Enterprise

SSO/OIDC Integration

AgentFlow supports any OpenID Connect provider (Okta, Azure AD, Google Workspace).

Configuration

Create an OIDCConfig with your provider details: - issuer: Your OIDC provider URL - client_id: Your application client ID - role_claim: JWT claim containing roles (commonly roles, groups, or custom) - role_mapping: Maps claim values to AgentFlow RBAC roles (Admin, Operator, Viewer)

Role Mapping

OIDC claims are mapped to AgentFlow RBAC roles. Unknown roles default to Viewer.

SLA Monitoring

Setup

The SLA monitor runs automatically as a background task, checking the API health endpoint every 60 seconds. Configure webhook URLs for Slack or PagerDuty alerts via the SLA_WEBHOOK_URL environment variable.

Live Endpoint

GET /health/sla returns the current SLA report:

{
  "total_checks": 1440,
  "successful_checks": 1440,
  "uptime_percent": 100.0,
  "avg_response_ms": 28.5,
  "max_response_ms": 142.3,
  "sla_met": true
}

Reports

Reports include: total_checks, successful_checks, uptime_percent, avg_response_ms, max_response_ms, sla_met. The default evaluation window is 24 hours.

Self-Hosted Deployment

Enterprise customers can deploy AgentFlow on their own infrastructure. Requirements: - Python 3.11+ - PostgreSQL 13+ - Systemd (Linux) or equivalent process manager - TLS certificate (Let's Encrypt recommended)