Licensing

The model

The license is offline: an Ed25519 certificate signed by Atlasberg root keys whose public halves are embedded in the binary. The import verifies parsing, the signature against the keyring, payload validity, the binding to the deployment public key and anti-replay of an older license. Every import attempt, accepted or refused, becomes a license.import event in the trail.

Clock rollback protection: a persisted high water mark, advanced on every status, import and usage call and by a five minute ticker. A regression generates a clock.retrograde event.

States and what freezes

• State: setup | Meaning: No license.
• State: valid | Meaning: Valid license.
• State: grace | Meaning: Expired, still fully functional.
• State: expired | Meaning: Expired past grace.
• The data plane never stops: an unlicensed box still routes inference. In expired state the log states that the data plane is still routing. The module gate is control plane by definition.
• Control plane freeze (expired past grace, or setup): mutations under /api are refused with 403 (license_control_plane_frozen) by allowlist, not denylist. GET reads always pass.
• Only these stay open: the license routes (the way out of the freeze), login and session routes including /api/atlasberg/sso/, /api/atlasberg/files/scan, which is an end-user data plane action, and the revocations under /api/atlasberg/identidade/tokens, because revoking a stolen or departed person's token must never wait for a license. Editing the identity configuration and the local accounts freezes with the rest.

Modules

The closed set this build understands:

• Module: governance | What it enables: Virtual keys, teams, budgets and rate limits.
• Module: local-llm | What it enables: Local model providers, on-prem or air-gapped.
• Module: audit-export | What it enables: Signed trail export and the compliance report.
• Module: byok | What it enables: The customer's own provider credentials.
• Module: sso | What it enables: Corporate OIDC login.
• Module: copilot | What it enables: Importing Copilot license inventories and fixed cost allocation.
• An unknown module never unlocks anything (fail-closed), but it is kept verbatim in the status for honest reporting.
• A module is licensed when it is present and the control plane is not frozen. An expired license does not license a new module action.

Soft cut versus module gate

Two mechanisms on different planes, both deliberate: one rewrites traffic and never denies, the other refuses configuration changes and never touches traffic or reads.

• Soft cut (budgets): when a scope's month spend blows its opt-in limit, the pre-request hook rewrites the model (and provider, when configured) to the degraded one the administrator chose. It never denies and never aborts a request; any internal failure degrades to serving exactly what was asked (fail-open on the data plane). It refuses to rewrite to a model the caller's key cannot use, because governance would return 403 right after. Events: budget.degraded when it served on the cheaper model, budget.degrade_blocked when the rewrite was blocked.
• Module gate (Copilot, module outside the license): writes (inventory import, saving a connection) respond 403 with activation instructions. Reads are never gated: the panel and the connections respond with all their data plus the fact modulo_licenciado and the modulo_aviso notice, so a deployment whose license loses the module keeps seeing the inventory it already has; there is no new import and no new connection until the module returns. Removing a credential never depends on an up-to-date license. The secret is never returned by the API in any state.

Air-gapped billing

• GET /api/atlasberg/license/activation generates the activation request signed by the deployment key, stamped with the product version.
• GET /api/atlasberg/license/usage?period=YYYY-MM generates the signed usage report, with numbers folded from the trail itself (tokens in and out, requests, per model), chained by the previous report hash. Verifiable offline with atlasberg-verify -usage.
• The tokens_per_month limit travels in the license payload and shows in the status.
• Automatic delivery: every closed month, a deployment with a way out to the internet delivers the same signed usage report to the Atlasberg central (POST /api/usage on proxy.atlasberg.com) by itself. No token or password travels: the central verifies the report with the deployment public key it received at activation. Without internet nothing happens; the block is kept on disk and resent, byte for byte, when a way out appears, so the chain stays whole. ATLASBERG_ENVIO_USO_DESLIGADO turns the delivery off; ATLASBERG_CENTRAL_URL points it at another central (https only). The licence status reports it under envio_uso, and each delivery leaves a license.usage_sent event in the trail.

About Atlasberg Platform

Atlasberg Platform is the control layer between a company and every AI model: each request is authenticated with a virtual key, filtered by policy and DLP, routed to the right provider and written to a hash-chained audit trail. It exposes an OpenAI-compatible API, so applications only swap the base URL.

The same artifact runs in Atlasberg Cloud, in your VPC, on-premises or fully air-gapped, and is priced by capacity and modules, never per seat.

This page is part of the official documentation. To talk to the engineering team, write to [email protected] or use https://atlasberg.com/contato. Answers come within one business day.