Open source vs Enterprise
The open-source product is not a demo, a trial, or an installer for something else. It is designed to be genuinely useful with no account.
| Unveilr Guard (AGPL) | Unveilr Guard Enterprise | |
|---|---|---|
| Discover · inventory · assess · explain | ✓ | ✓ |
| Policy-as-code, local evaluation | ✓ | ✓ |
| Local enforcement (supported adapters) | ✓ | ✓ |
| Local evidence | ✓ | ✓ |
| Organisation-wide identity graph | — | ✓ |
| Cross-workstation / cross-account correlation | — | ✓ |
| Central decisioning, approvals, step-up | — | ✓ |
| Distributed enforcement, containment | — | ✓ |
| Tamper-evident central evidence, retention | — | ✓ |
The split is organisational scope
Capability is not removed from the open-source product to create commercial value. Every line in the lower half is something a single workstation genuinely cannot do:
- An identity graph across an organisation needs data from every machine.
- Approvals and step-up need somewhere to route a request and someone to answer it.
- Containment needs to act on infrastructure the CLI has no authority over.
- Tamper-evident central retention needs a party the workstation does not control — that is the entire property.
A policy effect like require_approval therefore degrades locally
rather than silently passing: the local binary has nowhere to send the request,
and saying so is more useful than pretending it was handled.
The licence boundary
AGPL-3.0-only. Enterprise is reached over HTTPS — the AGPL binary never links proprietary code. See ADR-002 and ADR-007.
A network boundary rather than a linking boundary is what keeps the AGPL obligations clean in both directions.