Add-On Entitlements

Activate and deactivate add-on packages per company (tenant), and understand how a package's active state gates every one of its screens.

What an Entitlement Is

An entitlement records which add-on packages a company (tenant) has activated — its list of active packages. It is the Level-1 gate: if a package is not active, none of its screens open, and an Upsell panel is shown instead.

Tenant → Packages → Capabilities → Roles

A tenant activates packages; a package unlocks that domain's capabilities; capabilities are bundled into roles; roles are assigned to people. Entitlements sit at the very top of that chain.

Managing Add-Ons (Administrators)

Administrators manage add-ons in two places, both writing the same per-tenant entitlement — so what you toggle is exactly what the app enforces:

In-app "Add-Ons" screen

Admin → Add-Ons. Pick a tenant, toggle each package on or off, and manage per-person access by granting/revoking domain roles.

Tenant admin panel

The tenant table shows an Add-Ons column with a chip per package; click a chip to add or remove that add-on for the tenant.

Role	Scope
Tenant Admin	Can activate/deactivate add-ons for their own company only.
System Admin	Can manage add-ons for any tenant.

Activating a Package

Open the tenant's add-on management (in-app Add-Ons screen or the tenant panel).
Toggle the package on. Its screens immediately stop showing the Upsell panel for that tenant.
Assign the module's roles to the relevant staff so they can actually open the operational screens (see Staff & Multi-Hat Assignment).

Active package ≠ automatic access

Activating a package clears the paywall (Level 1). Individual users still need a role in that domain to open its operational screens (Level 2). Governance screens (Roles / Staff) remain admin-only.

Deactivating a Package

Toggling a package off re-applies the paywall: every screen in that add-on returns to the Upsell panel for that tenant. The tenant's roles and staff assignments are not deleted — they simply become inaccessible until the package is reactivated.

Coming-Soon Packages & Future Purchase

The catalog also lists packages whose screens aren't built yet — these are marked Coming soon and can't be toggled on. The same activation mechanism is designed to later support self-serve purchase by credit card, so a company can buy an add-on directly and have it activated automatically.

Frequently Asked Questions

Does the admin panel ever disagree with what users actually get?

No — the admin toggle and the app's access guard read and write the same per-tenant entitlement. There is no separate central file to fall out of sync.

I activated a package but a user still can't open its screens. Why?

Activation only clears Level 1 (the paywall). The user also needs a role in that module's domain for operational screens; Roles/Staff screens are admin-only. Assign them a domain role.

If I deactivate an add-on, do I lose its data?

No. Roles and staff assignments are preserved; they just become inaccessible until you reactivate the package.