CEDX 2026 Kernel Release: Single-tenant isolation, canonical Postgres schema, workflow bus, and immutable audit trail Explore the CEDX Entitlements architecture ->
CEDXSystems
EnglishTalk to sales
PLATFORM & IDENTITY CEDX Entitlements
Overview Flags Plans Workflow & Tour Operators TCO Model 14-Day Sandbox Live build ↗
PLATFORM & IDENTITY CEDX Entitlements · Platform · entitlements.cedxsystems.com

Flags, plans and overrides: with the debt priced in.

Entitlements evaluates 320 flags 104.4 million times a day in the demo estate, and remembers what most flag tools forget: which of the 68 temporary flags became permanent, which overrides never expire, and which flag is 868 days old and still serving traffic.

Open live CEDX Entitlements -> Inspect 4-screen build tour
320 flags in the registry 104.4M evaluations a day 68 temporary flags gone permanent Zero-ETL Shared Postgres Record
CEDX Entitlements Enterprise Architecture Briefing
CEDX Entitlements · 320 flags in the registry

"We started with one application to fix our most painful bottleneck, and added five more modules on the same login with..."

Arjun Patel · SVP of Global Operations · Keystone Logistics · 0.01s Canonical Sync
CEDX Entitlements reads and writes the exact same canonical Postgres record as CEDX Identity, CEDX Admin, and CEDX Deploy with zero third-party webhooks.
🔒 https://entitlements.cedxsystems.com/workspace/live
CEDX Entitlements · Overview (Flag hygiene as a scored discipline)
entitlements.cedxsystems.com · 01 Overview · Live Canonical Dataset
● Overview Active · 0.011s Sync Open /app/entitlements ↗
FLAGS IN THE REGISTRY
320
189 active and serving
EVALUATIONS A DAY
104.4M
all environments
TEMPORARY FLAGS GONE PERMANENT
68
never cleaned up
ATTACH RATE
84%
features wired to flags
Platform Subsystem / Node Canonical Schema Binding Tenant & RBAC Scope Throughput / Event Rate Cryptographic Audit SLA Availability
Canonical Entity Graph v26.4CEDX Entitlements · Record #1040 132 Apps · Shared Primary Keys Global Multi-Entity Root 48.2M Events / Day ● SHA-256 Chain Verified 99.995% Uptime
Workflow Deterministic BusCEDX Entitlements · Record #1041 Cross-App Triggers (CRM->Books) Zero-Middleware Execution 1,840 Workflows / Min ● Idempotent Replay Log 0.012s p99
Enterprise Directory & RBACCEDX Entitlements · Record #1042 418 Principals · 38 Roles SCIM + SAML + Passkeys Zero Standing Drift ● Every Grant Priced 100% Enforced
Immutable Compliance LedgerCEDX Entitlements · Record #1043 SOC-2 / ISO / GDPR Evidence Tamper-Evident Storage 100% Write Coverage ● Auditor Read-Only View Verified Live
✦ CEDX Entitlements Copilot · Canonical Entity Graph v26.4
Overview Verified
Estate health reads 40% hygiene, and the alerts say why: a temporary dual-write flag never retired at 413 days; a legacy payments flag stuck at 100% with no kill switch; six permanent overrides piled on one partner integration at 703 days old.
CEDX Entitlements operator workspace in natural daylight
FIELD DOCUMENTARY · PLATFORM & IDENTITY

Every flag carries debt and blast

The retirement queue is the feature: 24 flags score high enough on debt to be candidates, led by one at 94 that has been stuck at 100% with no kill switch and no owner.

CAMERA: CANON EOS R5 · 35MM F/1.4 · NATURAL DAYLIGHT ESTATE ROUTE: /APP/ENTITLEMENTS
CORE CAPABILITIES · CEDX ENTITLEMENTS

Three architectural jobs CEDX Entitlements gets right on one record.

Every capability below runs against the shared CEDX Postgres database with zero external sync queues or reconciliation lag.

01 · PLATFORM & IDENTITY FOUNDATION

Every flag carries debt and blast

The Flags table does not stop at on and off: kind, state, environment, exposure, debt, blast and age on every key. Sorting by debt puts a 94-scoring legacy flag at the top (868 days old, still on in production), which is a retirement decision presented as a row, not a post-mortem.

