Developer Edition vs Enterprise
Enterprise points the same code at a running control plane. What changes is what happens around the decision.
Everything the Developer Edition leaves out needs state outside your process — a fleet to revoke across, a plane to quarantine into, a key to sign lineage with. What it keeps is every guarantee that fits in one process: fail-closed semantics, engine-side attenuation, explicit scopes and value-free audit are identical in both.
What the Developer Edition does, and Enterprise keeps
| Capability | Developer Edition | Enterprise |
|---|---|---|
| Allow / require approval / deny, on real Cedar | ✅ in-process engine, policies from a local file | ✅ a running, scaled decision service |
| Strict-subset sub-agent attenuation, bounded by a delegation-depth limit | ✅ engine-side; max_delegation_depth per governor (default 8) | ✅ server-side; depth limit per tenant (default 8) and per agent |
| Human-in-the-loop approvals | ✅ single-use tokens | ✅ across the fleet, with an operator queue |
| Content screening | ✅ rule-based and in-process: govern.sanitize, govern.screen | ✅ the same class of check as a managed service — centrally authored policies, applied to traffic your code never touches |
| Framework plugins | ✅ LangGraph, Pydantic AI, Claude Agent SDK, DeepAgents, LangChain.js, MCP | ✅ those plus Claude Code, Google ADK, AWS Bedrock, Microsoft Agent Framework, OpenClaw |
| Scopes across a process boundary | ✅ HMAC scope token — integrity within one trust domain | ✅ independently attestable scopes |
| Policy lifecycle | ✅ a file in your repo | ✅ central management, staged rollout across environments |
| Dashboard | ✅ watchlight dev → localhost:7000 | ✅ the operator console |
What only Enterprise does
| Capability | Developer Edition | Enterprise |
|---|---|---|
| Real-time enforcement effects — quarantine an agent, terminate a run, sever a delegation subtree, revoke authority | ❌ the policy loads and the call is denied; the containment action never fires | ✅ a contained agent's live connections are force-closed mid-run, server-side, with no cooperation from the agent; a sever durably collapses the delegation tree |
| Drift and anomaly detection | ❌ | ✅ behavioural, goal-drift and arg-shape detectors, straight to quarantine |
| Runtime enforcement proxy | ❌ governs in-process, plus a PEP in front of one MCP server | ✅ agent egress is mediated on the wire as well as in-process, so a call has to clear both |
| Discovery and registry | ❌ | ✅ continuously scans your environments for agents and MCP servers, and tracks trust state |
| Signed execution lineage | ❌ local JSONL, unsigned | ✅ each step is signed, persisted and verified fail-closed, over a hash-chained audit trail anyone can re-verify |
| Fleet-wide revocation | ❌ a policy you flip, per process | ✅ revocation is durable and enforced at the credential broker, across tenants |
| Attested identity | ❌ the principal is asserted | ✅ OIDC federation and mTLS workload identity |
| Air-gapped fleet deployment | ❌ the library itself runs offline, but there is no plane to deploy | ✅ on-premises, with local policy evaluation |
| Support | ❌ community | ✅ enterprise support and SLAs |
When to reach for it
You have outgrown the Developer Edition when:
- compliance asks "prove who authorized this in production" — you need signed, tamper-evident lineage;
- you are governing more than one agent, or more than one environment;
- security wants a misbehaving agent stopped before its next action;
- you need to revoke authority fleet-wide, not process by process;
- procurement needs SSO, RBAC, HA, SLAs, or an air-gapped deployment.
Each of those is a guarantee a single in-process engine structurally cannot provide.
One layer or two
The Developer Edition decides in your process, and your code acts on the answer. That is exactly right for building and evaluating — zero infrastructure, real decisions, immediate feedback. It also means enforcement is in-band: it depends on the agent's own path calling the decision point and honouring the answer. An agent that can open its own socket can, in principle, route around a check it controls.
Enterprise adds a second, independent layer. The same engine still decides in-process, and a separate runtime governance plane mediates the agent's actual egress and tool traffic out-of-band. A single layer answers "is this allowed?". The second guarantees "nothing else got out" — the difference between a check an agent calls and a boundary it runs inside.
Ready for production? Talk to us about Enterprise.