STaurtomation/docs/research/notes/n8n-feature-feasibility.md

Ported from earlier research (2026-10-29) and sanitized for clean-room use: source-code-derived details removed. Not legal advice.

n8n Gated Features: What's Restricted in Community Edition and How Each Could Be Provided Independently

Research date: 2026-10-29. Marking: [V] = verified this session from a fetched source; [K] = from background knowledge (pre-2026), not re-verified this session. Treat [K] as needing a check. No license-key bypass content is included. The "external means" listed below are sidecars, proxies, documented extension points, or separate tools. None of them modify n8n's Enterprise-licensed code. Licensing analysis is in n8n-licensing-legal.md.

Sanitization note: internal database table names, internal (non-public) API paths and descriptions of n8n's internal code structure have been generalized or removed. Environment variables, CLI commands, public API endpoints and expression syntax below are as documented by n8n for users.

---

Q1. What is gated, on which plan, and at what price (2025-2026)?

Takeaway

n8n Cloud has three self-serve plans: Starter €20/mo (2.5K executions), Pro €50/mo (10K), and Business €667/mo (40K), all billed annually. Business is self-hosted only, with Cloud on a waitlist. Enterprise is priced by sales. The self-hosted Community Edition (CE) leaves out SSO/LDAP, projects, sharing, variables, environments/git, external secrets, external binary storage, log streaming, and multi-main. A free "registered community" key unlocks folders, debug-in-editor, and custom execution data.

Cited Findings

• Plans and prices (annual billing, EUR; the page shows no monthly or USD prices): Starter €20/mo, hosted, 2.5K executions/mo. Pro €50/mo, hosted, 10K. Business €667/mo, "self-hosted only (Cloud waitlist)", 40K. Enterprise: contact sales, hosted or self-hosted, custom volume, SLA. CE is self-hosted from GitHub with no price — n8n pricing [V]
• Shared projects: Starter 1, Pro 3, Business 6, Enterprise unlimited — n8n pricing [V]
• Concurrent executions (cloud): Starter 5. Pro "20 / 50" in the table but "up to 50" on the plan card, so the page contradicts itself. Enterprise 200+ — n8n pricing [V]
• Execution log retention: Starter 7 days, Pro 30 days, Enterprise unlimited. Max saved executions: 2.5k / 25k / 50k — n8n pricing [V]
• Workflow history: Starter 1 day, Pro 5 days, Enterprise 365+ days — n8n pricing [V]. The docs say versions from the last 24 hours are available to all users, full history needs Enterprise, and Cloud Pro gets 5 days — n8n docs: workflow history [V, via search summary]. A third-party Activepieces blog (2026-10-27) gives 30 days for Business self-hosted and 1 day for Community — Activepieces blog [V, secondary and from a competitor]
• Insights: Starter gets the overview banner only. Pro gets a dashboard with a 7-14 day filter. Business 30 days. Enterprise covers 24h-365 days at hourly, daily, or weekly granularity — n8n pricing [V]. The docs say the 7-day summary banner appears on all plans and the dashboard is Pro (limited) and Enterprise only. N8N_INSIGHTS_MAX_AGE_DAYS defaults to 365, and N8N_DISABLED_MODULES=insights turns insights off — n8n docs: insights [V, via search summary]
• SSO and LDAP: Business and Enterprise only (not Starter or Pro) — n8n pricing [V]. OIDC setup is documented as an Enterprise feature — n8n docs: OIDC setup [V, via search snippet]
• Roles: Admin roles and instance admins are Pro and above. Project editors are Pro and above, while Starter has project admins only. Project viewers and custom roles are Enterprise only — n8n pricing [V]. The docs say the Editor role is on Cloud Pro and self-hosted Enterprise, and Viewer is on Cloud Enterprise and self-hosted Enterprise — n8n docs: role types [V]
• Global variables: Pro and Enterprise. Multiple environments and git version control: Business and Enterprise (Enterprise includes dev and prod instances). Workflow Diff, external secret store, log streaming, audit logging, execution data redaction, enforced instance-wide 2FA, worker view, and "End-user credentials (preview)": Enterprise only on the comparison table. Multi-main: "Coming soon" on Enterprise in the cloud table — n8n pricing [V]
• Queue mode on the cloud pricing table: No for Starter/Pro, Yes for Business/Enterprise. This is about cloud plans. Self-hosted CE can run queue mode (see Q2) — n8n pricing [V]; CE queue mode [K]
• Debug in editor: Starter, Pro, and Enterprise. Search executions by their data: Pro and above — n8n pricing [V]
• AI Assistant: preview on Starter (1,600 credits/mo) and Pro (up to 9,600/mo; the FAQ mentions 4,000 or 9,600). On self-hosted it runs in preview with your own API key and has no credit limits — n8n pricing [V]
• Log streaming is on Cloud Enterprise and self-hosted Enterprise. Destinations are syslog, generic webhook, and Sentry. Event categories are workflow, node, audit (user/credential/workflow/variable/external-secrets/package/role-mapping/token-exchange/MCP), worker, AI node, runner, and queue (enqueued/dequeued/completed/failed/stalled) — n8n docs: log streaming [V]
• Excluded from CE: Custom variables, Environments, External secrets, External storage for binary data, Log streaming, Multi-main mode, Projects, SSO (SAML, LDAP), Sharing of workflows and credentials, Version control using Git — n8n docs: Community Edition features [V]
• Unlocked in CE by the free registered community license key: Folders, Debug in editor, Custom execution data (save, find, and annotate execution metadata) — n8n docs: CE features [V]
• Business/Enterprise is required for the s3 and azure values of N8N_EXECUTION_DATA_STORAGE_MODE (external storage) — n8n docs: executions env vars [V]
• N8N_CONCURRENCY_EVALUATION_LIMIT depends on tier: 1 on CE and Cloud Pro, 3 on self-hosted Business, 5 on Enterprise. Setting the variable overrides the tier default — n8n docs: executions env vars [V]
• n8n 2.0 (December 2025) added isolated task runners, which are secure by default, and a publish/save model that separates drafts from live workflows — jimmysong.io deep dive [V, secondary]

