Level 2: Basics

Enterprise Features

Scale your AI security infrastructure with SSO/SAML, team management, RBAC, compliance automation, unlimited retention, on-premise deployments, dedicated support, and custom SLAs. Built for organizations that need enterprise-grade control.

40 minutes
7 sections
Intermediate

SSO & SAML Configuration

Centralize authentication with Single Sign-On. Supports any SAML 2.0 provider and simplifies user onboarding/offboarding.

Why SSO Matters

SSO Provider Support

Works with Okta, Azure AD (Entra), Google Workspace, OneLogin, Auth0, JumpCloud, and any SAML 2.0 compatible IdP. SCIM provisioning available for automated user lifecycle.

Setup Flow: Okta Example

  1. In AAIS dashboard, navigate to Settings → Authentication → SSO
  2. Click Configure SAML and copy the ACS URL and Entity ID
  3. In Okta admin, create new SAML 2.0 app integration
  4. Paste ACS URL: https://agentaishield.com/api/v1/auth/saml/acs
  5. Paste Entity ID: agentaishield:your-org-id
  6. Configure attribute statements (email → email, firstName → firstName, etc.)
  7. Download Okta metadata XML or copy SSO URL + certificate
  8. Upload metadata to AAIS or manually enter SSO URL and certificate
  9. Test with Validate SSO button (opens test login flow)
  10. Enable Enforce SSO to require SAML for all users
[email protected] Jane Doe Engineering Security

Azure AD (Entra) Configuration

  1. In Azure Portal, go to Enterprise Applications → New application
  2. Create custom SAML application named "AgentAIShield"
  3. Set Identifier (Entity ID): agentaishield:your-org-id
  4. Set Reply URL: https://agentaishield.com/api/v1/auth/saml/acs
  5. Configure user claims (email, givenname, surname, groups)
  6. Download Federation Metadata XML
  7. Upload to AAIS SSO settings
  8. Assign users/groups in Azure AD
  9. Test login and enable enforcement

Google Workspace Setup

  1. In Google Admin Console, go to Apps → Web and mobile apps → Add custom SAML app
  2. Name it "AgentAIShield" and download IdP metadata
  3. Enter ACS URL and Entity ID from AAIS
  4. Map attributes: Primary email → email, First name → firstName, Last name → lastName
  5. Turn on for everyone or specific OUs
  6. Upload Google metadata to AAIS
  7. Test and enforce
Pro Tip: Domain Verification

Enable auto-provisioning by verifying your email domain (DNS TXT record). New employees with @yourcompany.com emails automatically get AAIS accounts when they first SSO in.

SCIM Provisioning (Automated User Lifecycle)

Sync users and groups automatically from your IdP:

// Enable SCIM in Okta SCIM Base URL: https://agentaishield.com/api/v1/scim/v2 OAuth Bearer Token: Supported operations: - Create users (POST /Users) - Update users (PUT /Users/{id}) - Deactivate users (PATCH /Users/{id} with active=false) - Sync groups (POST /Groups)

Role-Based Access Control (RBAC)

Assign granular permissions to team members based on their role.

Built-In Roles

AgentAIShield includes 5 predefined roles:

Permission Inheritance

Roles are hierarchical: Owner > Admin > Developer > Viewer. Higher roles inherit all permissions from lower roles.

Permission Matrix

| Action | Owner | Admin | Developer | Viewer | Billing | |-------------------------------|-------|-------|-----------|--------|---------| | View dashboards | ✓ | ✓ | ✓ | ✓ | ✗ | | View logs & request history | ✓ | ✓ | ✓ | ✓ | ✗ | | Create/edit agents | ✓ | ✓ | ✓ | ✗ | ✗ | | Generate API keys | ✓ | ✓ | ✓ | ✗ | ✗ | | Configure security policies | ✓ | ✓ | ✗ | ✗ | ✗ | | Manage webhooks | ✓ | ✓ | ✗ | ✗ | ✗ | | Configure SSO/SAML | ✓ | ✓ | ✗ | ✗ | ✗ | | Invite/remove users | ✓ | ✓ | ✗ | ✗ | ✗ | | Assign roles | ✓ | ✗ | ✗ | ✗ | ✗ | | View/export billing data | ✓ | ✗ | ✗ | ✗ | ✓ | | Manage payment methods | ✓ | ✗ | ✗ | ✗ | ✓ | | Delete organization | ✓ | ✗ | ✗ | ✗ | ✗ |

Team Management Workflow

Onboarding a new team member:

  1. Navigate to Settings → Team
  2. Click Invite Member
  3. Enter email address and select role
  4. They receive email invitation with signup link
  5. If SSO enabled, they automatically sign in via IdP
  6. Their permissions are active immediately

Offboarding:

  1. Go to Settings → Team
  2. Find user in member list
  3. Click Remove or Deactivate
  4. All active sessions are immediately revoked
  5. API keys created by that user are optionally rotated
Audit Trail Requirement

All role changes, invitations, and removals are logged with timestamp and actor. Immutable audit logs retained according to your plan's retention policy.

Custom Roles (Enterprise+)

For complex organizations, create custom roles with granular permissions:

// Custom role API (example) curl -X POST https://agentaishield.com/api/v1/roles \ -H "Authorization: Bearer sk_live_..." \ -d '{ "name": "Compliance Auditor", "permissions": [ "logs:read", "reports:export", "audit_trail:read" ], "deny": [ "agents:write", "api_keys:create", "settings:write" ] }'

Compliance Reports & Automation

Generate audit-ready reports for GDPR, SOC 2, HIPAA, and custom frameworks.

