Enterprise features
The canonical DBTrail EE feature registry (audit, forensics, rbac, sso) and how each one activates from your signed license
dbtrail-ee license # the features: line lists what your license grantsThe recovery safety net is never licensed
An expired, invalid or absent license still runs the full open-source core: capture, index, query, recover, reconstruct, verify, time-travel.
The feature registry
| Feature | What it gates |
|---|---|
audit | JSONL trail of every historical-data access, fail-closed at startup. Audit trail |
forensics | Who-changed attribution: who-changed, user-activity, connection-history, the console Forensics view, the connection-identity poller, doctor checks, agent commands. Forensics |
rbac | Console users with roles, data profiles and access rules, enforced server-side; SSO claim→role mapping. RBAC |
sso | OIDC "Continue with …" login for the console, via DBTRAIL_SSO_* |
A license cannot be issued with any other feature name.
What RBAC actually licenses
The core ships the profile data machinery (flag, profile, access) free.
rbac licenses console-side enforcement: per-user identities, roles, and
profiles applied per session. The CLI is not an enforcement surface: whoever
holds the index DSN can read the database directly.
How a feature activates
Registration at startup is the gate. There is no runtime check to defeat.
audit: installs the audit sink. If it cannot open, startup exits (unlessDBTRAIL_AUDIT_OPTIONAL=1): fail-closed policy.forensics: registers the commands and agent handlers. Without it,dbtrail-ee who-changedis an unknown command.rbac: installs the multi-user login backend (only when the user store exists and is not empty) and the SSO claim→role mapping when configured. Without it only the built-in credentials log in.sso: installs the OIDC provider on the console login. Without it the button never appears.
Enabled means valid or grace: the status words.