# Feature Availability by Plan > Which Layer5 Cloud capabilities each Layer5 plan includes, the limits each plan records, and the role and deployment conditions that also decide whether a capability is available to you. This page tells you which Layer5 Cloud capabilities each Layer5 plan includes. Your plan is one condition for using a capability, not the only one: your role and where your Layer5 Cloud deployment runs also decide what you can do. Those conditions follow the matrix and the limits table. ## Plans The matrix has one column for each of the four Layer5 plans: Free, Team Designer, Team Operator, and Enterprise. Each plan is offered with monthly and annual billing. The Free plan is the plan that Layer5 Cloud calls Personal in its plan records, so you see that name in subscription and entitlement data. Entitlements follow your organization's plan. Current pricing and plan details are listed at [layer5.io/pricing](https://layer5.io/pricing). ## Reading the matrix - A check mark means the plan includes the capability. - A dash means the plan does not include it. - Each table covers one category of capability. The **What it does** column describes the capability in one sentence. The matrix is refreshed automatically from the Layer5 product feature list. It lists the capabilities that have a documentation page. A capability that does not appear here is not necessarily unavailable; check the page that documents it. This page covers the Layer5 Cloud categories. For design, deployment, collaboration, and performance capabilities, see [Kanvas Feature Availability by Plan](/kanvas/reference/feature-availability/). ## Capabilities by plan

Identity & Access Management
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Built-in Roles	Predefined user roles: Organization Admin, Team Admin, Workspace Admin	Included	Included	Included	Included
Identity through OAuth	Use third-party identity providers, Google and GitHub, to manage the identities of your organization’s members.	Included	Included	Included	Included
Teams	Establish new team for organizing groups of users and resource access. Single organization, multiple teams.	Not included	Included	Included	Included
Custom Roles	Assign User Roles, Assign Keychains to Roles	Not included	Not included	Included	Included
User-defined Roles	Customizable roles for specific permission assignments	Not included	Not included	Not included	Included
Cloud as an IDP	Own and control the user accounts of your enterprise members with Cloud your identity provider (IdP).	Not included	Not included	Not included	Included
Organizations	Participate as a member of multiple organizations each with their own accounting and billing structure. Multiple organizations, multiple teams.	Not included	Not included	Not included	Included
Organizations	Establish new organization for organizing teams, users, and resource access.	Not included	Not included	Not included	Included
Direct Add or Invite User to Organization	Directly create a new user account within an organization. Send a request for a user to join an organization.	Not included	Not included	Not included	Not included

Workspaces
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
My Workspace	My Workspace is your always available, primary space for storing designs, views, and models that you own.	Included	Included	Included	Included
GitOps Snapshots	Visual insights in your pull requests in GitHub. Verify your workload designs and Kubernetes cluster configurations prior to accepting and merging pull requests.	Not included	Included	Not included	Included
Manage Workspace Team and Environment Access	Assign designs, views, users, and environments to shared workspaces.	Not included	Included	Included	Included
Shared Workspaces	Shared Workspaces are collaborative spaces that you can use to store and collaborate on files within and between teams. Easily share files with customizable permissions (edit, comment, view). Create up to 10 shared workspaces per organization.	Not included	Included	Included	Included
GitOps Integrations	Initiate deployment with creation of pull request, ArgoEvents, Flux sync, or webhook.	Not included	Not included	Not included	Included

Catalog
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Public Catalog: 400 Cloud Native Patterns	A library of pre-built design patterns and operational templates for common deployment scenarios, simplifying the configuration process and ensuring best practices.	Included	Included	Included	Included
Organization Private Catalog	Privately publish and share reusable design patterns and operational templates within your organization.	Not included	Not included	Not included	Included
Share Design	Share design with anyone within your organization, and make your design easily accessible to all relevant team members.	Included	Included	Not included	Included
Clone Design	Clone any published design to customise it according to your use cases	Included	Included	Not included	Included
Publish Design	Publish a design	Not included	Not included	Not included	Not included
View Designs	View all public and published designs of other team members and private of signed-in user	Not included	Not included	Not included	Not included
View Filters	View all public and published filters of other team members and private of signed-in user	Not included	Not included	Included	Included
Approve Catalog Request	Change management for the curation of content published in the catalog.	Not included	Not included	Not included	Included
Single and multiple approvers		Not included	Not included	Not included	Not included
Import Filter	Import a publish WASM filter	Not included	Not included	Not included	Not included

Security
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Event Audit Trail	Detailed accounting of user activity. Historical record or each action taken.	Not included	Not included	Not included	Included
Customizable Permissions: Keys, Keychains and Roles	Highly flexible permissioning. Organize keys into custom keychains and assign to existing or custom roles that you define.	Not included	Not included	Not included	Included
User Session and API Token Oversight	Expiring and non-expiring API tokens. Visibility into active and expired user sessions.	Not included	Not included	Not included	Included

