What this is, and who it is for
A feature switch says whether one organization may use one licensed feature, independently of roles. There are no plans and no numeric limits: every feature is on by default, and a Super-Admin switches one off for one organization. Only the exceptions are stored; switching a feature back to its default removes the row.
Where to find it
An organization's page → Feature switches (Manage an organization).
What you can do
Each feature is a row with its key, a note (On by default, Switched off for this organization or, for a feature nothing uses yet, Nothing in the product uses this switch yet) and a switch. Flip it to change it; the change is recorded on the ledger as entitlement.set with who made it. A change reaches the trial application within a minute: it keeps each answer for 60 seconds (ENTITLEMENTS_CACHE_TTL_MS), so the first requests after a change may still be answered as before.
Every option
| Key | Gates | Enforced |
|---|---|---|
exports.csv | Requests for an Excel or CSV export, of the data or of a design | Yes, by the format asked for |
exports.cdisc | Requests for a CDISC ODM-XML export, of the data or of a design | Yes |
ai.crf_builder | Both AI form-generation routes: the generator used from a study and the one used from the form library | Yes |
sso | Single sign-on | No. Sign-in is an emailed one-time code; there is no single sign-on. Shown as Not built yet and cannot be switched |
api.access | A public API | No. There is no public API distinct from the application's own. Shown as Not built yet and cannot be switched |
A switch that does nothing is worse than none, so the two that gate nothing are listed (the two planes keep one list), greyed and refused.
How the trial application applies a switch
An explicit off denies the feature. A feature absent from the list is allowed, so an organization provisioned before a key existed is not retroactively restricted. If the control plane cannot be reached the application grants the feature (fail open), and logs a warning: sites entering patient data must not be stopped by a licensing lookup. A failed lookup is remembered for ten seconds before trying again, and a lookup waits at most two seconds. The application reads switches with a narrow key (CONTROL_PLANE_ENTITLEMENTS_KEY) that opens one route and nothing else (Configuration).
What the system records
entitlement.set (the feature, the new value, who) on the platform ledger. See The platform audit ledger.
What you cannot do, and why
- Switch a feature that is not built.
- Give a feature to an organization by role. A switch is licensing; roles still decide who inside the organization may use it.
- Set a limit. There are none: no seats, studies or storage quotas.
Compliance Q&A
Yes. Each change is written to the platform ledger with the administrator who made it.
Limits: when the control plane is unreachable the trial application fails open, deliberately, so that a licensing outage never stops data entry; the failure is logged.
Evidence: control plane entitlements (audit entry entitlement.set with the actor)simulation of 20 Oct 2026, step 1 (sso switched off and on, ledger entries)
Related
Manage an organization · Export data · AI form generation and the AI workstation · Not built yet