Commercial Model

Open-core split

Everything in the apache-core tag in this repository is Apache-2.0. Framework adapters live in the same repo for developer convenience but are runtime-gated by JWT tier claim — they will not execute without a valid Team+ API key.

---

Tier enforcement

Enforcement happens in two places:

1. SDK-side (client-only, honour-system for local dev): agentrust_sdk/tiers.py — is_allowed(capability, tier) gates adapter construction. Without a valid API key the tier defaults to OSS.

2. Gateway-side (authoritative when AUTH_ENABLED=true): middleware/auth.py — parses and verifies the JWT; returns 403 if the requested capability is not in the token's tier claim.

For self-hosted deployments with AUTH_ENABLED=false (local dev only), the gateway accepts all requests. Never run AUTH_ENABLED=false in production.

---

License validation (roadmap — not yet implemented)

The recommended mechanism for paid tier enforcement is:

1. Signed JWT with short TTL (1 hour) issued by https://auth.agentrust.io. Payload: { "org_id", "tier", "agent_quota", "exp" }.

2. Optional hourly heartbeat to https://auth.agentrust.io/v1/heartbeat. On failure → degrade to Apache core (OSS/Free capabilities), never hard-break customer apps (unless AGENTRUST_FAILURE_MODE=closed).

3. Air-gap licence (Enterprise only): long-lived signed JWT (90 days) distributed out-of-band, validated locally with the vendor's public key.

This will be implemented in a future release. Track: GitHub issue: License server + signed JWT heartbeat

---

Proprietary adapter packaging (future)

To ship adapters as a separate proprietary wheel:

1. Move agentrust_sdk/agentrust_sdk/adapters/ to a private repository.
2. Publish as agentrust-sdk-enterprise on a private PyPI index.
3. Replace the adapter imports in the open-core __init__.py with:

   try:
       from agentrust_sdk_enterprise.adapters.langgraph import AgentTrustNode
   except ImportError:
       raise RuntimeError("LangGraph adapter requires agentrust-sdk-enterprise. "
                          "See agentrust.io/upgrade")

Until then, adapters ship in the open repo with runtime tier gating only.

---

OSS vs paid operational model

Positioning: "Apache core you can run forever; paid tiers add adapters, analytics, and ops burden removal."

---