Managed Service Provider
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Public Profiles for Users	See public user profile details, public activities and public resources.	Not included	Not included	Not included	Included
Recognition Program Badges	Badges are visual indicators of achievements or milestones that users can earn in order to recognizing activity milestones, encouraging positive behavior, mark progress, and gamifying platform experience.	Not included	Not included	Not included	Included
Self-service User Accounts	New user sign-up verification. Self-service password recovery.	Not included	Not included	Not included	Included

Support and Deployment
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Community Support	Get help with most of your questions and issues in our Community Forum.	Included	Included	Included	Included
Standard Support	Support can help you troubleshoot issues you run into. Get support via email.	Not included	Included	Included	Included
Managed Service Provider	White Label: Customize the appearance and branding of your engineering platform powered by Cloud. Multi-tenancy: Hierarchical organizations, teams, users and customizable permissioning.	Not included	Not included	Not included	Included
Premium Support	With Premium, get a 2-hour SLA and 24/7 web and phone support.	Not included	Not included	Not included	Included
Self-hosted Deployment	Self-hosted Cloud for on-prem appliances or self-managed cloud tenants. Keep your designs internal to your workplace. Get remote support when you need it.	Not included	Not included	Not included	Included

Academy
Capability	What it does	Free	Team Designer	Team Operator	Enterprise
Academy Theoretical Learning	A comprehensive learning management system for creators and instructors on how to build, manage, and extend educational content like learning paths, challenges, and certifications.	Not included	Not included	Not included	Included
Academy Practical Learning	An inclusive, collaborative, hands-on learning environment for students.	Not included	Not included	Not included	Included

## Limits by plan Each plan records a quantity for the following entitlements. | Entitlement | Free | Team Designer | Team Operator | Enterprise | |---|---|---|---|---| | Components per design | 100 | 200 | 100 | 300 | | Relationships per design | 100 | 200 | 100 | 300 | | Image size in a design | 250 KB | 1 MiB | 1 MiB | 10 MiB | | Designs per workspace | Unlimited | Unlimited | Unlimited | Unlimited | | Workspaces per organization | See note | 10 | 10 | Unlimited | For workspaces per organization on the Free plan, the plan records disagree: the monthly billing record sets 1 and the annual billing record sets 10. ### Which limits Layer5 Cloud enforces Layer5 Cloud enforces one limit today: components per design. When you save or import a design, Layer5 Cloud compares its component count with the limit of your organization's active plan. A design that exceeds the limit is refused with the error `Design exeeds maximum limit of N components supported by your current plan`, where N is the limit. To proceed, reduce the number of components in the design or upgrade the plan. When an organization holds more than one active subscription, the highest component limit among them applies. An organization with no active subscription cannot save or import a design; the request fails with HTTP 500 and the error `Org is not entitled to adding components to a design`. Layer5 Cloud records every other quantity in the table and lists it through the entitlements API (`GET /api/entitlement/features`), but it does not refuse an action because of any of them. For the API's base URL and authentication, see the [API Reference](/cloud/reference/api-reference/). ## Availability depends on more than your plan ### Your role Authorization in Layer5 Cloud is by permission key. Each role you hold grants a set of keys, and your effective permissions are the union of the keys from every role you hold in the organization you are working in. An action your role does not grant is refused with HTTP 403, even when your plan includes the capability. See [Roles and Permissions](/cloud/reference/default-permissions/) for which role holds which permission. ### Where your deployment runs Layer5 Cloud runs either as the hosted service that Layer5 operates or as a [self-hosted deployment](/cloud/guides/self-hosted/) that you operate. Self-hosted Deployment is listed under the Enterprise plan in the **Support and Deployment** table. The difference that matters most for availability is provider administration. The Provider Admin role administers the deployment and passes every permission check; on a self-hosted deployment, your operators assign it. ### Custom roles Only Provider Admins create custom roles. Layer5 Cloud refuses a role creation request from anyone else with HTTP 403. On hosted Layer5 Cloud, an organization therefore cannot create a custom role itself; on a self-hosted deployment, the operator's Provider Admins can. Roles are defined for the whole deployment, not per organization, so a role change applies in every organization where the role is held. The **Custom Roles** and **User-defined Roles** rows in the **Identity & Access Management** table describe how those capabilities are packaged into plans. Layer5 Cloud does not check your plan when a custom role is created. ### Plan rows and enforcement The component limit is the only entitlement Layer5 Cloud enforces by plan. The capability rows in the matrix describe how Layer5 packages its plans. When an action is unavailable and the plan is not the component limit, check your role and your deployment first. ## Support by plan The support channels and response commitments each plan includes are listed in [Support](/cloud/reference/support/).