# What is available where

Which capabilities are on for every tenant, which are enabled per tenant, and how to tell from the API or CLI before you build on one.

Most of Tanomis is on for every tenant. A few capabilities are enabled per tenant by a platform
operator, either because they need tenant-side configuration or because they are rolling out
shadow-first. This page is the one place that says which is which, so the guides do not have to.

- **Hosted Tanomis:** the per-tenant capabilities are enabled on request; ask us.
- **Self-hosted:** your platform operator enables them per tenant.
- Where a capability has a probe, check it in code rather than assuming.

## Capabilities

| Capability | Hosted Tanomis | Self-hosted | How to tell |
|---|---|---|---|
| Sessions, runs, streaming, replay | On | On | Always present. |
| Durable approvals and questions | On | Operator enables | A paused run shows `awaiting_input: true`; see [Approval-required actions](/guides/run/approval-required-actions). |
| Session files | On | Operator enables | `file_attachments_enabled` on [Inspect the caller](/api/workspaces/whoami), then `session_files_supported` on the session. |
| Warm starts (golden snapshots) | On | On | The deploy's final golden line. A skipped golden still deploys; sessions cold-start. |
| Automation credentials | On | On | `tanomis m2m ls`; see [Automation credentials](/guides/deploy/automation-credentials). |
| Author-declared network egress | Per tenant | Operator enables | Without it the list is validated and recorded but no external route exists. See [Restrict network egress](/guides/govern/restrict-network-egress). |
| MCP connectors and personal OAuth | Verified in SaaS development; platform enablement required | Operator enables and configures | Agent → Integrations shows connection and account readiness. Not enabled by default in every deployment. See [MCP connectors](/guides/connect-tools/mcp-connectors). |
| Manifest-declared connector access | Enabled for Acme development | Other tenants require explicit enablement | The manifest fixes the connector and allowed tools; the platform records tool schemas automatically. Operators can enable or disable access, but cannot substitute another connector. Explicit disables persist across versions. See [Declare an integration](/guides/connect-tools/integration-contracts). |
| Custom connectors | Per tenant | Operator enables | Needs the `manage` capability in your workspace. See [Create a custom connector](/guides/connect-tools/create-a-custom-connector). |
| Delegation between agents | Per deployment | Operator enables | The delegation tools are present in the bind of an agent whose manifest names a target under `delegation.calls`. See [Delegate work to another agent](/guides/run/delegate-to-another-agent). |
| Durable work and settlement | Per tenant | Operator enables | A `settlement`-mode version fails session activation where the boundary is unavailable. See [Durable work and settlement](/guides/run/durable-work-and-settlement). |
| Evaluation and the rollout gate | Per tenant, shadow-first | Operator enables | The gate records a verdict before it is allowed to block. See [Evaluation](/guides/evaluate/overview). |
| Metering and budgets | Per tenant | Operator attaches the decision point | A session shows usage as not measured where it is off. See [Usage and spend](/guides/govern/usage-and-spend). |
| Service-mode agent identity | Per tenant | Operator enables | No public probe; the session runs without an identity assertion where it is off. See [Identity and access](/concepts/identity-and-access). |
| Scoped and delegated agent authority | Held | Held | Declarations validate and record; no public runtime workflow uses them yet. |

"Per tenant" means the capability exists in the platform and a platform operator turns it on for a
tenant. "Held" means the contract is defined and the runtime path is not yet offered.

## Coming soon

Pages marked **Soon** in the sidebar describe capabilities that are being built. They carry an
under-construction notice and change without a changelog entry until they ship.

## Where to go next

- [Changelog](/changelog): when a capability moves from per tenant to on.
- [Get access](/getting-started/get-access): how to ask for a per-tenant capability on hosted
  Tanomis.