---
title: "Plans and entitlements"
slug: features/plans-and-entitlements
url: https://projectri.com/docs/features/plans-and-entitlements
section: features
audience: everyone
mobile: false
updated: 2026-09-08
source: Projectri documentation
---

# Plans and entitlements

What each plan includes, what happens when you hit a limit, and why losing a feature never loses the data behind it.

![Plans and entitlements](https://projectri.com/docs-shots/admin-billing.png)

## What it is

An **entitlement** is what your workspace has bought. Where a permission asks
*are you allowed*, an entitlement asks *does this workspace have the feature at
all*. They are two systems on purpose, and the refusal you get tells you which
one stopped you: **403** means ask an admin, **402** means the organisation has
not bought it.

There are three tiers — **Free**, **Team** and **Business** — and two shapes of
entitlement: an on/off feature, and a meter with a number on it.

## How to get there

Your plan, what it includes and how much of each meter you have used are on
**Admin → Billing**. Reading it needs `billing.view`. Anywhere a feature is not
included, the screen draws an upgrade card naming the feature, the tier that
includes it and the price, rather than hiding it — a capability you cannot see
is one you cannot want.

## How to use it

### See what your plan includes

1. **Admin → Billing**.
2. The feature list and the meters are both rendered from the same catalogue the
   API enforces, so the page cannot claim something the product will refuse.

### Read a 402

1. A refusal carries the tier name and the feature. On the public API it is an
   RFC 7807 problem document with `code: plan_required`.
2. Nothing you can do with a token or a permission fixes a 402. It needs a plan
   change, and the person to talk to is inside your own organisation.

### Read a quota refusal

1. Running out of a meter is different from not having the feature. On the
   public API a spent quota answers **429** with `code: quota_exceeded`, because
   every HTTP client already knows to back off on a 429.
2. Flow meters — AI tokens, agent runs, API calls — accumulate per calendar
   month in UTC and reset at the start of the next one.
3. Stock meters — seats, projects, storage — are counted from what you have
   right now, not accumulated. They are enforced where the stock *increases*:
   accepting an invite, creating a project, and every upload route.

## What it affects

### What is gated

Roughly: the commercial chain, resourcing, the reporting toolchain, the platform
surfaces and the enterprise identity features.

| Included from | Features |
|---|---|
| **Free** | Projects, tasks and boards; time tracking and timesheets; documents and discussions; the iOS and Android apps; two-factor authentication; the audit log |
| **Team** | Estimates, quotes, retainers, billing runs, tax codes; resource bookings, the skills library, availability search; the report builder and scheduled delivery; the public API; e-signature; the meeting notetaker; Nia agent runs |
| **Business** | Demand forecasting and scenario planning; warehouse sync; the sandbox tenant; outbound MCP connections; OIDC single sign-on; SCIM provisioning; audit-log streaming |

### The meters

| Meter | Free | Team | Business |
|---|---|---|---|
| Seats | 5 | unlimited | unlimited |
| Active projects | 3 | unlimited | unlimited |
| File storage | 5 GB | 100 GB | unlimited |
| AI tokens per month | 100,000 | 2,000,000 | unlimited |
| Agent runs per month | none | 500 | unlimited |
| Recorded meetings per month | none | 200 | unlimited |
| API calls per month | none | 100,000 | 1,000,000 |

### What is never gated

- **Core delivery work** — tasks, boards, time entry, documents, discussions,
  search, mobile. A time entry must never hit a paywall.
- **Security** — two-factor, the audit log, session management. Single sign-on
  is the industry's one exception and sits on the top tier.
- **Your client's own surface** — the portal, public share links and the quote a
  client has already been sent. A lapsed subscription must not land on the
  client at the worst moment in a deal.
- **Signature verification.** A signature that stops being verifiable when a
  subscription lapses is not a signature.

## On mobile

The app reads the same entitlements and draws the same upgrade cards. Changing
the plan is done on the web: the button raises a conversation with us rather
than a checkout, and selling a subscription inside the app would have to go
through in-app purchase.

## Limits and gotchas

> [!NOTE]
> **A downgrade is not a deletion.** Gates are on the writing verbs only. A
> workspace that built two years of estimates on Team and lapses to Free can
> still open them, export them and show them to an accountant — it just cannot
> write another one. Gating the read would make a billing lapse look exactly
> like data loss.

- **A few reads are gated, and they are the ones that compute rather than
  return your rows** — an availability search, a demand forecast, running a
  report. Read-only access to those preserves nothing; it hands over the
  feature. Notably, running a saved report is gated while the saved definitions
  are not.
- **Free means zero for some meters, and that is a gate, not a limit.** Agent
  runs, recorded meetings and API calls are all a hard zero on Free, so the
  refusal arrives as a 402 before the counter is ever touched.
- **AI token counts are an estimate**, derived from characters in and out. They
  are labelled as an estimate everywhere they appear.
- **Storage counts everything uploaded**, not only task attachments — documents,
  discussion files and ticket attachments all sum into the same number.
- **A public API quota is checked, not reserved.** Two requests arriving at the
  boundary at once can both pass. The overshoot is bounded by concurrency and
  the counter stays accurate.
- **Scheduled jobs do not check entitlements.** Report delivery, warehouse sync
  and demand snapshots run per workspace with no session, so a lapsed
  subscription keeps receiving scheduled reports until somebody notices.
- **A tenant override can turn a feature on outside the tier.** It is granted by
  us, carries a required reason, is audited, and usually has an expiry.

## Related

- [How permissions work](/docs/features/permissions-model) — the other reason a screen refuses you.
- [Billing](/docs/admin/billing) — the plan, the meters and the invoices.
- [The API, MCP and apps](/docs/features/mcp-and-api) — where `platform.public_api` and the call quota bite.
- [Nia, the assistant](/docs/features/nia-assistant) — one turn is one agent run.

## Related

- [How permissions work](https://projectri.com/docs/features/permissions-model.md): The three tiers Projectri decides "may this person do this" with, how a role default becomes one person's answer, and the two traps that catch every new key.
- [Billing](https://projectri.com/docs/admin/billing.md): Your workspace's own subscription to Projectri — the plan, the seats and limits you are using, the invoices we send you, and the details we print on them.
- [The API, MCP and connected apps](https://projectri.com/docs/features/mcp-and-api.md): Three ways software reaches a Projectri workspace — the REST API, the MCP server for coding agents, and third-party apps a member authorises.
- [Nia, the assistant](https://projectri.com/docs/features/nia-assistant.md): What Nia can read, what she can do, how she works by voice, with files, in a document or on a board, and the things she deliberately cannot see.