Skip to main content
For an organization with several teams, a security review to pass, and access to hand out deliberately. The technical work is the same as any other path; the sequencing is what is different.
Plan a quarter, not a week. First data in an hour, one team productive in a week, an organization in a quarter. The long pole is almost never the installation.

​
Phase 1 — Decide the boundaries

Everything here is expensive to change once telemetry has accumulated.
1

How many organizations

An organization is the isolation boundary: separate telemetry, keys, users and plan, with no cross-organization view.Most enterprises want one — with deployment.environment and service.namespace separating environments and teams — because every additional organization means another place to look and another set of dashboards nobody shares.Choose more than one only where the requirement is genuinely access control: a regulated workload, a customer-isolated deployment, a subsidiary that must not see the rest. See Organizations and multi-tenancy.
2

A naming convention

service.name, service.namespace, deployment.environment. Agree it once, centrally, and write it down before the first team instruments anything — retro-fitting a convention across forty services is a quarter of someone’s time.See Resource attributes.
3

Who holds which role

Viewer for most people. Editor for whoever maintains dashboards and alerts. Admin sparingly. Auditor for compliance reviewers — it grants audit-log access and no ability to change anything, which is exactly right and is frequently the role people did not know to ask for.See Roles and permissions.
4

What must never be sent

Telemetry is append-only with no surgical delete, so this must be decided before ingest rather than cleaned up after. Redaction belongs at the Collector, in your network. See Collector configuration.

​
Phase 2 — Security review

Exactly one outbound destination over TLS, authenticated by a license key. The Collector is the single egress point, and it is the place to enforce what may and may not leave. See Ingest endpoints.
Tenancy is attached at the receiver from your license key and never read from the payload, so an exporter cannot claim to be someone else. Every query filters on it, and a request naming another organization is refused rather than silently corrected.
License keys are shown once and stored only as a hash. They are revocable individually, so a compromised key is a rotation rather than an incident. Issue separate keys per environment and per agent — see Create a license key.
aiAxonIQ support access is time-limited and recorded in your audit log, not only in an internal one. That is a control you can verify rather than a policy you have to accept. See Audit log.
It grants kernel capabilities on every node, and Security model is written to be forwarded to a reviewer unedited.Two things a reviewer will find, so raise them yourself: there has been no external security review, and TLS library coverage is unmeasured. Both are stated on that page. Presenting them before your reviewer finds them is the difference between a caveat and a credibility problem.

​
Phase 3 — Access

Decide who gets in, and get them in, before the pilot starts.
There is no single sign-on today. aiAxonIQ does not federate with an identity provider — there is no SAML or OIDC application to register, and no directory group that maps to a role. Every person arrives through an invitation and holds a role set inside aiAxonIQ.Plan for that in the rollout schedule. An enterprise programme that assumed it could switch SSO on and let a directory do the onboarding has to fall back to inviting people, and that is a different amount of work.
Membership is therefore always an explicit, audited act rather than a side effect of a group change — which is the property a reviewer usually wants, and is worth saying out loud in Phase 2. See Roles and permissions and Invite your team.

​
Phase 4 — Pilot with one team

1

Choose a team with a real problem

A team that currently cannot answer a question they care about. A volunteer with nothing to diagnose produces a pilot that proves nothing.
2

Instrument one complete request path

End to end across every service it touches. A complete trace across five services demonstrates the value; partial coverage of twenty demonstrates the opposite.
3

Get to one real incident

The pilot succeeds when someone diagnoses something with it faster than they would have otherwise. Nothing else convinces an organization.
4

Write down what the team had to do

That becomes your internal runbook, and it is what makes team six take an afternoon instead of a week.

​
Phase 5 — Roll out

A Collector configuration and a set of environment variables they copy. Every team deriving their own from the documentation produces forty variations and forty naming conventions.
Exceeding a volume allowance does not stop ingest, so nothing fails to warn you — the first signal is the invoice. Settings → Usage, monthly. See Plan limits.
One place, not forty. Health-check filtering and tail sampling belong on the shared gateway where they can be reasoned about. See Sampling.
Every enterprise has services nobody owns and vendor images nobody can rebuild. eBPF instrumentation covers them without a code change — early access, and it needs the security conversation in phase 2. See Zero-code instrumentation.
The audit log is not exempt from retention. If compliance requires records for longer than the platform keeps them, a periodic export is the mechanism — there is no archive to request later. See Audit log.

​
What will actually go wrong

Naming drift. Six teams, six conventions, and a service list nobody can read. This is the failure that shows up in month three and costs the most to fix. Publish the convention, and check it at pilot rather than at scale.
Alert fatigue. Every team creating twenty rules on day one produces a channel everyone mutes. Cap it: two or three rules per service to begin with, and require that each one be tested after saving — a rule with an unimplemented comparator is created without complaint and never fires. See Alerting.
Volume surprise. Debug logging in one busy service, or one metric label carrying a request id, can multiply ingest overnight. Both are silent. Check usage in month one, not month four.

​
Next

Roles and permissions

What each role can do, and who may grant it.

Kubernetes

The technical path most enterprises take.

Zero-code security model

The document to forward to a reviewer.