Priced on the work the layer does, one authorisation decision at a time, not on the number of products. Every plan includes the full pipeline.
For teams putting their first agents into production, with every action on record.
For teams running agents across systems, with humans in the loop on the decisions that matter.
For regulated environments with residency, isolation, air-gap, or cross-organisation needs.
| Features | Starter | Growth | Enterprise |
|---|---|---|---|
| Volume | |||
| Authorisation decisions included | 50k / mo | 500k / mo | Committed |
| Registered agents | 5 | 50 | Unlimited |
| Seats | 3 | 15 | Unlimited |
| Workspaces | 1 | Unlimited | Unlimited |
| Enforcement & records | |||
| Deterministic and semantic policies | |||
| Scoped, time-bound delegation | |||
| Shadow mode and backtesting | |||
| Mandates & Charter | × | ||
| Intent Contracts | × | ||
| Access Profiles | × | ||
| Risk Verdict | × | ||
| Escalations and human review | × | ||
| Breakglass protocol | × | × | |
| Runtime containment and kill switch | × | × | |
| Provenance Vault retention | 90 days | 12 months | Unlimited |
| Add-ons | |||
| Agent-to-agent authorisation | Add-on | Add-on | Add-on |
| Cross-organisation federation | Add-on | Add-on | Add-on |
| MCP gateway | Add-on | Add-on | Add-on |
| Xybern Redact | Add-on | ||
| Deployment and support | |||
| Xybern Cloud (fully managed) | |||
| Dedicated Environment | × | × | |
| Sovereign Deployment (on-premise, private cloud, air-gapped) | × | × | |
| Self-hosted relay (local enforcement) | × | ||
| Data residency (US, Saudi, sovereign) | × | × | |
| SSO (SAML / OIDC) | × | SSO | SSO |
| Support | Priority | Named engineer | |
| SLA | × | 99.5% | 99.9% |
| Book a Security Assessment | Book a Security Assessment | Talk to us | |
Tell us how many agents you run and what they are allowed to touch, and we will size it with you.