Welcome to BrightOnAGENTIC Documentation

Mixed projects: one account plan, two pricing pools

Foundry and CrewAI projects share one agent pricing pool: add their secured agents and workspaces together. All N8N workspaces share a second pool, with regular nodes and AI Agent nodes priced separately. Do not combine Foundry/CrewAI agents with N8N node counts.

The applied account plan controls the interface, features and automatic scan cadence for every workspace: weekly for Starter, daily for Growth, and every 12 hours by default for Enterprise after activation. Each pool retains its own pricing tier, minimum and contract terms. Add the two pool subtotals into one invoice. An account-level upgrade caused by combined workspaces does not by itself impose the Enterprise minimum on a lower-tier N8N or agent pool.

How plan changes work with two pools

Reassess each pool using its own units and workspace count. Apply that pool’s upgrade, grace, downgrade and contract-lock rules, then recheck the account plan against both applied pool tiers and total workspaces. A pool can become eligible for Starter while the account remains Growth or Enterprise. A lower account plan takes effect only when every condition is met and the applicable billing boundary or contract lock permits it.

A fourth total workspace requires Enterprise handling without node-excess grace. Conversely, reducing total workspaces to two cannot lower an account while either pool still requires or is locked to Enterprise.

Azure Foundry & CrewAI plans and capabilities

The following agent-based limits, billing minimums, scan allowances, and transition rules apply to the combined Foundry/CrewAI pricing pool. Agent counts are pooled across both project types. In a mixed account, features and automatic scanning follow the higher applied account plan. For N8N on AKS, use the N8N rules below.

Paid Starter and Growth workspaces provide dashboard, inventory, graph, and threat-analysis views. AI Trust Matrix is an Enterprise capability. Growth Red Team access requires the add-on; it is not included automatically with the base plan.

Foundry & CrewAI usage counts

Actual secured agents

The observed agent count in your secured scope, used to assess plan eligibility.

Active workspaces

Empty workspaces do not count as active for plan transitions. Two active workspaces prevent a move to Starter, even below 15 agents.

Billable agents

A billing minimum can exceed actual usage: paid Starter has a 6-agent minimum; Growth has a 15-agent minimum; an activated Enterprise agent pool has a 51-agent minimum until contract end.

Other account allowances

Check Your profile and Manage users for Azure subscription and user-seat allowances. These are separate from the agent and workspace thresholds above.

Workspace count affects eligibility and scan cadence. It is not a separate workspace fee. The Free Trial has no paid billing minimum.

Foundry & CrewAI scan schedules and allowances

An automatic schedule specifies how often each eligible workspace is scanned. It is separate from your manual-scan allowance. For example, Growth with 3 eligible workspaces schedules one scan for each workspace per day; that is not a shared monthly quota.

• Free Trial: 2 manual scans total during the 7-day trial, with no automatic schedule.
• Starter with 0–9 actual agents: weekly automatic scans; no manual scans included.
• Starter with 10–14 actual agents: weekly automatic scans plus 2 manual scans per billing period. A manual scan does not change the next automatic run.
• Growth: daily automatic scans per eligible workspace. Check the scan launcher for any manual allowance available to your account.
• Enterprise: automatic cadence and manual allowances follow the agreed contract, with twice-daily automatic scanning as the default.

Before queuing a manual scan, check the remaining allowance in the scan launcher. Using a manual allowance does not consume or replace the paid plan’s automatic schedule.

Foundry & CrewAI plan transitions

Starter to Growth: immediate

The paid plan moves from Starter to Growth when actual secured agents reach 15, or active workspaces increase above 1, provided the scope stays within Growth’s limits. This applies when a manual or scheduled scan detects the changed scope. Monthly settlement reflects the pricing applicable before and after the change. Do not add a duplicate upgrade charge for usage already included in settlement.

Growth to Starter: next monthly billing cycle

A downgrade takes effect at the next billing cycle only when both conditions are met: 14 or fewer actual secured agents and exactly 1 active workspace. Reducing agents alone is not enough. Until the change takes effect, the current plan remains Growth. The annual contract continues through its existing end date after the plan changes.

Growth to Enterprise: scan-detected agent increase

If a manual or scheduled scan detects more than 50 secured agents, an in-app and email notice gives you 48 hours to reduce the count to 50 or fewer. If the count remains above 50 when the window expires, Enterprise activates automatically. Letting the window expire with the excess scope counts as approval of the transition, and the applicable billing adjustment begins. Enterprise then remains in effect for the remaining duration of the current annual contract.

