Enterprise features
The canonical DBTrail EE feature registry (audit, forensics, rbac, sso) and how each one activates from your signed license
dbtrail-ee license # the features: line lists what your license grantsThe recovery safety net is never licensed
An expired, invalid or absent license still runs the full open-source core: capture, index, query, recover, reconstruct, verify, time-travel.
The feature registry
| Feature | What it gates |
|---|---|
audit | JSONL trail of every historical-data access, fail-closed at startup. Audit trail |
forensics | Who-changed attribution: who-changed, user-activity, connection-history, the Forensics view in the web interface, the connection-identity poller, doctor checks, agent commands. Forensics |
rbac | Web interface users with roles, data profiles and access rules, enforced server-side; SSO claim→role mapping. RBAC |
sso | OIDC "Continue with …" login for the web interface, via DBTRAIL_SSO_* |
A license cannot be issued with any other feature name.
What RBAC actually licenses
The core ships the profile data machinery (flag, profile, access) free.
rbac licenses enforcement in the web interface: per-user identities, roles, and
profiles applied per session. The CLI is not an enforcement surface: whoever
holds the index DSN can read the database directly.
How a feature activates
Registration at startup is the gate. There is no runtime check to defeat.
audit: installs the audit sink. If it cannot open, startup exits (unlessDBTRAIL_AUDIT_OPTIONAL=1): fail-closed policy.forensics: registers the commands and agent handlers. Without it,dbtrail-ee who-changedis an unknown command.rbac: installs the multi-user login backend (only when the user store exists and is not empty) and the SSO claim→role mapping when configured. Without it only the built-in credentials log in.sso: installs the OIDC provider on the web interface login. Without it the button never appears.
Enabled means valid or grace: the status words.