Licence changes
Changing the licence never widens anyone's access.
- With the feature
- Enterprise · free trial
- Without
- Foundation
- Takes effect
- Without a restart
The licence decides who may create the objects of Advanced Access Control. It never decides whether an object that exists is enforced: every share and every deny counts on every licence. That is what keeps a licence change from widening access. A deny written on Enterprise still blocks after a move to Foundation, and anything that narrows access (removing a share, a steward, a member, a deny) works without the licence.
A licence change takes effect without restarting MaestroHub: the role catalog is rebuilt and open sessions refresh their permissions.
When the licence loses Advanced Access Control
| Object | What happens | Can you still… |
|---|---|---|
| Feature roles (Connect, Automate, Data, Apps), Compliance Auditor, Fleet roles | The assignments are kept but grant nothing. Users & Roles and My Access mark them inactive, and Explain my access names the licence. | Remove them. Not assign them. |
| Custom roles | Keep granting what they grant to the people who hold them. | Delete them, remove them from people. Not edit or assign them. |
| Groups | Keep giving their members the group's roles. The Groups tab shows them read-only with a notice. | Remove members, delete the group. Not create, edit, add members or give a group a role. |
| Shares | Keep granting access. | Revoke them. Not create new ones. |
| Deny rules | Keep blocking, including denies on pipelines. | Lift them. Not write new ones. |
| Stewards | Keep their authority over their branch. | Remove them. Not appoint new ones. |
| Time-bound grants | End on schedule. | Not renew them, or give new ones with an expiry. |
| Access requests | Pending requests stay. | Deny them, cancel your own. Not file or approve. |
| Who has access | The Via roles section needs the licence; the rest stays. | |
| Pipelines | Triggered runs act as the shared pipeline runtime instead of the pipeline. The save check still runs. | |
| Break-glass | Unchanged: it is on every edition. |
The menus show what is left: Share…, Assign steward… and Access denials… open their dialogs captioned as remove only, and Request access is shown disabled with the reason. A role that grants nothing on this licence is listed last in role pickers with the reason.
Look at who holds a feature role or Compliance Auditor (Users & Roles → Roles). Those people lose that access when the licence changes; give them a built-in role that Foundation includes, such as Data Engineer or Plant Operator, first.
When the licence gains Advanced Access Control
Everything above becomes editable again, and the inactive role assignments grant again at once: nobody has to be re-assigned. Triggered pipeline runs act as the pipeline itself again; the pipeline's rights were kept up to date all along, so nothing has to be set up.
Which licences include it
| Licence | Advanced Access Control |
|---|---|
| Foundation | No |
| Enterprise | Yes |
| Free trial | Yes |
See Licensing & Activation for the editions and the trial.