Enterprise scope selected during deployment setup

Adding a deployment that selects more than 50 agents or more than 3 active workspaces triggers Enterprise immediately, with confirmation during the deployment workflow before activation. That action is treated as explicit approval. The scan-detected 48-hour window does not apply to this confirmed scope selection.

Once Enterprise is active

Enterprise is always an annual commitment, whether activated during onboarding or through a usage-based transition. Onboarding establishes the annual Enterprise term. A transition during an existing annual contract applies for the remainder of that contract, through its existing end date.

Enterprise remains in effect until that annual contract ends, with a minimum of 51 billable agents. Reducing the agent or workspace count—even removing all agents—does not unlock an earlier downgrade. No downgrade credit applies during the contract unless the agreement explicitly provides for one.

Foundry & CrewAI usage examples

Foundry & CrewAI annual commitment and billing

Free Trial is available through trial onboarding. Move to a paid plan when the trial ends or when you select paid scope. Follow the account activation step to complete the applicable terms and billing process.

Usage is accounted for daily and aggregated into the monthly invoice; it does not mean your card is charged every day. Monthly settlement weights pricing snapshots over their effective duration, with each pool’s minimum applied to each segment. For example, Growth with 35 agents for half a month and 13 for half uses 35 billable agents first, then the 15-agent Growth minimum until an eligible downgrade takes effect.

For an eligible Growth-to-Starter transition, the lower plan charge applies from the next monthly billing cycle. Payments continue monthly for the remainder of the annual contract. Enterprise transitions remain subject to the commitment and minimum billing rules above.

N8N paid plans and limits

N8N plan eligibility uses total functional nodes and enrolled workspaces, pooled across the subscription. Total nodes include regular nodes and AI Agent nodes. AI Agent count affects the price, but does not have a separate plan-upgrade threshold.

All prices are in USD, per month, before taxes. No additional workspace fee applies. These limits select the N8N pool’s tier; the account tier also covers the other pricing pool and total workspaces. In a mixed account, all workspaces receive the applied account’s scan cadence. Enterprise scope and service remain subject to the contract; there is no fixed fee for unlimited usage. The Foundry/CrewAI 51-agent minimum does not apply to N8N.

What counts toward N8N usage

Workspace

One enrolled N8N instance. A workflow or worker replica is not a separate workspace.

Total functional nodes

Regular nodes plus AI Agent nodes in assessed workflows within the enrolled scope. Sticky notes are excluded.

Regular nodes and AI Agent nodes

Each functional node is counted once. The supported AI Agent type is @n8n/n8n-nodes-langchain.agent; other functional node types are regular. Sticky notes (n8n-nodes-base.stickyNote) are excluded. AI Agent nodes are never also billed as regular nodes.

Unique inventory

Nodes are identified by workspace, workflow, and node ID. Repeated executions and repeated discovery do not add billable nodes.

Enrolled workflows

Inactive workflows count only when enrolled and assessed. Archived or unselected inventory is not automatically billable.

Counts require a complete, successful inventory, including all API pages. An API failure or incomplete response must not be treated as zero usage, remove enrolled workspaces, or trigger a downgrade. Explicit scope changes and valid observations determine the inventory. If one server cannot be collected completely, preserve its last complete inventory rather than reducing billable usage to zero.

Graduated node pricing

Pool regular nodes across all enrolled N8N workspaces, and pool AI Agent nodes separately. Apply each rate only to the nodes in its band, once across the subscription. Reaching a lower rate does not reprice earlier nodes, and the bands do not restart for each workspace.

Before pricing a Growth or Enterprise pool, apply its total-node minimum: billable regular nodes = actual regular nodes + MAX(plan minimum − actual total functional nodes, 0). AI Agent nodes remain at their actual count. Price these two quantities using their respective graduated bands, then add the amounts. For Starter, apply the greater of the combined node charges and $900 per month.

An active N8N Enterprise pool retains its 501-node minimum even if usage later falls below Enterprise eligibility. Actual usage and node mix still determine the monthly amount. Existing contracts retain their pinned pricing version and agreed terms; the current schedule does not silently replace historical pricing.

N8N plan transitions

N8N monthly pricing examples

For 300 total nodes including 15 AI Agent nodes, the 285 regular nodes cost (80 × $24) + (80 × $22) + (125 × $20) = $6,180. AI Agent nodes cost (10 × $50) + (5 × $45) = $725, for a total of $6,905 per month. The 80-node and 300-node examples are reference configurations; the Starter and Growth ceilings remain 100 and 500 total nodes.

