Enterprise Governance Features

Enterprise governance features provide workspace admins and security teams with the controls needed for compliance, audit, and multi-team management in regulated industries.

Overview

The policy engine and budget controls are available today on the Enterprise plan. SCIM provisioning, custom audit-log retention, and data residency are not yet available — they are on the enterprise roadmap, and this page describes their current status honestly so you can plan around it.

SCIM provisioning (roadmap)

SCIM (System for Cross-domain Identity Management) — automatic sync of users and groups from an identity provider such as Okta, Azure AD (Entra ID), or Google Workspace — is not yet available in AACWorkflow.

Today, team members are invited and managed directly in Settings → Members — see Members and roles for the permission model.

If SCIM provisioning is a requirement for your organization, contact us — enterprise identity integration is prioritized by customer demand, and we can walk you through the current member-management workflow in the meantime.

Audit-log retention (roadmap)

AACWorkflow keeps an audit trail of significant workspace events (see what's logged below). A customer-configurable retention policy is not yet available — logs are retained according to AACWorkflow's standard data-retention practice, and there is no self-serve setting to extend or shorten the window.

If your compliance program requires a specific retention period or a periodic export of audit data, contact us to discuss options.

What's logged

All significant workspace events are logged:

• User actions — login, invite, role changes, workspace settings
• Agent management — agent creation, configuration, approval workflows
• Skill governance — skill approvals, rejections, updates, revocations
• Data changes — issues created/closed, comments, agent runs
• Security events — approval denials, threat detections, policy violations

Policy engine (Enterprise)

The policy engine lets you define workspace-wide rules that control when agents and autopilots can take action. Policies can:

• Require approval before high-risk changes
• Enforce file protections — block changes to sensitive paths
• Restrict operations by agent, project, or time of day
• Mandate reviews for production changes

This is the foundation for features like approval policies and threat detection.

Policy types

• Approval policies — control when agent work requires human review
• File protection policies — block modifications to critical files
• Capability restrictions — limit which agents can use certain tools
• Time-based policies — restrict operations during certain hours

See Approval Policies for detailed guidance.

Budget controls (Enterprise)

Budget controls let you set spending limits per workspace and get alerts when costs exceed thresholds.

Setting a budget

1. Go to Settings → Billing → Budget Controls
2. Enter a monthly credit limit (in USD or your workspace currency)
3. Choose alert thresholds (e.g., 50%, 75%, 90%, 100%)
4. Click Save

How it works

• Alerts — when spending crosses a threshold, you receive a Slack notification (if connected) and email
• Hard stop — if you set a hard stop at 100%, no new agent tasks can start once the limit is reached
• Soft alerts — if you only set alerts, spending can continue but admins are notified

Monitoring spend

1. Go to Settings → Billing → Usage
2. See real-time spending, per-agent breakdowns, and forecasts
3. Drill into specific agents or projects to see cost drivers

See Usage Limits and Enforcement for more details.

Data residency (roadmap)

Region pinning is not yet available — AACWorkflow Cloud currently runs in a single region, and workspace data (issues, comments, transcripts, logs) is stored there. There is no region selector at workspace creation or afterwards.

Note that agents execute on your own machines through the local daemon: your code, working directories, and API keys never leave your infrastructure. For many teams this addresses the core residency concern, because the sensitive material — source code and credentials — is never stored on AACWorkflow's side.

If your regulatory requirements demand hosting workspace data in a specific region (for example the EU), contact us — data residency is on the enterprise roadmap and regional demand directly influences its priority.

Feature flags and billing

Shipped enterprise features are gated by your workspace's billing plan. Features are:

• Automatically enabled when you purchase the appropriate plan
• Defensive parsing — AACWorkflow never assumes features are present; it gracefully handles billing data
• Documented — each feature has its own guide under this docs site

If you're on a lower plan and try to use an enterprise feature, you'll see an error with an upgrade prompt.

Compliance and audit

The governance features above — audit logs, the policy engine, budget controls, and approval workflows — are building blocks that teams use in their compliance programs (SOC 2, GDPR, ISO 27001, and similar frameworks). AACWorkflow does not currently publish formal certifications.

Work with your security team to determine whether AACWorkflow meets your requirements, and contact us for help with compliance questionnaires.

Next steps

• Approval policies — enforcement mechanism for sensitive files
• Usage limits and enforcement — budget and rate limiting
• Secrets isolation (Enterprise) — secure credential management
• Members and roles — permission model and access control