Free and paid
The same split applies in Claude Code, Codex and ChatGPT Work. There is no separate plugin plan and no separate Claude Code tier.
| License | Plugin behavior | Seats |
|---|---|---|
| Free | Signed decisions in shadow mode. No tool call is blocked. Burn why and pace stay free. Chain verification is free. | none |
| Solo | Enforce mode, team policy files, receipt export and seat metering. A policy can still choose shadow. | 1 |
| Team | The same paid plugin features. | 5 |
| Team, 50 seats | The same paid plugin features. | 50 |
Start a 14-day Enforce trial by email, no card, from the pricing page. After the trial the plugin returns to free shadow mode.
Activate a license
Section titled “Activate a license”Ask the agentguard-policy skill to activate license <KEY>. Its helper accepts the key on standard input, writes licenseKey into ${PLUGIN_DATA}/policy.json, preserves unrelated settings and resolves the current session again. AGENTGUARD_LICENSE_KEY takes precedence over a saved key.
How the mode is resolved
Section titled “How the mode is resolved”stateDiagram-v2 [*] --> Resolving: SessionStart, one refresh attempt, 2 s deadline Resolving --> Enforce: usable license, seat registered Resolving --> Shadow: no cached license yet Enforce --> Enforce: heartbeat every 5 min from the worker Enforce --> Grace: past expiresAt, up to 7 days offline Grace --> Shadow: grace over, reason license_required Resolving --> Shadow: explicit server rejection, no grace Enforce --> Shadow: seat limit exceeded, reason seat_limit Shadow --> [*]: SessionEnd stops renewal
At session start a detached process makes one license refresh attempt through the Spend SDK. Hook processes only read the local result; without a usable cached license they stay in shadow while resolution finishes. Licensing never denies a tool call.
The shared KV store counts all sessions on a license across machines. A seat stays active for fifteen minutes after its last heartbeat, and its license record expires after twenty four hours. Each live session renews every five minutes from the worker, never from a hook. Heartbeat failures and later over-limit responses do not change the current session mode.
Status shows seats used, the limit, seatStorage and seatsVerified. Memory fallback is explicitly unverified; a failed heartbeat marks any retained count as an older, unverified observation. Renewal stops at SessionEnd or host exit; an unidentified host uses a fifteen minute lease renewed by tool activity.