N8N billing and scan allowances

N8N uses 12 monthly installments under a 12-month Contract Period, including Enterprise Order Forms. Monthly settlement weights the applicable pricing snapshots over their effective duration and applies each segment’s pool minimum. An upgrade must not produce a second charge for usage already included in settlement. Payment retries must not duplicate the charge. An eligible Growth-to-Starter downgrade takes effect at the next monthly boundary after rechecking scope; the existing contract end date remains.

For example, an N8N Growth pool with 120 regular nodes for exactly half a month and 20 regular nodes for the other half is billed using $2,800 and $2,382 monthly run rates. The second segment retains Growth’s 101-node minimum, giving ($2,800 + $2,382) ÷ 2 = $2,591 for the month. With two N8N workspaces still enrolled, the pool cannot downgrade to Starter even if it has 100 or fewer nodes.

An N8N Enterprise pool that falls to 20 regular nodes and no AI Agent nodes remains Enterprise during its lock: bill 501 regular nodes for a $10,500 full-month run rate under the current schedule. An Enterprise account caused solely by combined workspaces does not impose this floor on a lower-tier pool. The pricing table shows full-month estimates; actual settlement reflects effective usage, pricing versions and contract terms.

Enterprise onboarding requires the applicable Order Form, payment arrangement and activation approval. An accepted Order Form alone is not an active subscription. Authorized internal admins and company super_admins can approve activation and monthly payments, subject to the payment prerequisites.

Automatic scanning follows the applied account plan for every workspace, including mixed accounts: Starter weekly, Growth daily, Enterprise every 12 hours by default after activation. These paid-pricing rules do not introduce an N8N-specific manual-scan quota or change trial terms. Check your trial offer and the scan launcher for the allowances available to your account.

Monitor tenant health and start investigations

The dashboard is the workspace landing page. Tenant Overview identifies the active company, tenant, technical contact, region, and status. The System Health Overview reports the most recent security scan, active-agent count, security score, and Trust Matrix availability.

Use Threat Summary to triage open critical, high, and medium findings from the latest completed scan for each deployment. Low-severity findings are intentionally not included in this summary; open Inventory for resource-level detail.

Launch a manual scan

Select Launch Scan, choose one or more ready workspaces, and arrange them in the desired queue order. The launcher shows the number of manual scans remaining for the account. Select Queue selected scans to submit the queue.

Manual scanning depends on your plan’s available allowance. See scan schedules and manual allowances before queuing a scan.

Manage your account and organization capacity

The profile page shows the current plan and consumption of workspace and Azure subscription allowances. From here, open company billing, configure organization notifications, add a workspace, or manage users. The identity panel also lets you manage verified email addresses, change your password, and create passkeys.

Grant company access deliberately

Open Manage users from the profile page to add company Admins or Readers, optionally grant finance access, review consumed membership seats, and manage Super Admin ownership. Access is tied to the exact email address entered.

Check connections and scan schedules

Onboarded Deployments groups connected resources by platform, such as Foundry. Each deployment card shows its ID, connection status, target set, latest test, most recent successful test, next scheduled scan, and last update time. Expand Metadata or Configuration for additional context.

Inspect discovered agents, tasks, tools, and risk

Resource Inventory lists the components found during scanning. Use the platform, deployment, infrastructure, resource name, resource type, and identifier columns to locate an item. The risk indicator summarizes direct findings and contextual exposure inherited through related graph nodes.

Select Graph to open the resource in its dependency context, or Report to review the available assessment output.

Open resource-level threats

Select a resource’s risk indicator to view its threat cards. Each card identifies the severity and whether the relationship is direct, then provides a description, category, affected resource, evidence or reason, and assessment timestamp.

Trace dependencies and exposure paths

The graph visualizes agents, tasks, tools, external services, and the relationships between them. Choose a graph from the selector and select Load. Use zoom and fit controls to navigate large systems. The legend explains node colors and edge styles such as performs, uses, collaborates with, delegates to, and calls an external resource.

Select a node to highlight its connected route and populate the Selection panel. Use Copy JSON when structured metadata is needed for investigation notes, Fit to frame the selection, and Pin to keep the node in place while reorganizing the view.