Inferences

• Business (€667/mo, self-hosted) is the cheapest plan with SSO, git, environments, and queue mode. Many "Enterprise" rows (log streaming, external secrets, audit, worker view) are not shown on the Business card, so Business may not have them. Confirm with sales.
• The pricing table describes cloud plans. Self-hosted CE gating follows the CE features doc instead. For example, queue mode and concurrency limits run on CE without a license.

Gaps

• The pricing page does not give monthly or USD prices. Older Business pricing (e.g. €800/mo) is not confirmed here.
• Whether Business self-hosted includes log streaming, external secrets, and audit logs is not shown on the page.
• I did not verify whether CE still limits the number of users. Background knowledge [K]: CE allows an owner plus invited members, but members cannot share workflows or credentials, and admin roles are gated.
• Whether "Folders" is on paid cloud plans is not listed in the pricing table.

---

Q2. What is already free in CE, and how could each gated feature be provided externally? (per-feature table)

Takeaway

Several "gated" capabilities have free near-equivalents. Pruning and concurrency use environment variables. Queue mode, the /metrics endpoint, the public REST API, CLI export/import, and external backend hooks are all available on CE. That leaves real gaps in four places: in-product identity (SSO, RBAC, sharing), live log streaming of audit events, external secrets, and multi-main HA. All four can be approximated with proxies, sidecars, and scripts. For STaurtomation, the table doubles as a list of capabilities users expect and of the operational knobs they are used to.

