Enterprise setup

You subscribed. Turn it on.

The paid layer is three extra services you run next to your wiki, on your own servers: the gateway your agents talk to, the audit recorder, and the dashboard. They switch on with your short activation code. Your content never moves to our cloud — only seat counts are reported, so we can meter the plan. Hand the prompt below to your agent, or follow the four steps yourself.

Paste this to your AI agent 
Turn on the Letwrites Enterprise layer on our existing self-hosted Letwrites.

1. I have an activation code and access to the private images. Ask me for the
   code (LETWRITES_ACTIVATION) and confirm we can pull the enterprise images.
2. Bring up the three paid services next to our stack with the enterprise overlay,
   with LETWRITES_ACTIVATION + LETWRITES_BILLING_URL set and LETWRITES_ENGINE_SECRET shared with the engine:
     docker compose -f wiki/deploy/docker-compose.yml \
       -f deploy/compose.enterprise.yml up -d
   They refuse to start without a valid license, so confirm all three booted.
3. Put the gateway behind our SSO: set OIDC_ISSUER and OIDC_AUDIENCE so every
   agent call is bound to a verified person.
4. Point our agents' MCP at the gateway endpoint (e.g. https://docs.ourco.com/mcp),
   and set LETWRITES_GATEWAY_URL for the letwrites-publish and letwrites-search skills.
5. Open the governance dashboard and confirm decisions, denials, and skill usage
   show up.

Check in with me at each step and wait for my answer when you need a decision.

Works with Claude Code, Cursor, or any agent that can run shell commands. Full reference lives in deploy/compose.enterprise.yml and docs/DEPLOY.md in your Enterprise repo.

Step 1

Your activation code, and the images.

When you subscribe you get two things: a short activation code (shown on your success page, re-fetchable anytime at billing.letwrites.com/license), and access to pull the private Enterprise images. Your services exchange the code for a signed, short-lived license and refresh it daily — reporting only seat counts, never your content. Air-gapped deployments can use an offline token instead.

1

Drop your activation code in your environment

Put your short code in your env as LETWRITES_ACTIVATION. Your services fetch a signed, short-lived license from us and refresh it daily; change seats or cancel anytime and they pick it up automatically. (Air-gapped? Use an offline LETWRITES_LICENSE token instead — just ask.)

# in your deploy .env LETWRITES_ACTIVATION=lw_... # the code from your success page LETWRITES_BILLING_URL=https://billing.letwrites.com
2

Pull the Enterprise images

Your subscription grants pull access to the private gateway, audit, and dashboard images. Copy them into your own registry if you run with no internet.

Offline, and it never locks you out. The license is checked on your servers against a built-in key, with no call home. If it expires it warns you but never shuts off your wiki. Renewing is just a new token, nothing reinstalls.
Step 2

Deploy the three paid services.

They run beside your existing wiki, on the same network, on your infrastructure. Each one verifies the license on startup and refuses to boot without it, so a missing or expired token can never quietly leave the gate open.

1

Bring up the enterprise overlay

One command starts the gateway, the audit exporter, and the dashboard alongside your stack.

docker compose -f wiki/deploy/docker-compose.yml \ -f deploy/compose.enterprise.yml up -d
2

Send the audit to your security tools

Point the audit at your security log system (Splunk, Microsoft Sentinel, or any webhook). It sends a copy of every agent action there, and raises an alert if the log on the wiki is ever changed.

SIEM_TYPE=splunk SIEM_URL=https://splunk.ourco.com:8088 SIEM_TOKEN=...
3

Turn on self-service team groups

So people manage their own sharing groups without filing an admin ticket, give the broker's service account two more permissions in BookStack: Manage Users & Roles and Manage Users (it already has Manage Permissions for sharing). A "My Teams" panel then appears for everyone, and nobody can reach another team's content or escalate access. Miss this and group actions show a clear "grant these permissions" message, never a silent failure.

Settings ▸ Roles ▸ your broker service account ▸ enable "Manage Users & Roles" + "Manage Users"
Step 3

Connect your SSO, point your agents at the gateway.

The gateway figures out the real person behind every agent call from your login system, so writes are tied to a name and recorded. No shared API tokens floating around.

1

Verify identity with OIDC

Set your issuer and audience. The gateway verifies each request's token against your IdP's keys, so the agent can only ever act as a real, signed-in person.

OIDC_ISSUER=https://login.ourco.com OIDC_AUDIENCE=letwrites
2

Point the skills at the gateway

Set LETWRITES_GATEWAY_URL for the letwrites-publish and letwrites-search skills. Now writing runs as the real signed-in person, checked against their permissions and recorded, instead of with a personal token.

LETWRITES_GATEWAY_URL=https://docs.ourco.com/mcp
Writing back is the upgrade. An agent proposes an edit, a person approves it, and the action is logged against a real name. That is the thing Confluence never gave you, and the reason the paid layer exists.
Step 4

Open the governance dashboard.

The read only screen your admins and security team open: who asked what, what was blocked, which questions keep getting asked with no answer, skill usage, and live audit health. It runs on your own network.

1

Front it with your SSO, for auditors only

It shows raw query text, so expose it behind your SSO and restrict it to admins and security. Then confirm the agent activity you just generated is showing up.

# the dashboard is on the governance service https://docs.ourco.com/governance
2

That's it, you're governed

Every agent read and write is now tied to a real person, checked against their permissions, recorded in a log that can't be quietly edited, and copied to your security tools. Need help or hit a snag? Email hello@letwrites.com.