Abu Enterprise · Private deployment · Seat license

AI productivity for every employee. Cost, data and risk under control.

Abu Enterprise brings model access, knowledge permissions, policy audit and usage budgets into one private console. Admins can see who uses AI, how much, and what each person can reach.

a

Unified gateway

Employees never handle the real model keys; every call goes through the enterprise's own gateway.

b

Team controls

Each department has its own budget, rate limit, allowed models and resource grants.

c

Enterprise knowledge

Organization, department and personal knowledge bases that Abu can search and cite when it answers.

d

Private deployment

The console, audit records and governance data are deployed in the enterprise's own environment.

Why Enterprise

Employees are already using AI, and the organization needs to manage it. Once AI reaches a team, the enterprise faces four management problems: cost, access, knowledge and risk.

1

AI spend becomes opaque

Every employee sets up a model key. Who uses AI, how much, and which department is over budget are hard for the enterprise to say.

Enterprise answer

Model calls all go through the enterprise gateway. Admins set budgets, RPM limits and allowed models per department, and review usage and cost in the console.

2

Access boundaries are unclear

Models, knowledge bases, Skills, MCP services and file access live in each person's settings, so the enterprise cannot apply one set of organization rules.

Enterprise answer

Admins draw the boundaries with organizations, departments, roles and pushed policies. The client checks locally before it calls a tool, a Skill or an MCP service.

3

Company knowledge stays buried

Policies, FAQs, product material, project documents and meeting notes sit in files, and AI cannot reliably cite the enterprise's own material.

Enterprise answer

Enterprise knowledge bases support document upload, parsing, chunking, vector search and full-text search. Abu can cite its sources when it answers, and every query is audited.

4

Tool sources and risk are hard to trace

Employees install extensions and connect internal systems on their own. Source, permission, credential, version and usage records are hard for the enterprise to manage in one place.

Enterprise answer

Skills go through upload, scan, review, publishing and signature checks. MCP services go through catalog registration, review, authorization and credential management. When something goes wrong, admins can trace it back.

Product shape

Enterprise adds a governance layer on top of Abu. Employees use AI in the desktop client, and admins configure organization, models, knowledge, tools and governance policies in a private console.

Employee side

Employees keep a familiar workflow

Employees still start tasks, call tools and use Skills in the Abu desktop client. After binding to the enterprise, the client uses enterprise models, enterprise knowledge bases and approved Skills, and shows each employee their own usage and audit information.

Enterprise bindingEnterprise modelsEnterprise knowledgeEnterprise Skills
Abu desktop client showing a finished task
Admin side

Admins configure and trace in one place

Admins configure departments, roles, models, budgets, knowledge bases, Skills, MCP services, policies and audit in the console. Every use of AI in the organization has a boundary and a record, and can be reviewed afterwards.

Access controlCost governanceTool approvalAudit trail

Core enterprise capabilities

Six modules: identity, cost, knowledge, extensions, security and operations. Each one states the problem it solves and what the console actually manages.

Identity

Identity and organization governance

The enterprise's organizations, departments, employees, roles and login methods are all managed in one console.

  • Password, Magic Link, OIDC SSO and desktop Device Flow
  • Organization, department tree, users, roles and permission matrix
  • Invites, pending approvals, sessions and license seats
Gateway

Model gateway and cost controls

Model keys, providers and spend that were scattered among employees come back to the enterprise side for central governance.

  • LiteLLM gateway, multiple providers, encrypted storage of the real keys
  • Department budgets, RPM limits, model allowlists and connectivity tests
  • Tokens, spend and calls by user, department and model
Knowledge

Enterprise knowledge bases

Once enterprise documents are ingested, Abu can search and cite them, and every query leaves an audit record.

  • PDF, Word, HTML, Markdown and plain-text ingestion
  • pgvector vector search + BM25 full-text search + RRF ranking
  • Organization, department and personal scopes with ACLs
Extensions

Trusted Skill and MCP extensions

Internal capabilities and connections to outside tools can all be published, authorized, signature-checked and traced.

  • Skill upload, manifest parsing, security scan, review and publishing
  • Skill ACLs, signature verification and client install records
  • MCP catalog sync, review, ACLs and authorized credential access
Policy

Security policies enforced locally

Organization-level and department-level policies are pushed to the client, which blocks a sensitive action or asks for confirmation before it happens.