Cited Findings

• Pruning env vars are not license-gated: EXECUTIONS_DATA_PRUNE (default true), EXECUTIONS_DATA_MAX_AGE (default 336 hours = 14 days), EXECUTIONS_DATA_PRUNE_MAX_COUNT (default 10000; 0 = no limit), EXECUTIONS_DATA_HARD_DELETE_BUFFER (1h), ..._HARD_DELETE_INTERVAL (15 min), ..._SOFT_DELETE_INTERVAL (60 min) — n8n docs: executions env vars [V]
• N8N_CONCURRENCY_PRODUCTION_LIMIT (default -1, meaning no limit in regular mode) is not marked as license-gated — same [V]
• The /metrics Prometheus endpoint is enabled with N8N_METRICS=true (off by default). It is available on self-hosted in all editions, but not on n8n Cloud. /healthz and /healthz/readiness (DB connected and migrated) are always on. Health checks on queue workers need QUEUE_HEALTH_CHECK_ACTIVE=true — n8n docs: monitoring [V]
• External backend hooks are registered with EXTERNAL_HOOK_FILES. They are plain JS files that run server-side and include hooks such as n8n.ready and frontend.settings — n8n docs: external hooks [V, via search summary]. External hooks are not on the CE exclusion list, and a community member reports they work without a license key — community thread, 2026-03/04 [V]
• A NixOS deployment puts n8n behind oauth2-proxy with Kanidm. An external hook logs users in automatically from the X-Email header. The hook code is not shown — git.thalheim.io dotfiles [V, via search summary]
• cweagans/n8n-oidc describes itself as "bolt-on OIDC support for n8n" (JavaScript). An aggregator lists its last push as 2025-12-29 with 2 open issues. I did not check this on GitHub — GitTrend [V, aggregator]. A forum reply also names n8n-oidc and n8n-community-sso. A search for the latter found no such project — community thread [V]
• Proxy-gateway SSO is a known pattern: Authelia, Authentik, Pomerium, or Cloudflare Access enforce IdP MFA and groups before a request reaches n8n. n8n's own login still applies unless a hook maps the header to a session — lumadock guide (403 on fetch; content seen only as a search summary) [V-partial]. Header trust is safe only if the backend is reachable solely through the proxy — Authelia nginx docs [V, via search]
• Git backup and sync community tooling: n8n.io template 12721 offers bidirectional GitHub sync. It detects new, edited, renamed, and deleted workflows, runs a daily backup, and has a manual restore path — n8n template 12721. Template 7304 does backups with change detection and name-based filenames — n8n template 7304. The forum's "Ultimate GitHub ↔ n8n Workflow Backup System" adds a UI and lets you import from any commit — community.n8n.io. wapad/n8n-data-manager is a shell script that backs up and restores workflows, credentials, and env to GitHub — ecosyste.ms topic [V, via search]
• [K] CLI: n8n export:workflow --all --separate --backup --output=dir/, n8n export:credentials --all [--decrypted], n8n import:workflow --separate --input=dir/, n8n import:credentials. Public REST API (/api/v1/workflows, /executions, /credentials, /tags) with X-N8N-API-KEY, available on CE. Security audit with n8n audit CLI / POST /api/v1/audit (risk report, not an event log). Logging with N8N_LOG_LEVEL and N8N_LOG_OUTPUT=console,file, N8N_LOG_FILE_LOCATION. Credential overwrites with CREDENTIALS_OVERWRITE_DATA (JSON per credential type) or CREDENTIALS_OVERWRITE_ENDPOINT. Docker secrets through _FILE-suffixed env vars. Queue mode with EXECUTIONS_MODE=queue plus Redis (QUEUE_BULL_REDIS_*) and n8n worker processes. Error Workflow (Error Trigger node) is free.

