Learn how Bob on-premises uses backend and frontend entitlements to control Premium Package deployment and user access.

Bob on-premises uses a two-layer entitlement model to manage Premium Package capabilities. You enable and deploy Premium Package workloads through installation configuration (backend entitlement). A Bob administrator then grants user access to the installed capabilities (frontend entitlement).

Note:

All available Premium Package add-ons extend Bob with IBM Z application modernization capabilities. For information about what each add-on provides, see Z Understand and Refactor.

Entitlement model overview

Entitlement layer	Administrator	Purpose
Backend entitlement	Cluster administrator	Controls which Premium Package workloads are installed and available in the deployment.
Frontend entitlement	Bob administrator	Controls which users can access installed Premium Package capabilities.

A Premium Package can be assigned to users only after the corresponding workload is installed and operational in the cluster.

Backend entitlements

Backend entitlements determine which optional Bob components are deployed. Configure these settings in config.yaml before installation or during an upgrade.

Add-on	Configuration flag	Dependency	Purpose
Bob Premium Package for Z (RAG)	`rag.enabled: true`	None	Provides RAG over a Z/I-specific corpus and z/OS knowledge capabilities.
Bob Premium Package for Z (Proxy)	`zProxy.enabled: true`	Requires `rag.enabled: true`	Provides a proxy layer for z/OS service traffic between the API gateway and Z RAG services.
Bob Premium Package for Z Understand	`zUnderstand.enabled: true`	None	Provides automated analysis and understanding of z/OS application assets.

You must explicitly enable each add-on before installation. To enable an add-on after deployment, update the configuration and perform a supported upgrade or redeployment procedure.

Important:

Premium Packages that are not enabled at the infrastructure layer are not deployed to the cluster and cannot be assigned to users.

Note:

Each enabled add-on deploys additional workloads and increases cluster resource consumption. Before enabling add-ons, review the cluster sizing guidance and ensure that adequate cluster capacity is available.

Frontend entitlements

After an add-on is installed and operational, a Bob administrator can grant access to the corresponding Premium Package through the Bob Admin UI. Frontend entitlements control user access without affecting the underlying deployment.

To assign Premium Package access:

Locate the user account.

Assign the appropriate Premium Package entitlement.

Save the changes.

Users can access Premium Package capabilities only when:

The corresponding add-on is installed in the cluster.

The user has been granted the required entitlement.

Entitlement workflow

The following sequence describes how Premium Package access is enabled end to end:

You enable the required add-on in config.yaml.

The add-on is installed during deployment or upgrade.

The workload becomes available in the Bob environment.

A Bob administrator assigns the corresponding Premium Package entitlement to users.

Eligible users can access the Premium Package features.

Relationship between backend and frontend entitlements

Backend and frontend entitlements are independent but complementary:

Backend entitlements determine what capabilities are available in the deployment.

Frontend entitlements determine who can use those capabilities.

Installing an add-on does not automatically grant user access.

Assigning a Premium Package entitlement does not install the underlying workload.

Both layers must be configured before users can access Premium Package functionality.

Security considerations

When managing Premium Package access and user entitlements, follow these security recommendations:

Restrict access to the bob-keycloak-initial-admin Kubernetes secret to cluster administrators only. Do not change the password stored in this secret. The operator uses these credentials for automated reconciliation, and changing the password will break operator functionality.

Always perform user and entitlement management in the bob realm in Keycloak.

Do not use the master realm for Bob administration. It is reserved for Keycloak administrative functions.

Do not create additional realms or clients in Keycloak; Bob relies on an operator-managed realm configuration.

Managing entitlements