Advanced Features & Configuration
Advanced capabilities that exist in Apso today, and — just as important — the ones that are not implemented yet, so you can plan around them. Grounded in the current platform behavior.
Access control (RBAC)
Per-service roles: Owner / Admin / User / ReadOnly, assigned in Service Settings → Members. Granular per-service role assignment is a Business-plan capability; below that, access is workspace-level. Roles are enforced server-side (a member is scoped to exactly the services they’re granted).
Audit logging
Audit logs are a Team / Enterprise entitlement (auditLogs). The audit-log endpoints are gated by tier — a workspace below Team receives 403 ENTITLEMENT_REQUIRED for them. See Error Handling.
Compute tiers & scaling
Services scale by tier (Small → 2XL, plus Custom), each bundling CPU, memory, and connection limits — set in Service Settings → Plan & Add-ons. Changing tier resizes the underlying Lambda, API Gateway, and database compute through an orchestrated upgrade; a failed resize rolls back automatically rather than leaving a half-applied change. Per-service add-ons can be enabled/disabled independently.
Custom domains & deployment targets
- Custom domains — a
customDomainsentitlement (Pro and above). - External AWS / BYOC — deploy into your own AWS account via
externalAws(Pro and above), configured through the connected-AWS-account flow. - Environments — per-service environment configuration; see Environments.
Schema (advanced)
- Relationships —
OneToOne,OneToMany, andManyToMany(see Schema Editor). - Rich data types —
json,jsonb,array,enum,uuid, and the full PostgreSQL numeric/temporal set. - Field constraints — primary key, not-null, and unique.
Schema migrations are generated and applied during deployment, not authored by hand in the app. There is no in-app schema-version history or manual rollback UI — the editor manages the schema definition, the pipeline manages migrations.
AI token budget
AI features (schema generation, chat) are metered against a per-workspace monthly token budget; exhausting it returns 429 (see Error Handling). The budget resets on a rolling monthly window.
Not currently available
Several items commonly requested under “advanced features” are not implemented in Apso today. Documenting them as available would be inaccurate:
- Deployment strategies — no blue-green or canary deployment, and no deployment hooks. Deploys are a single orchestrated pipeline (with automatic rollback on failure).
- Network security — no IP whitelisting/allow-lists and no user-configurable load balancing (AWS-managed).
- Custom authentication — auth is BetterAuth (OAuth providers + email); there is no custom auth-provider configuration surface.
- Logging configuration — no user-facing log-retention policy, log-level configuration, log aggregation, or log-export UI. Recent logs are viewable per service; retention is set by the platform.
- Usage predictions / capacity forecasting — not provided.