Per-feature table

Feature	Gated on (plan)	Free in CE today	External / independent approach (no edits to Enterprise-licensed code)	Clean-room in-product difficulty	Community projects
SSO – SAML	Business+, Enterprise [V]	Email/password login, 2FA per user [K]	A forward-auth proxy (Authelia/Authentik/Pomerium/oauth2-proxy/Cloudflare Access) in front of n8n gates access, but users then hit n8n's login again. Removing the second login takes an external hook that reads the trusted header and issues the session cookie (thalheim pattern). SAML IdP → proxy (Authentik/Keycloak can bridge SAML to OIDC).	Medium-High: auth middleware, JIT provisioning, cookie/JWT issuance, mapping onto the user model	cweagans/n8n-oidc; thalheim oauth2-proxy+hook; lumadock guide
SSO – OIDC	Enterprise per docs; pricing card says "SSO" on Business [V]	—	Same as above. oauth2-proxy/Pomerium are native OIDC. A hook-based OIDC callback is what n8n-oidc does.	Medium	cweagans/n8n-oidc
LDAP	Business+, Enterprise [V]	—	Authelia/Authentik/Keycloak with an LDAP backend → forward-auth headers → hook. Or a cron job that syncs LDAP users into n8n via invites. [K: the public API's user endpoints may need an owner key]	Medium	none found specifically
User mgmt / RBAC (instance admin, project admin/editor/viewer, custom roles)	Admin: Pro+. Editor: Pro (cloud) / Enterprise (self-host). Viewer and custom roles: Enterprise [V]	Owner + members [K]	You cannot add real per-object authorization from outside. Options: separate n8n instances per team/trust boundary (one owner each); a proxy that restricts write methods per group (a crude, fragile read-only "viewer"); expose workflows to non-editors through webhooks/forms only	High: per-object authorization must be enforced on every API endpoint and UI view	none robust found
Projects (count limits) / sharing	Projects excluded from CE; Starter 1 / Pro 3 / Business 6 / Ent unlimited shared projects [V]	Personal space per user; tags; Folders (registered key) [V]	One instance per team; tags and folders as soft grouping; a git repo per team using the export/import scripts	High: tied to the RBAC data model	—
Workflow & credential sharing	Excluded from CE [V]	—	Shared service account (the owner) with distributed login, which is weak for audit. Credentials injected via CREDENTIALS_OVERWRITE_DATA so every user's node of a given type gets the same secret [K]. Export/import workflows between users via CLI/API	High	—
Log streaming (syslog/webhook/Sentry)	Enterprise [V]	/metrics Prometheus (self-host, all editions) [V]; console/file logs [K]; Error Trigger workflows [K]; execution records in the DB	(1) Ship N8N_LOG_OUTPUT=file / container stdout with Vector/Fluent Bit/Promtail to syslog/Loki/Datadog. (2) Postgres logical replication or Debezium CDC on the execution tables to get workflow-level events. (3) Prometheus scrape of /metrics plus Alertmanager. (4) A global Error Workflow that posts to a webhook or Sentry. (5) External hooks on workflow lifecycle events [K; check the docs for hook names]. Node-level and audit events are the hard part.	Medium: delivering events to destinations is easy; producing node and audit events needs in-process hooks	none specific found
Execution retention / pruning	Cloud plans cap retention (7d / 30d / unlimited) [V]	Fully free on self-host via EXECUTIONS_DATA_PRUNE, _MAX_AGE, _PRUNE_MAX_COUNT [V]; EXECUTIONS_DATA_SAVE_ON_SUCCESS/ERROR [K]	Already free. For longer archives, copy execution rows to cold storage before pruning (cron + pg_dump or COPY)	N/A (free)	—
Insights	Dashboard: Pro (limited) / Enterprise (full) [V]	Summary banner (7 days) on all plans [V]; insights data is collected on CE (N8N_INSIGHTS_MAX_AGE_DAYS default 365) [V]	Grafana on Postgres execution data or Prometheus /metrics counters. Metabase/Superset dashboards	Low-Medium: it's an aggregation UI over existing data	Grafana n8n dashboards exist [K]
Multiple environments / git source control	Business+, Enterprise [V]; excluded from CE [V]	CLI export/import, public API [K]	Separate dev/stage/prod instances (distinct DB, same N8N_ENCRYPTION_KEY only if moving encrypted creds). CI (GitHub Actions/GitLab) runs n8n export:workflow --backup --separate → commit → PR review → n8n import:workflow or API PUT on prod. Strip/re-map credential IDs per environment.	Medium: serializing workflows is simple, but merge, conflict, and credential-stub mapping take work	templates 12721, 7304, the forum UI system, wapad/n8n-data-manager
Workflow history / versions / diff	CE: 24h (docs) [V]; Pro 5d; Ent 365+ days; Diff Ent only [V]	Last 24h versions [V]	A git backup on every change (cron every N min or a public-API poll for recently updated workflows) gives unlimited history. git diff / jq-normalized JSON diff. Restore with import	Low-Medium	same git-backup tools
Variables ($vars)	Pro+ cloud; excluded from CE [V]	Env vars via $env in expressions [K, may be blocked by N8N_BLOCK_ENV_ACCESS_IN_NODE, default true in v2 per n8n 2.0 hardening — unverified]	Use $env (set N8N_BLOCK_ENV_ACCESS_IN_NODE=false), a "config" sub-workflow or Data Table read at start, or a static JSON file loaded via Read File node	Low	—
External secrets (Vault, AWS SM, Azure KV, GCP SM, Infisical)	Enterprise (pricing table) [V]; excluded from CE [V]	CREDENTIALS_OVERWRITE_DATA / _ENDPOINT [K]; _FILE env vars [K]	A sidecar (Vault Agent, External Secrets Operator in Kubernetes, Infisical agent, AWS Secrets CSI) renders secrets into env or a file at pod start. Feed them into CREDENTIALS_OVERWRITE_DATA, or have a cron job update credentials via the public API (create/delete; update support [K, uncertain]). Or call the Vault/AWS API at runtime inside a workflow via HTTP node (bootstrap token still needed)	Medium: provider adapters + expression resolution {{ $secrets.x }}	none specific found
Audit logs	Enterprise [V]	n8n audit security risk report [K]; workflow update timestamps and history	DB triggers or CDC on the workflow, credential and user tables; reverse-proxy access logs (method + path + header identity) give a who-did-what HTTP trail; external hooks for workflow create/update/delete [K]	Medium	—
Queue mode / workers	Cloud: Business+ [V]	Free on self-host: EXECUTIONS_MODE=queue + Redis + n8n worker [K]	Already free. Scale workers with Kubernetes HPA/KEDA on Redis queue length	N/A	n8n Helm charts (community) [K]
Worker view	Enterprise [V]	Worker /healthz (QUEUE_HEALTH_CHECK_ACTIVE) [V]; /metrics [V]	Grafana panel from worker /metrics + Bull queue metrics from Redis (bull-board, redis-exporter)	Low	bull-board (generic BullMQ UI) [K]
Multi-main HA	Excluded from CE [V]; Enterprise [V]	Single main + many workers [K]	Active/passive: one main replica plus a fast restart (Kubernetes liveness), with Postgres HA. Separate webhook processors (n8n webhook) in queue mode take ingress load [K]. True active-active needs leader election for triggers/cron, which is the hard part.	High: leader election, pub/sub coordination, trigger deduplication	—
Debug in editor	Free with registered CE key [V]	Yes (registered) [V]	—	—	—
Execution search / custom data	Search by data: Pro+ cloud [V]; custom execution data free with registered key [V]	Custom data (registered) [V]	Full-text search via Postgres on execution data (JSON) or ETL into OpenSearch	Low-Medium	—
Folders	Free with registered CE key [V]	Yes (registered) [V]	—	—	—
Concurrency limits	Cloud caps 5/20-50/200+ [V]	Free: N8N_CONCURRENCY_PRODUCTION_LIMIT [V]	Already free	N/A	—
External binary storage (S3/Azure)	Business/Enterprise [V]	Filesystem / DB mode [K]	Mount S3 through a FUSE or CSI driver (s3fs, mountpoint-s3) into the filesystem binary-data path. Performance caveats apply	Medium	—
AI Assistant credits	Cloud credits: 1,600 Starter / up to 9,600 Pro [V]	Self-hosted: preview with own API key, no credit limit [V]	Use own LLM keys; the AI Agent nodes are free; an external MCP/LLM coding assistant can generate workflow JSON	N/A	—

