Enterprise
AI agents under your control.
Manage access, permissions, approvals, and audit logs.
Capabilities
| Capability | What you get | Status |
|---|---|---|
| Identity | ||
| Single sign-on | SAML or OIDC through your identity provider, plus Google, Microsoft, GitHub and Apple sign-in. | Available |
| Two-factor | Authenticator-app two-factor, required for every organization by default. | Available |
| Domain join | People with your verified email domain join automatically. Personal email domains never do. | Available |
| Sessions | Seven days at most, ended after a day idle. Admins can revoke them. | Available |
| Directory sync (SCIM) | Provision and remove people from your directory. | Coming soon |
| Access | ||
| Roles | Workspace, organization and project roles, from read-only to admin. | Available |
| Custom roles | Allow and deny rules for people, nested teams and service accounts. Deny always wins. | Available |
| Branch rules | Required reviews and checks, linear history, signed commits and no force-pushes. | Available |
| Access tokens | Personal access tokens that act with exactly their owner’s permissions. | Available |
| Audit | ||
| Audit log | Sign-ins, pushes, merges, CI runs, permission, secret and settings changes, and AI model calls. | Available |
| Filters | Filter by action, person, result, organization and time. | Available |
| Export | Send the audit log to your own systems. | Coming soon |
| AI agents | ||
| Same permissions | Agents work under the same roles, branch rules and reviews as people. | Available |
| Approvals | Choose which agent actions and workflow decisions need a person. | Available |
| Your model accounts | Link Claude, ChatGPT or Google accounts, or set project API keys. Keys are encrypted and never sent to a branch. | Available |
| Budgets | AI usage metered per person, project and model, with monthly token budgets per organization. | Available |
| Isolation | ||
| Private branches | Branch servers have no public address. All traffic goes through one authenticated gateway. | Available |
| Secrets | Encrypted with AES-256-GCM, scoped to a project or environment, and delivered as a file, never as environment variables. | Available |
| Short-lived credentials | Branch credentials last eight hours at most, and admins can shorten that. | Available |
| Hosting | ||
| Google Cloud | Production runs in the United States (us-central1). | Available |
| Per-cloud control planes | Each cloud has its own control plane, so a workspace and its data stay in the cloud it was created in. | Available |
| AWS and Azure | Run ReasonOS in another cloud. | Coming soon |
| SOC 2 report | An independent audit report. | Coming soon |
Bring your security questionnaire.
We will walk your team through how ReasonOS handles identity, access, data and agents.