Plan Features: What Each Tier Unlocks

A Quartyl plan is not a bag of entitlements: it is a set of eleven boolean feature flags, one per gated capability, and everything the workspace hides or shows derives from that set. This page is the catalog — the exact flags, what each one gates, and the machinery that enforces the boundary on both sides of it, the UI and the API.

The catalog: eleven flags

The plan console renders one toggle per entry; the key column is the exact identifier the platform and the workspace share:

Key	Label	Description	Suggested tier	Manual page
result_charts	Result graphs & charts	Interactive charts and graphs on benchmark result pages.	enterprise	Charts
user_management	User & role management	Team roster, invitations, and role assignment console.	enterprise	Team Management
appearance_theme	Appearance theme	Custom UI theme variant for the firm workspace.	enterprise	— chosen in the dashboard appearance picker (Partner / Firm Admin)
firm_settings	Firm settings	Firm-wide configuration and preferences panel.	enterprise	Firm Settings
dump_retention_config	Extended dump retention	Configurable dump retention beyond the default 7 days.	enterprise	Dump Data
advanced_ai_screening	Web research + advanced AI screening	Per-company web research for independent evidence, plus an independent deep FAR re-screening of the comparables that AI screening kept.	enterprise	AI Screening
predictive_risk	Predictive risk engine	Portfolio risk and audit-probability views.	enterprise	Predictive Risk Engine
evidence_repository	Evidence repository	Cross-study evidence search, war room, append-only audit ledger, certified packet exports, and retention.	enterprise	Evidence Repository
api_access	API access	Programmatic access and third-party integrations.	enterprise	Developer Console
white_label	White-label branding	Firm brand name and accent colour in the workspace.	enterprise	Branding and White-Label
priority_support	Priority support	The priority-support card on the Help page and priority tagging of feedback.	enterprise	Contact Support

Two of those descriptions are ours, not the console’s: the platform catalog text for white_label reads “Branded reports and custom subdomain”, for priority_support “Priority support with a named account manager”. Neither is what ships. Generated deliverables carry the platform’s house brand (there is no per-firm report template and no custom domain), and support contacts are in-app defaults. The screening models are configurable slugs on an OpenAI-compatible gateway — by default qwen/qwen3.8-max:free for the screening pass and mistralai/mistral-large-2512 for the deep pass.

The suggested tier is guidance only — the platform composes each plan and decides what it actually contains. The two seeded plans bookend the catalog: the Boutique Firm Plan ships with every flag off, the Enterprise TP Suite with every flag on, and a custom plan picks its own set. Price and quota entitlements (reports per month, seats, study capacity) live on the plan itself, not on the flags — see Billing and Usage.

How gating works

The boundary is enforced in two layers, and the two layers agree:

The workspace: hidden, not locked

• The sidebar renders an entry point only for features the firm’s plan holds; a group that empties out disappears entirely. There is no greyed-out or locked entry anywhere in the shell.
• Direct navigation to a gated page is redirected to the dashboard by a route guard — the page never mounts and its component API calls never fire, so a stale bookmark costs nothing but a redirect.
• In-page surfaces follow the same rule: the Branding tab exists in Firm Settings only when white_label is held, and the priority-support card on the Help page only when priority_support is held.
• The enabled set rides on the session profile (the /users/me response carries the firm’s plan features), so the shell can filter itself without an extra call. A tenant-less platform account carries no plan and is never filtered.

The API: the security boundary

Hiding the UI is convenience; the enforcement is server-side. Every gated endpoint carries a plan-feature dependency that resolves the caller’s tenant plan per request:

• Feature held — the call proceeds under the normal role rules.
• Feature not held — a 403 on every request, with no grace period. A downgrade takes effect on the next call: existing API keys stop working, the evidence endpoints refuse, and the risk API locks out the moment the feature goes.
• Tenant-less platform accounts (Superadmin) fail open — the platform is the operator of the boundary, not a subject of it.
• A tenant with no assignable plan is denied — a firm never gains a gated capability by omission.

Not every flag has a server-side guard, and the manual should not pretend otherwise:

Enforcement	Flags
HTTP guard on the gated routes	api_access, evidence_repository, firm_settings (the whole panel, SSO included), predictive_risk, user_management, appearance_theme (the theme write only)
Inline check on one field	white_label — only the branding block of the firm-settings save returns 403; reads, the other blocks and reset are not gated by it
Pipeline step gates	advanced_ai_screening — one flag for both gated steps, the web research pass and the deep FAR step after it — the run skips the step rather than failing
Plan licensing at provisioning	dump_retention_config — no HTTP guard; the plan’s retention window becomes the firm’s
Frontend only	result_charts, priority_support — nothing server-side reads these keys

Roles and features compose: roles decide who may act on a capability that exists; features decide whether the capability exists at all for the tenancy — the split is mapped in Roles & Permissions.

Losing a feature

Losing a feature changes access, not records:

• The entry points disappear and the endpoints start returning 403 immediately.
• Nothing is deleted: studies, evidence, keys and audit records all remain stored; they are simply unreachable through that surface while the feature is off, and reachable again when it is re-added.
• A firm that loses white_label keeps a working, unbranded workspace (reads and reset stay open); a firm that loses user_management keeps its roster but loses the console that changes it.

FAQ

Can a firm buy a single feature? No self-serve feature purchase exists. The plan is the unit of entitlement: the platform composes plans from this catalog and sets the flags per plan, and the firm’s current plan, quotas and seat position are visible in Billing and Usage.

Why does the workspace show nothing instead of a locked button? A lock panel advertises a capability the firm neither holds nor can self-serve. The workspace shows only the surface the plan funds; the gap is visible where the plan itself is visible, not sprinkled across the sidebar.

Do features change what the pipeline runs? At step level, yes: advanced_ai_screening gates both the web research step and the deep FAR step after it — one flag for the pair — while predictive_risk gates the inline predictive-risk analytics. A run without the feature skips those steps rather than failing, and the study’s record reflects exactly what ran.

Where does a firm admin see the enabled set? The Billing and Usage page shows the plan the firm holds; the individual flags ride on the session profile that the workspace reads to render itself. The plan-composition console is platform-side, not part of the firm’s own administration.