How it activates
Implicitly. The first time your org touches a tier-gated feature (e.g. installing a Vault credential broker integration, configuring anallow_with_redact response handler), the TrialGate middleware activates the trial as a side effect. A toast banner confirms the trial start; the dashboard widget in the upper-right shows days remaining on your shortest trial.
Two-layer check
For every gated request, TrialGate runs:- Base tier — does the org’s current tier permit the feature? If yes, returns
paid. - Trial overlay — is there an active, unexpired trial row for the (org, feature) pair? If yes, returns
trial_active. If a row exists but is expired, returnslocked_after_expired. If no row exists, inserts one and returnstrial_just_started.
One-shot rule
Enforced at the storage layer with a UNIQUE constraint on(organization_id, feature_id). You cannot re-trial a feature; once expired, the only way back is upgrading.
What happens at expiry
The nightly tier-reconciliation cron transitionsactive rows past their expires_at to either expired_no_upgrade (org still on lower tier) or expired_to_purchase (org upgraded during the trial). Enforcement reverts to the Violet equivalent — usually deny or deny_with_reroute.
Settings page
See/settings/trials for every (org, feature) trial in three sections: active, expired without upgrade, converted to purchase.