Inferences

• External hooks are the key enabler for SSO on stock n8n without touching Enterprise-licensed code. They work without a license in practice, though n8n has not ruled on whether using them this way complies with its license (see Q3). They run inside the n8n process, so they can break on upgrades. Pin versions and test them in CI.
• n8n does not natively honor forwarded identity headers in CE. I found no documented trusted-header login. A proxy alone gives an access gate on top of n8n's login, not seamless SSO. Seamless SSO needs a hook such as the thalheim X-Email hook or n8n-oidc.
• Retention, concurrency, queue mode, and /metrics are gated only on cloud. On self-host they are free, so they need no reimplementation.
• RBAC, sharing, and multi-main are the hardest to provide from outside. Separate instances per team is the most robust workaround.

Gaps

• The cweagans/n8n-oidc README, its mechanism, and its compatibility with n8n 2.x were not verified on GitHub.
• Exact hook names for workflow lifecycle events and the current N8N_BLOCK_ENV_ACCESS_IN_NODE default in v2 were not re-verified.
• Whether the public API supports updating existing credentials (vs. create/delete) in current versions was not verified.
• I found no community project specifically doing external-secrets or log-streaming sidecars for n8n.

---

Q3. Legal/technical constraints on a clean-room reimplementation

Takeaway

n8n uses the Sustainable Use License (SUL). It allows internal-business use and modification but restricts commercial resale and hosting. Files carrying the Enterprise Edition marker fall under the separate n8n Enterprise License. Whether an independently written SSO built on hooks complies with the license is officially unresolved. A community user asked n8n licensing in March 2026 and had no answer as of April 8, 2026. Full analysis: n8n-licensing-legal.md.

