Platform, Multi-tenancy, RBAC & LicensingGovernance & Platform

Isolation you can audit. Licenses you can verify offline.

Underneath every Netgraph module is a platform built for hard multi-tenancy: tenant_id is first-class on every node, credentials are vaulted per tenant, permissions are enumerable — 390 of them — and licensing is an Ed25519-signed file that activates an air-gapped install with no call-home. From a 16-vCPU pilot to a 50k-EPS enterprise, the same platform, honestly gated.

Hard tenant isolation390 granular permissionsHash-chained AAA auditEd25519-signed licensesAir-gap capableNear-zero RPO DC-DR

Book a demo →Why Netgraph →

What ships in the module

The plumbing every other module stands on.

Native multi-tenancy

tenant_id is first-class on every node: per-tenant graphs, per-tenant vaulted integration credentials and enable-state, per-tenant deployed detection rules — and new tenants provision bare-empty, never pre-seeded.

RBAC / ABAC

390 granular permissions. The menu itself is a catalog driven by license plus role — what a user can't do, they don't see. Attribute rules refine role grants where needed.

Keycloak identity & SSO

Keycloak-backed identity with SAML, OIDC and LDAP federation — bring the IdP you already run, keep the sessions and policies you already trust.

Super Administrator plane

A platform-global Super Administrator distinct from per-tenant admins — separate console, env-seeded bootstrap with forced password change. Tenant admin and platform operation never blur.

Hash-chained AAA audit

Authentication, authorization and actions recorded in a hash-chained, tamper-evident audit trail — who did what is provable, not just logged.

Signed license files

Ed25519-signed .lic files — tamper-proof, downloadable, emailed, and offline-uploadable to activate air-gapped installs with no call-home. Term picker (30/90/365/perpetual) and portable site licenses.

Server-side module gating

Per-module license enforcement lives on the server: unlicensed modules return 404/402 and go fully inert — menus hide, APIs refuse, background loops skip. Not a greyed-out button.

Region-aware billing

Metering stays in USD; each tenant's cost is presented in its region-derived currency using cached FX rates with a working-day fallback — local numbers, consistent base.

Deploy anywhere

Cloud (multi-tenant or dedicated), on-premise with customer-owned storage and keys, or fully air-gapped — offline signed content packs, local model provisioning, zero external dependency.

Scale, resilience, sovereignty

A pilot on 16 vCPUs. An enterprise at 50k EPS. Same platform.

Reference footprints run from a 16 vCPU / 64 GB pilot handling up to 2k EPS to enterprise builds at 96–160 vCPU for up to 50k EPS. Storage and compute are decoupled, so retention grows cheap storage — not compute. DC-DR HA is designed in, and every tier's retention, compression and backup is configurable.

Near-zero RPO streaming replication; warm-standby RTO measured in minutes.
N+1 per plane, cross-site DR — resilience is per-plane, not a monolith failover.
Air-gapped installs stay current via offline signed content packs and local model provisioning.
The license file is the whole activation path — verify with the baked public key, no call-home.

Functionality map

Module functions at a glance

Function	What it does	Where it lives
Tenant isolation	Per-tenant graphs, vaulted credentials & enable-state, deployed rules; bare-empty provisioning	Platform core; Tenant AAA menus
RBAC / ABAC	390 permissions; menu as a license-and-role-driven catalog	Tenant AAA ▸ Roles & Permissions
Identity & SSO	Keycloak-backed identity with SAML / OIDC / LDAP federation	Tenant AAA ▸ Identity
Super Administrator	Platform-global admin plane, separate console, env-seeded bootstrap with forced password change	Platform ▸ Super Administrator
AAA audit	Hash-chained, tamper-evident trail of authentication, authorization and actions	Tenant AAA ▸ Audit
Licensing	Ed25519-signed .lic files: download / email / offline upload; 30/90/365/perpetual terms; site licenses; server-side per-module gating	Tenant admin; Platform ▸ Super Administrator
Billing & FX	USD base metering; region-derived currency presentation with cached FX and working-day fallback	Config; Platform ▸ Super Administrator
Deployment & DR	Cloud / on-prem / air-gapped; near-zero RPO replication, minutes-RTO warm standby, N+1 per plane, cross-site DR; per-tier retention / compression / backup	Config

See it live

Provision a tenant in minutes. Audit it forever.

Book a demo →Browse all modules