POC Mode

Trial-window posture, local credential-custody defaults, and expiry behavior.

What is POC mode?

Proof-of-concept (POC) mode is a tenant status (PocConfig) that places a tenant in a trial window with a different security posture:

• New systems default to execution_mode=agent (local credential custody for trials)
• Write endpoints are blocked (HTTP 423) after expiry
• Once the trial has expired, writes to the customer's connected systems stop as well (see below)
• Read endpoints, plus /poc-mode/* and /auth/*, stay open so the customer can still see their data

Lifecycle

• enable — sales triggers this through the POC command-line tool or the platform-admin interface. A PocConfig is created with active=true, an expires_at, and the window configuration.

• sweep — a periodic check compares expires_at with the current time; on expiry the middleware switches into block mode.

• disable — an admin or salesperson converts the trial into a paying customer (or records explicit churn). The PocConfig becomes inactive and all blocks are lifted.

PocExpiryMiddleware — what is blocked

For an expired POC, every non-read endpoint returns HTTP 423 (Locked) with a hint toward the "upgrade" flow. The customer can still log in, view dashboards, and download their export — only modifications are blocked.

Expiry also freezes writes to connected systems

An expired POC does not only refuse API writes. The tenant is frozen for writes to its connected systems: a sync, a grant or a revoke that is already queued or started in the background is refused as well, reconciliation shows the work as pending rather than performing it, and the refused write is recorded as a policy-blocked job. A freeze never revokes anything in the customer's systems; the one exception is an emergency removal for a person under an open lockout or kill switch, which still goes through. The same freeze applies to a suspended or offboarding tenant, a tenant being restored and the provisioning pause. See safety limits for the pause.

ℹ Good to know

There is a 60-second in-process cache on the PocConfig lookup. It is invalidated by the enable / disable / sweep service calls — a manual database change outside those calls requires a backend restart.

Sales-side tooling

The sales command-line tool (scripts/rv-poc) wraps tenant provisioning and POC enablement into a single command. Use cases: creating a POC ticket, loading demo fixtures, extending the expiry window, and checking status. The cross-tenant POC list and status views are vendor-side surfaces: they require the platform-admin credential (or a vendor support credential with the tenants read permission), never a customer administrator's session.

Further reading:

• Tier-3 Hybrid
• Onboarding Walkthrough