Cited Findings

• Fair-code / SUL: anyone may use and modify the source for free, but commercial resale as a hosted service is restricted. Free self-hosting is allowed for internal use, and commercial hosting or embedding needs a paid license — Sacra [V, secondary]
• The question of building one's own OIDC SSO via hooks without n8n-derived code was asked on 2026-03-31. Replies argued hooks are an ungated CE feature and the approach "sounds reasonable", and advised contacting license@n8n.io. The asker had emailed and received no response by 2026-04-08. No n8n staff confirmation appears in the thread — community.n8n.io thread [V]
• The n8n repo has LICENSE.md (SUL) and LICENSE_EE.md (n8n Enterprise License, covering Enterprise-marked files). Using the EE code in production requires a valid enterprise license — LICENSE_EE.md

Inferences

• The lowest-risk approach for n8n users is purely external: proxies, CI scripts, sidecars, and DB/metrics scraping. Hook-based in-process features sit in a grey area. Anything that patches or replaces Enterprise-licensed modules, or interferes with license checks, is out of bounds (license-key bypass excluded per scope).
• Even a clean-room in-product feature forked into n8n stays under SUL for the rest of the codebase. That fork cannot be offered commercially as a hosted service. An independent codebase (STaurtomation's model) is not subject to the SUL.

Gaps

• No official n8n statement on hook-based SSO was found.

---

Q4. Alternatives (open-source workflow tools) and their own gating; n8n forks

Takeaway

Most "open-core" alternatives gate the same enterprise set as n8n: SSO, RBAC, audit, git, and secrets. Truly ungated options are general-purpose orchestrators or simpler tools: Node-RED, Huginn, Airflow, and Temporal. Kestra and Windmill are OSI-licensed at the core but still gate SSO/RBAC/audit. See also the Kestra/Windmill/Activepieces comparison.

Cited Findings

• Windmill Community Edition caps SSO users at 10, users at 50, workspaces at 3, and groups at 4. Git sync works for up to 2 users. There are no audit logs, no external secret backends (Vault/AKV/AWS SM), no multiplayer, no agent workers, no worker-group management UI, no autoscaling, and no concurrency limits. SAML and SCIM are Enterprise — Windmill pricing [V]. The license is not stated on the pricing page. [K] The core is AGPLv3, with EE features under a proprietary license.
• Activepieces pricing: Free $0 (1,000 credits, 5 users), Plus $20/mo, Team $200/mo (25 users, SSO and standard roles), Ultimate custom (SCIM, custom RBAC, audit logs, secret managers, Git sync/releases, branding), Embed from $36k/yr — Activepieces pricing [V]. The core is MIT; enterprise code is under a commercial license — Activepieces license docs [V, via search]. Sources disagree on whether CE lacks projects, SSO, audit, and Git sync (third-party summary) or has "all features" (vendor editions page) — editions [V, conflicting]
• Kestra OSS is Apache 2.0 at $0 and includes Git integration/versioning. Enterprise adds SSO (OIDC, LDAP, SCIM), RBAC, audit logs, secrets managers, multi-tenancy, worker groups, and namespace-level secrets/variables. It is sold as an annual per-instance subscription with no listed price — Kestra pricing [V]
• [K, not re-verified] Node-RED: Apache-2.0, no paid tier in core. Its multi-user/auth support is basic (admin auth with a passport strategy allows OIDC/OAuth). FlowFuse sells team and enterprise features. Huginn: MIT, fully free, multi-user, aging. Automatisch: AGPL-3.0 core with enterprise features under a commercial license (SSO/SAML gated). Apache Airflow: Apache-2.0, all features free (RBAC, OAuth/LDAP via FAB auth manager, logs to remote stores), but it is code-first, not low-code. Temporal: MIT server, all features free self-hosted (Temporal Cloud is paid); code-first.
• This part of the research (search-engine results only) found no reporting of an n8n fork that unlocks enterprise features — search results summary [V, negative result]. The licensing research did find that such forks exist; see n8n-licensing-legal.md §7 (they are not named).

Inferences

• If you need SSO and RBAC for free, the closest low-code fit is Node-RED (OIDC via admin auth, permissions coarse). Code-first stacks like Airflow and Temporal are fully free but are a different paradigm. Windmill CE gives 10 SSO users free, which is the most generous of the open-core options.
• n8n forks would inherit SUL restrictions. Any fork that unlocks Enterprise-licensed code would violate the Enterprise License.

Gaps

• Licenses and gating for Node-RED/FlowFuse, Huginn, Automatisch, Airflow, Temporal, and Windmill were not re-verified this session.
• No systematic GitHub search for n8n forks was done (search engine results only).