#Plan and Entitlements

#Overview

The Plan and Entitlements page at /settings/entitlements shows the active plan tier, effective platform capabilities with a scope badge and a plain-language source label for each, the route-backed transcript download formats, and current tenant usage limits.

This page is intended for plan review and entitlement support workflows. Client roles are read-only: Client Admins can review full detail, while Client Managers see only a plan summary. Edit mode is available only to Partner Admin and AiDial Admin sessions for the active tenant context in the current session.

The current release is descriptive and observational. The page distinguishes stored tenant plan fields from effective capability state derived from the route/RBAC/API sources that actually expose each surface. It does not add new server-side entitlement enforcement.

Entitlement records are tenant-level settings. Some effective capabilities are not tenant-only. Recording download, for example, also depends on selected project/call scope, recording availability, consent, playback compliance, and retention/media conditions. There is no project selector on this page.

#Prerequisites

• You are signed in to the AiDial portal. See Signing In for instructions.
• Your role is permitted to access /settings/entitlements.
• Partner Admin and AiDial Admin edit access depends on the active tenant context in the current session.

#What You Can Review

• Plan tier: Starter, Professional, or Enterprise.
• Effective capabilities: Whether the current role and runtime route

surface make transcript export/download, audit-log access/evidence export, recording download, API keys, outbound, integrations, and max users available, conditional, unavailable, or enforced.

• Capability scope: Each capability is labelled Tenant-level, Route/RBAC, or

Mixed tenant/project/call, so it is clear which checks apply beyond the plan.

• Capability source: Each capability names the system that decides it, in

plain language (for example, Call transcript routes or Recording access policy). Internal module paths are not shown.

• Stored-plan divergence: When a stored tenant flag differs from effective

route reality, the page labels the stored plan state and the effective route state instead of treating the raw flag as final availability.

• Transcript export formats: The read-only view lists TXT and PDF, the two

formats the transcript download endpoints actually serve. CSV is not part of that effective list; it remains a stored plan value that Partner Admin and AiDial Admin can still select in edit mode.

• Usage limits: Current limits for concurrent calls and user seats.

Concurrent-call limits are finite and are shown for reference only. The user seat limit is enforced, and may display as unlimited.

• Last updated: The displayed timestamp combines the stored

portal_entitlements.updated_at value with the per-request time when the effective capability snapshot was derived by the portal BFF.

#Member Quota Behaviour

The Max users entitlement is enforced as the tenant team member quota. 0 means unlimited. Finite limits count active tenant members plus pending, non-expired tenant invitations for counted roles; internal AiDial admin/operator roles are not counted. Current edit bounds are 1-100 concurrent calls and 0-500 users.

The quota is enforced on the server when a tenant invitation is created, when an invitation is accepted, and when a tenant assignment is activated. Once the quota is full, those requests are refused until a seat is freed. Removing a member or cancelling a pending invitation frees a counted seat. Team and user management — including inviting and removing users — is handled by your AiDial partner, not from the customer portal.

Partner Admin and AiDial Admin users can reduce Max users below current counted usage only after acknowledging the over-usage state and entering a justification. Existing members and invitations are kept, but new counted additions remain blocked until usage drops below the new cap.

#Role Behaviour

#Client Admin

• Can review the full entitlement detail for the current tenant.
• Cannot edit plan capabilities or limits from this page.

#Client Manager

• Sees a summary-only view of the current plan.
• Does not see detailed capability or limit controls.

#Partner Admin

• Can review and update entitlements for the active tenant context in the current session.
• Saves changes through the tenant-targeted portal API route.
• Changes are saved with optimistic concurrency checks, so you may need to refresh if another change was saved first.

#AiDial Admin

• Can review and update entitlements for the active tenant context in the current session.
• Saves changes through the same tenant-targeted portal API route as Partner Admin.
• Changes are saved with optimistic concurrency checks, so you may need to refresh if another change was saved first.

#Client Staff and Partner User

• Cannot access the Plan and Entitlements page.

#AiDial Operator

• Cannot access the Plan and Entitlements page.

#Access and Security

The browser uses your signed-in portal session. You do not need to enter or send an API key.

The browser calls portal BFF routes only: client roles read from /api/entitlements, while Partner Admin and AiDial Admin sessions read and save through /api/entitlements/[clientId]. Those route handlers resolve the server-side session and forward the session bearer token to aidial_api at /v1/entitlements/{client_id}. The shared API transport injects the bearer token and strips any forwarded X-API-Key header before the upstream call.

Save requests enforce the portal CSRF check and include the entitlement version for optimistic concurrency. Entitlement access is checked against your role and tenant scope. Navigation visibility is not a security boundary.

Read responses are enriched by the portal BFF with deterministic effective capability metadata. The upstream aidial_api entitlement record remains the stored plan record; the BFF enrichment is used for truthful display and reporting.

#Common Issues

#Related Pages

• Settings Overview
• Role Reference
• Recording Access