Feature Availability

Reference

Workload Trust is available only in private, self-managed AIControls installations, on premises or in a cloud cluster that you run. It requires dedicated clusters with Kyverno, Kyverno Runtime, and other control points that a shared, Nirmata-hosted (SaaS) workspace can't provide. Runtime Controls and Kubernetes posture are also self-managed only, because they depend on the same in-cluster control points. Every other feature listed here works in both deployment models.

Availability by deployment

Feature	Nirmata-hosted (SaaS)	Self-managed	Why
LLM gateway	Available	Available
MCP governance	Available	Available
Access Bindings and Toolsets	Available	Available
Team access	Available	Available
Workload Trust: discovery, registrations, Blueprints, Runtime Bindings, protection and Enforce, kill switch	Not available	Available	Needs a cluster that you run, with Kyverno, Kyverno Runtime, and cluster OIDC and RBAC access.
Runtime Controls	Not available	Available	Needs the Kyverno Runtime sensor on your cluster.
Kubernetes posture	Not available	Available	Needs read access to your cluster.

For the concepts behind Workload Trust, see Workload protection.

How AIControls decides

Each AIControls instance runs in one deployment mode:

Mode	Where it applies
selfManaged	Installations that you run. This is the default.
hosted	Nirmata-hosted (SaaS) workspaces.

You set the mode with the Helm value deployment.mode, which defaults to selfManaged, or with the environment variable AICONTROLS_DEPLOYMENT_MODE. If you don't set a mode, AIControls treats an instance as hosted only when it has Nirmata-hosted tenant handoff settings (auth.handoff.keyPath or auth.handoff.subdomain). Set selfManaged for installations that you run. If you change deployment.mode, the change takes effect after a restart. Your data stays in place.

What you see in a hosted workspace

When Workload Trust is unavailable, AIControls does the following:

• Hides Workloads from the navigation. If you open a Workloads address directly, the page explains that Workload Trust is available in self-managed installations.
• Returns a 404 response with the code feature_unavailable from the Workload Trust API routes.
• Omits the discovery and posture rows from the Health page.
• Doesn't start workload discovery or the Runtime Controls collector.

To use Workload Trust, install AIControls with Helm in your own cluster.