Separate modeled risk from observed behavior

A resource analysis begins with the final threat model: overall risk posture, key drivers, severity totals, quick wins, and individual threat cards. Each card explains why the risk was raised and the evidence used to support it.

Turn evidence into proportionate action

Use the threat model’s Quick Wins for immediate hardening opportunities, then validate each recommendation against the affected resource, evidence, and dependency path. Recommendations may include constraining external calls, pseudonymizing outputs, adding outbound DLP checks, tightening identities, or introducing policy, validation, and approval controls at a tool boundary.

1. Prioritize validated findings and verified exposures, starting with the highest severity and widest affected path.
2. Read the evidence and use Ask HAL to clarify why the condition matters; do not treat explanatory context as proof of an observed exploit.
3. Apply the recommended hardening at the stated level of certainty and record the owner and change reference.
4. Run a new deployment scan or control scan and confirm the finding, graph path, and control result changed as expected.

Assess controls and compliance alignment

The AI Trust Matrix summarizes control effectiveness for a selected project. Review the generated snapshot and counts for effective, partial, ineffective, not assessed, and not applicable controls. Search by control name or ID, or filter by family, effectiveness, and importance. Select Run control scan when fresh evidence should be assessed.

Open a control to understand its definition, importance, assessment method, evidence examined, and alignment with frameworks such as NIST AI RMF, ISO/IEC 42001, and SOC 2. This detail explains how the result was reached and what evidence is missing when a control remains unassessed.

Review offline adversarial assessment

The Red Team workspace presents an offline adversarial assessment. It does not perform live Foundry execution or real tool execution. Project-level totals distinguish assessed scenarios, attack hypotheses, verified exposures, validated findings, evidence gaps, and remediation linkages.

Use Scenario Results to filter hypotheses and findings, Attack Paths to inspect the graph-backed route and affected nodes, and Remediation to review linked hardening. The investigation summary states applicability, evidence confidence, observation, control result, potential impact, and recommended hardening.

Use the guided investigation tour

Select Take Tour for an evidence-focused walkthrough. Its core principle is that architecture support does not mean a condition was observed or exploited. The recommended triage order is: resolve operational errors, review validated findings and verified exposures, then assess hypotheses, insufficient evidence, and not-applicable cases.

Generate an assessment report

Select Generate Report to assemble the executive summary and project-level evidence-based scenario results. Use Print / Save as PDF to preserve or share the report through your organization’s approved process.

Define the assessment scope

Mapping begins with the deployments and workspaces the customer has authorized. Select only the environments that should be assessed, confirm that each is ready, and queue the scan. The selected scope sets the boundary for the resulting inventory, graph, and risk analysis.

Create a consistent asset inventory

The scan identifies supported components and records them as common resource types, such as agents, tasks, tools, and external dependencies. Normalization makes resources from supported Foundry and AKS-based deployments easier to search and compare without exposing the underlying collection implementation.

Map relationships between resources

BrightOnAGENTIC connects inventory records into an agent network graph. Nodes represent resources and edges represent supported relationships—for example, an agent using a tool, delegating to another agent, or calling an external service. This makes dependency paths and shared resources easier to inspect.

Selecting a node narrows the investigation to that asset and its connected path. The detail panel provides structured context that can be copied into investigation notes without revealing BrightOnAGENTIC’s internal mapping logic.

Correlate risks with assets and paths

Findings are associated with the resource where the condition was identified and, when relevant, with connected resources that add exposure context. This distinction prevents a nearby asset from being presented as though it contained the same direct finding.

Direct

The condition or supporting evidence is associated with the selected resource itself.

Contextual

A related resource or path helps explain potential reach or impact but is not the direct finding.

Produce an explainable threat view

The correlated asset and graph context feeds the final threat view. It summarizes risk posture, key drivers, severity, quick wins, and resource-specific threat cards. The goal is to give reviewers enough evidence to understand and prioritize a condition without exposing proprietary detection rules or scoring formulas.

Remediate and refresh the map

Use severity, evidence quality, affected resources, and path context to choose a proportionate response. Quick wins provide high-level hardening direction, while the resource and graph views help teams identify where a control or configuration change should be applied.

1. Confirm the affected resource and whether the risk is direct or contextual.
2. Review the supporting evidence and connected path before assigning priority.
3. Apply the appropriate configuration, access, validation, or data-protection control through the owning platform.
4. Run a new scan after the change. The new scan refreshes the inventory, graph, findings, and summarized posture.