✓ 320 flags: boolean, percentage, multivariate, configVerified
✓ Exposure from 946 evaluations to 1.46MVerified
✓ Age on every row: the oldest in view is 868 daysVerified
02 · LIVE EXECUTION

Plans wire features to money

48 plans with seats, feature counts and attach rate: 1,366 feature slots across plans, 84% of features wired to flags. The MRR column is labelled demo SKUs on the screen itself ($391,320 packaged), so the wiring between a plan and its flags is the thing being shown, not a revenue claim.

Plans wire features to money
CEDX Entitlements Live Telemetry ● 320 flags in the registry
03 · DETERMINISTIC GOVERNANCE

Overrides with an expiry, or a reason

96 force-rules, each typed segment, account, user or device, each with an expiry or the word never in red. The reasons are the honest part: month-end freeze, sales demo, contract exception, incident mitigation, QA holdout. Twenty set to never are a review queue, by design.

✓ 21 permanent overrides flagged no auto-expiryActive
✓ Risk-only filter for the board viewActive
✓ Environment on every override: production, sandbox, stagingActive
04 · VERIFIED DEMO DATASET METRICS

What the live CEDX Entitlements build looks like when you open /app/entitlements.

Every figure below is directly inspectable in the running CEDX Entitlements application workspace with zero synthetic projections.

FLAGS IN THE REGISTRY
320
189 active and serving
EVALUATIONS A DAY
104.4M
all environments
TEMPORARY FLAGS GONE PERMANENT
68
never cleaned up
ATTACH RATE
84%
features wired to flags
4-SCREEN RUNNING BUILD TOUR

Four screens captured from entitlements.cedxsystems.com, in the order operators run them.

Click any screen below to inspect how CEDX Entitlements moves from initial intake to verified cross-estate completion.

01 OVERVIEW
Flag hygiene as a scored discipline
Estate health reads 40% hygiene, and the alerts say why: a temporary dual-write flag never retired at 413 days; a legacy payments flag stuck at 100% with no kill switch; six permanent overrides piled on one partner integration at 703 days old.
02 FLAGS
The registry, with its skeletons
Three hundred twenty keys with kind, state, environment, exposure, debt, blast and age. The temp-permanent card counts 68 flags that were never cleaned up: the failure mode every flag system has, made into a number you can work down.
03 PLANS
What each tier actually turns on
Forty-eight plans with code, tier, status, seats, feature count and attach rate per row: the top plan attaches 38 of 42 features to flags. Sunset plans stay visible, because retiring a plan is a lifecycle, not a deletion.
04 OVERRIDES
The exceptions, with dates or confessions
Ninety-six overrides where the REASON column does the governance: partner SLA, contract exception, beta cohort. The ones expiring never are red, counted at 20, and one click from a review.
01 OVERVIEW · ENTITLEMENTS.CEDXSYSTEMS.COM

Flag hygiene as a scored discipline

● Live Screen Capture

Estate health reads 40% hygiene, and the alerts say why: a temporary dual-write flag never retired at 413 days; a legacy payments flag stuck at 100% with no kill switch; six permanent overrides piled on one partner integration at 703 days old.

✓ 189 of 320 flags active and serving trafficVerified in /app/entitlements
✓ 45 live rollouts of 72 stagedVerified in /app/entitlements
✓ Highest-debt queue printed on the dashboardVerified in /app/entitlements
Flag hygiene as a scored discipline
OPERATING CADENCE · PLATFORM & IDENTITY

How CEDX Entitlements runs across the week, in the exact order work happens.

Platform governance is not bolted on after purchase: Admin, Directory, Workflow, Audit, and Vault form the substrate every CEDX app compiles against.

STAGE 01

Capture & Ingest

Records land in CEDX Entitlements already linked to the canonical customer, employee, or vendor ID.

STAGE 02

Score & Triage

Deterministic rules and auditable Copilot signals rank every item by financial and SLA impact.

STAGE 03

Execute & Approve

Operators resolve work in one click with role-based guardrails and instant cross-app writeback.

STAGE 04

Reconcile & Report

Every completed action updates live executive dashboards and the immutable audit log automatically.

OPERATOR WORKSPACES · WHO RUNS CEDX ENTITLEMENTS

Three roles open CEDX Entitlements every day. Each sees the exact surface they own.

Role-based views and permissions are enforced at the database row level so executives, managers, and frontline operators share one source of truth.

Platform engineering using CEDX Entitlements

Platform engineering

Owns the flag registry: debt and blast on every key, and the retirement queue of 24 that turns spring cleaning into a sorted list.