  • Tool blocklist, tool confirmation rules, Skill / MCP blocklists
  • File path allowlists and blocklists
  • Enterprise policy hooks run before local tool calls
Ops

Audit, transparency and operations

Admins see the governance outcomes, and employees see which of their own data and usage the enterprise has recorded.

  • Admin audit logs, sensitive-field redaction, usage and cost dashboards
  • Employee transparency page: profile, tokens, audit, usage
  • Quality feedback, diagnostic logs, diagnostic bundles and a self-hosted observability entry

Deployment and delivery

Enterprise starts from a private single-host deployment, with the console deployed separately. The client's enterprise capabilities are delivered through enterprise builds and closed-source modules; private modules never enter the public release.

DeliveryPrivately deployed enterprise consoleThe standard single-host deployment includes Console, Postgres / pgvector, LiteLLM, Nginx, Redis, MinIO and related components; observability and knowledge-base enhancements can be enabled to suit the customer environment.
Scale50 to 2,000 seatsPoCs and teams of 50–500 can start with the default configuration; 500–2,000 seats should tune database, gateway and observability resources; larger environments get a separate high-availability design.
ComplianceRoom left for domestic IT environmentsThe database layer stays close to standard Postgres and images support amd64 / arm64; domestic databases, CPUs and intranet models can be validated against the real customer environment.

Open source and Enterprise

Both editions share the same core, and Enterprise adds organization-level governance. The open-source edition suits individuals and small teams; Enterprise suits organizations that need central control of cost, access, knowledge, extensions and audit.

Open source

A full AI work assistant for one person

A local-first desktop app that uses your own model keys and local configuration. Best for individuals, developers and small-team trials.

Free and open source · Local use · Self-managed
Enterprise

A governable AI platform for a team

Employees keep using Abu while the enterprise manages people, models, budgets, knowledge, extensions, policies and audit in a private console.

Private deployment · Seat license · PoC available
AreaOpen sourceEnterprise
Core work capabilities: both editions use the same Abu client core
AI desktop work assistant
Fully availableChat, task execution, tool calls, Skills and local workspace collaboration.
Fully inheritedThe same desktop experience, plus enterprise binding and governance.
Local-first
IncludedConversations, memory, files and project data stay on the machine by default.
IncludedEnterprise configuration, authorization, audit and usage go to the private console.
Enterprise governance: added by the Enterprise edition
Identity and login
Not includedNo enterprise accounts, single sign-on or member approval.
IncludedPassword, Magic Link, OIDC SSO, client Device Flow and member approval.
Organization, department and role access
Not includedNo organization-level permission system.
IncludedOrganization, department tree, users, roles, permission matrix and resource ACLs.
Model keys and gateway
PersonalUsers enter their own model keys and are responsible for calls and bills.
CentralizedThe real keys are encrypted in the console, and the client calls through the enterprise gateway.
Budgets, rate limits and model allowlists
Not includedNo organization-level central control.
IncludedBudgets, RPM limits and allowed models per department.
Usage and cost dashboards
Not includedNo central enterprise reporting.
IncludedTokens, calls and cost by user, department and model.
Enterprise knowledge bases
Not includedLocal context and personal memory only.
IncludedOrganization, department and personal knowledge bases with hybrid retrieval, citations and ACLs.
Enterprise Skill marketplace
Not includedUsers install and maintain Skills themselves.
IncludedUpload, scan, review, publish, authorize, verify signatures and record installs.
Enterprise MCP management
Not includedUsers configure local MCP services themselves.
IncludedCentral registration, sync, review, authorization and credential management.
Enterprise security policies
Not includedPersonal permission modes and local security settings only.
IncludedTool blocklists, confirmations, extension blocklists and file path policies.
Audit, transparency and diagnostics
Not includedNo central enterprise audit or diagnostics.
IncludedAdmin audit, personal transparency, quality feedback, logs and diagnostic bundles.
Deployment, licensing and branding
Not includedThe open-source repository and public releases only.
IncludedPrivate console, enterprise builds, license, logo / brand color and controlled delivery.

Note: the enterprise MCP client currently provides catalog browsing and authorized credential access, so an enterprise can manage the available tools and the scope of credentials in one place.

PoC / Demo

Want to see how Enterprise fits your team?

Scan the code to add Shawn, Abu's author, on WeChat with the note “Enterprise”, and arrange a demo or a small PoC: settle the deployment, the login method, the model providers, a knowledge-base sample and the first enterprise Skills.

WeChat QR code of Shawn, Abu's author
Scan in WeChat · note “Enterprise”