else. | Settings › Keys and access › Security findings key |
| Trust chain | When a run starts with metadata.parent_run_id, ingest attests the delegation. Read it with GET /api/trust/chain?run_id=…; anyone can check an export with POST /api/trust/verify, which needs no account. From Pro | Runs |
| Chargeback | Cost per team, for internal billing: the By team view. GET /api/chargeback. | Agents › Cost |
| Deep replay | Re-executes your agent's code against a recorded run, with @runback/sdk-replay (not yet on npm; see Replay). The recording comes from GET /api/runs/{run_id}/cassette, which needs a full-access key or a session; a ci key gets 401 and a trace_write key 403. | Your own code, not the app |
| SSO and SCIM | OIDC sign-on and user provisioning; see Team. | Settings › Single sign‑on |
Request and response shapes for every route above are in the API reference, and which plan includes what is in plans.