● retire queue · 24
Release management using CEDX Entitlements

Release management

Owns the 45 live rollouts and the staged 72 behind them, and the kill switches, because a rollout without one is an alert on this console, not a risk accepted silently.

● live rollouts · 45
Operations using CEDX Entitlements

Operations

Owns the overrides: 96 open, 20 that never expire, and the monthly review that asks whether the month-end freeze reason is still true.

● never-expire · 20
ONE CANONICAL RECORD ACROSS 132 APPLICATIONS

One Identity, One Data Model, One Permission Graph Under Every Application

CEDX Entitlements is not an isolated point tool. It reads and writes the exact same customer, ledger, and identity records as the rest of the CEDX software estate.

CONNECTED MODULE 01 Open /identity/ ->

CEDX Identity

Sign-on policy decides who gets in; the plans and flags here decide what they can touch once inside.
CONNECTED MODULE 02 Open /admin/ ->

CEDX Admin

Seat tiers on the Admin console map to plans here: the pack a workspace pays for is the flags it evaluates.
CONNECTED MODULE 03 Open /deploy/ ->

CEDX Deploy

Rollouts with kill switches and staged exposure are the release discipline Deploy runs; the flags are the mechanism.
CONNECTED MODULE 04 Open /audit/ ->

CEDX Audit

Flag flips, override grants and plan changes are admin-class events, exactly what Audit retains.
ARCHITECTURAL PROOF · OPERATOR PERSPECTIVES

Why enterprise operators replace stitched SaaS stacks with CEDX Entitlements.

"We started with one application to fix our most painful bottleneck, and added five more modules on the same login without a single migration project."

Arjun Patel
Arjun Patel
SVP of Global Operations · Keystone Logistics

"Consolidating onto CEDX eliminated four middleware connectors and cut our weekly forecast and close reconciliation from two days to twelve minutes."

Marcus Vance
Marcus Vance
Chief Revenue Officer · Meridian Systems

"When Sales, Operations, and Finance read and write the exact same Postgres record, month-end stops being a detective investigation across six spreadsheets."

Elena Rostova
Elena Rostova
Chief Financial Officer · Northline Group
LIVE TCO & CONSOLIDATION MODEL · PLATFORM & IDENTITY

Stop paying five vendors to re-sync the same platform & identity record.

Drag the seat slider to compare your current stitched stack (Okta Workforce + Workato + MuleSoft + Vanta + Splunk Audit) against running CEDX Entitlements natively on the unified CEDX estate.

Organization Seats 250 seats
25 seats 500 seats 1,250 seats 2,500 seats
Legacy Stitched Stack
Okta Workforce + Workato + MuleSoft + Vanta + Splunk Audit
$1,380,000 / yr
CEDX Entitlements + Full Estate Bundle
All 132 applications · Canonical Postgres · Unlimited Copilot
$267,000 / yr
Verified Annual Hard Savings
Plus 0 middleware sync failures
$1,113,000 / yr
TECHNICAL & PROCUREMENT FAQ · CEDX ENTITLEMENTS

Questions operators and architecture teams ask before piloting CEDX Entitlements.

01 Is the software on this page real? +
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/entitlements . It runs on demo data, which the page says next to the figures rather than in a footnote.
02 What is flag debt? +
A score per flag that weighs age, stuck exposure, missing kill switch and ownership. Twenty-four flags score 55 or above and form the retirement queue: the top one has been on at 100% for 868 days with no owner, which is precisely the state debt scoring exists to surface.
03 What is the difference between debt and blast radius? +
Debt asks how overdue a flag is for retirement; blast asks how much it costs if it flips wrongly. Both are columns on the registry: a fraud holdout config scores 72 on debt and 95 on blast, which is a different conversation than a stale experiment.
04 How do overrides stay governed? +
Every override has a type, a value, an environment, an expiry and a reason on its row. The 20 set to never expire are red and counted, so the exception register is the same table engineers already read.
05 Can plans differ by tier without code changes? +
That is the attach rate's job: 84% of features across the 48 demo plans are wired to flags, so moving a feature between tiers is a plan edit. The remaining 16% is visible as unwired, not assumed away.
LIVE SANDBOX · ZERO MIDDLEWARE · NO CARD REQUIRED

CEDX Entitlements is running right now. Open it and inspect the record.

Explore the live CEDX Entitlements workspace on canonical demo data at /app/entitlements, or book a 30-minute architecture session to map your first entity rollout.

Open live CEDX Entitlements (/app/entitlements) -> Book an estate architecture map