GDPR Compliance

AgentAIShield includes built-in tools for GDPR compliance:

// GDPR data export (user request) curl -X POST https://agentaishield.com/api/v1/gdpr/export \ -H "Authorization: Bearer sk_live_..." \ -d '{ "user_email": "[email protected]", "include_logs": true, "include_pii_detections": true, "format": "json" }' // Response includes download link to encrypted archive

SOC 2 Readiness

Pre-built control mappings for SOC 2 Type II audits:

Generate SOC 2 evidence package:

  1. Go to Compliance → SOC 2
  2. Select audit period (e.g., last 12 months)
  3. Click Generate Evidence Package
  4. Download ZIP with control screenshots, config exports, logs
  5. Share with auditor via secure link (expires in 7 days)

HIPAA Compliance

For healthcare AI applications:

BAA Requirement

HIPAA compliance requires a signed Business Associate Agreement. Enterprise customers automatically receive BAA upon plan activation. Contact support to initiate signing process.

Audit Trail Management

Every action is logged with immutable timestamps:

// Example audit log entry { "timestamp": "2026-02-25T14:32:18.442Z", "event_type": "config.agent.update", "actor": { "user_id": "usr_abc123", "email": "[email protected]", "role": "admin", "ip_address": "203.0.113.42", "user_agent": "Mozilla/5.0..." }, "resource": { "type": "agent", "id": "agt_xyz789", "name": "customer-support-bot" }, "changes": { "injection_blocking": {"old": false, "new": true}, "pii_redaction": {"old": "partial", "new": "full"} }, "metadata": { "request_id": "req_def456", "session_id": "ses_ghi789" } }

Data Residency Controls

Choose where your data is stored and processed:

Cross-Border Data Flow

Once a region is selected, data is never transferred out without explicit consent. For multi-region organizations, use separate AAIS workspaces per region.

Building Custom Reports

Create compliance reports for internal audits:

  1. Navigate to Compliance → Custom Reports
  2. Select report type (security events, PII access, user activity)
  3. Define date range and filters
  4. Choose format (PDF for auditors, CSV for analysis)
  5. Schedule recurring delivery (weekly, monthly) or one-time export
// Schedule automated SOC 2 report { "report_name": "Monthly SOC 2 Evidence", "schedule": "0 0 1 * *", // First day of month, midnight UTC "format": "pdf", "sections": [ "access_logs", "config_changes", "security_events", "uptime_metrics" ], "recipients": [ "[email protected]", "[email protected]" ], "retention_days": 365 }

Unlimited Data Retention

Enterprise tier removes all retention limits — keep data as long as regulations require.

What's Retained

Configuration Options

Set retention policies per data type:

// Configure retention policies curl -X PATCH https://agentaishield.com/api/v1/organization/retention \ -H "Authorization: Bearer sk_live_..." \ -d '{ "logs": { "full_payload_days": 90, "metadata_only_days": 365, "pii_redaction_after_days": 30 }, "security_events": { "retention_days": 2555 // 7 years }, "audit_trail": "indefinite" }'

Archival & Cold Storage

Older data moves to cheaper storage tiers automatically:

Cost Optimization

Cold storage costs 90% less than hot storage. A customer with 500M requests/year saves $18K/year by auto-archiving data >6 months old.

Export & Backup

Download your entire dataset for external backup:

  1. Go to Settings → Data Management → Export
  2. Select data types and date range
  3. Choose format (JSONL, Parquet, CSV)
  4. Export job runs async (large datasets take hours)
  5. Download from secure S3 presigned URL (expires in 7 days)

VPC & On-Premise Deployments

Run AgentAIShield in your own infrastructure for maximum control.

Deployment Options

Docker Deployment

# Pull AAIS container (requires license key) docker pull agentaishield/enterprise:latest # Run with PostgreSQL backend docker run -d \ --name aais-enterprise \ -p 8443:8443 \ -e LICENSE_KEY=your-enterprise-license \ -e DATABASE_URL=postgresql://user:pass@db:5432/aais \ -e REDIS_URL=redis://cache:6379 \ -v /data/aais:/var/lib/aais \ agentaishield/enterprise:latest # Access dashboard at https://localhost:8443

Kubernetes Deployment

Helm chart available for production k8s:

# Add AAIS Helm repo helm repo add aais https://charts.agentaishield.com helm repo update # Install with custom values helm install aais-prod aais/agentaishield \ --namespace aais-system \ --create-namespace \ --set license.key=your-license-key \ --set postgres.enabled=true \ --set redis.enabled=true \ --set replicas=3 \ --set ingress.enabled=true \ --set ingress.hostname=aais.company.com

Network Architecture

Recommended production architecture:

On-Prem Success Story

A Fortune 500 financial services company deployed AAIS on air-gapped Kubernetes in their datacenter. Handles 12M requests/day with 99.97% uptime, zero data ever leaves their network.

Dedicated Customer Success Manager

Every Enterprise customer gets a dedicated CSM for strategic support.

What to Expect

CSM vs Support

Support handles technical troubleshooting. CSM focuses on strategic success: helping you get more value, optimize workflows, and plan for scale. Both are included in Enterprise.

SLA Guarantees

Enterprise tier includes legally-backed SLAs:

// SLA violation credits (example) Uptime < 99.95%: 10% monthly credit Uptime < 99.50%: 25% monthly credit Uptime < 99.00%: 50% monthly credit Uptime < 95.00%: 100% monthly credit (1 month free)

Strategic Planning & Roadmap Input

Your CSM ensures AAIS evolves with your needs:

Enterprise Unlocked!

You now understand all enterprise capabilities — SSO, RBAC, compliance automation, on-prem deployments, and dedicated support. Ready to dive deeper? Explore Compliance Deep Dive or Architecture & Scale modules.

Previous: Security Deep Dive Next: Compliance & Enterprise
Last verified: March 2026 · Report an issue