# Enterprise activation (/docs/operations/enterprise-activation)



Set `security_profile: enterprise` to enable Ductor's fail-closed production
security posture. The process validates every required control at startup and
refuses to serve traffic when a required dependency or setting is missing.

## The enterprise hardening posture [#the-enterprise-hardening-posture]

`security_profile: enterprise` applies a fail-closed posture after static config
loads, and the process **will not start** unless the required knobs are set
explicitly:

| Requirement                                     | Setting                                                                                             |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| Fail-closed authorization                       | `authz.allow_when_unconfigured=false`                                                               |
| Enforced egress                                 | `egress.mode=enforce`                                                                               |
| Durable marketplace with signature verification | `marketplace.enabled=true` + `artifact_verification` trusted keys                                   |
| Real connector master-key source                | `connector.encryption_key` **or** `key_provider.enabled=true` with `wrapped_master` (KMS/Vault)     |
| Exec fails closed                               | `server.exec_isolation_required=true` (in-process exec fails until a real isolated runner is wired) |
| Workflow-runtime safety limits                  | nonzero tick timeout, CAN thresholds, transition and run-state caps                                 |
| Loopback-bound metrics                          | metrics listener bound to loopback (also part of the Helm `production` gate)                        |
| Cross-replica aggregator                        | `aggregator.backend=redis`                                                                          |

<Callout type="warn" title="Switch the aggregator to redis before production">
  `aggregator.backend=memory` (the default) is in-process only: it **loses every
  deferred slot on restart and does not coordinate across replicas**. Enterprise
  requires `redis`, and you should switch to it *before* flipping the
  aggregator on in any multi-replica production deployment — not after.
</Callout>

See [Security & auth](/docs/operations/security) for the individual controls and
[Key management](/docs/operations/key-management) for the master-key source.

## Verify the profile before rollout [#verify-the-profile-before-rollout]

Enable the profile in a non-production environment first and confirm that the
service starts with the same secret, Redis, marketplace-signing, metrics, and
execution-isolation configuration you will use in production. A startup failure
identifies the missing or unsafe setting; correct the configuration instead of
disabling the profile.

After startup, check readiness and exercise an authenticated, tenant-scoped
request before admitting traffic. See [Health checks](/docs/operations/health-checks)
for probe behavior and [Production deployment](/docs/deployment/production) for
rollout guidance.

## Related [#related]

<Cards>
  <Card title="Production deployment" href="/docs/deployment/production">
    Wiring the enterprise posture into a production rollout.
  </Card>

  <Card title="Key custody" href="/docs/auth/key-custody">
    Configure tenant-scoped BYOK custody and key rotation.
  </Card>
</Cards>