Licensing
Licensing
Section titled “Licensing”Phrame licenses by credits flowing down a hierarchy — from a master authority, through regional and site servers, to the client that actually uses capacity. It works online, partially connected, or fully air-gapped, and it never over-grants: no credits, no licence.
Why it matters
Section titled “Why it matters”Broadcast customers range from a single cloud tenant to a multi-region enterprise with air-gapped sites. A licensing model has to stretch across all of that without either leaking revenue or blocking legitimate use.
- Fits any deployment. The same model scales from
MLS → Site → Client(small SaaS) toMLS → Regional → Site → Edge → Client(large enterprise), and to fully air-gapped sites via signed file bundles. - Non-permissive by design. Capacity can’t be activated without credits in place — no accidental over-use, no grace credit to reconcile later.
- Pay for what you use. Usage is metered and aggregated up the chain, from monthly granularity down to per-minute for large customers, with consumption prediction to flag replenishment before exhaustion.
- Secure end-to-end. Every node holds a unique certificate; mutual TLS is enforced on every online connection.
In one line: revenue-safe licensing that reaches from the cloud to the air-gapped edge, without getting in the customer’s way.
How it works
Section titled “How it works”Licence credits are the currency. They originate at the top and are delegated downward as signed sub-pools; usage flows back up as reports.
| Tier | Role |
|---|---|
| Master Licence Server (MLS) | Global credit authority (Phrame-owned); issues signed allocations to Tier 1; drives billing and exhaustion prediction; anchors the PKI. |
| Regional Licence Server (RLS) | Holds a delegated sub-pool per region; sub-allocates to sites; aggregates usage; caches MLS state to ride out brief outages. |
| Site / Tenant Server (SLS) | Issues individual leases to clients; enforces the non-permissive policy; supports air-gap operation via file bundles. |
| Edge / Proxy Server (ELS) | Optional micro-pool tier for very large sites or cluster isolation. |
| Licence Client (SDK) | Acquires and holds a lease from its nearest server; reports consumption back up. |
Minimum deployments: small SaaS = MLS → SLS → Client; enterprise
on-prem = MLS → RLS → SLS → Client; air-gap site = MLS → (signed file bundle) → SLS → Client.
Transport is REST or MQTT, both over mutual TLS. Air-gap sites, with no network path to a parent, receive cryptographically signed file bundles and operate fully offline.
Under the hood
Section titled “Under the hood”- Topology: a rooted tree of licence nodes; depth is deployment-specific (at least four tiers supported before clients).
- Credit model: the MLS is the sole source of truth for global inventory; each tier holds a delegated sub-pool and issues smaller pools (or leases) downward. Parents cache last-known state to continue operating within a configurable grace window during brief parent unavailability.
- High availability: MLS is geo-redundant (active/standby with automated failover, or active/active with strong consistency / CRDT sync); RLS and SLS can run as HA pairs per region/site.
- Security (PKI-first): a root CA (managed by MLS or a dedicated PKI service such as OpenBao) issues a unique certificate to every node; mutual TLS is enforced throughout; air-gap bundles are cryptographically signed.
- Granularity: monthly by default, down to per-hour or per-minute for large customers, with consumption-rate tracking for proactive replenishment alerts.
The design is captured in detail in the module’s architecture docs and a set of ADRs (communication protocol, granularity, security infrastructure, implementation language).
Part of the Phrame documentation system — one Markdown source, four audiences, a code-generated house-style diagram.