Kin Agent — one of your own
console Get early access

SECURITY

Security that's built in, not just promised.

Most software asks you to trust it. Kin Agent is built so you don't have to. The controls below aren't policies someone follows — they're walls built into how Kin Agent works. There is no code path around them.

Structural, not disciplinary.

There are two ways to make software safe. One is rules the software is asked to follow — and might not. The other is walls: build the system so the unsafe path doesn't exist. Kin is built the second way wherever it matters most. Where we use rules, we say so. Where we built walls, we can prove it.

Works within your rules

A Kin Agent works on its own inside the boundaries you agree. The moment something falls outside them, it stops and asks you.

Sensitive information is gated

Everything a Kin Agent sends out is checked first. Anything sensitive waits at the gate for your yes.

A machine of your company's own

Your Kin Agents work on a machine dedicated to your company — each Kin Agent with its own workspace and its own private network on it. No other company's agents share that machine — not by policy, but because no shared path exists.

Logins stay in the vault

Your passwords live in a locked vault. A Kin Agent is signed in for a task and signed out after — it never sees or holds your password.

Everything on the record

Every action a Kin Agent takes is written to a permanent record — what it did, when, and who approved it. Check it anytime. Nothing is off the books.

You see it before it counts

Every new skill starts in a dry run — your Kin Agent does the real work in rehearsal, and you review it before anything goes live. Once it's on the job, anything sensitive still stops and waits for your yes, and every step lands on the record.

EVERY ACTION: GATED → LOGGED · EVERYTHING SENSITIVE: HELD → APPROVED

When you're ready, ask us the hard questions. We built Kin Agent to answer them with proof, not promises.

FOR YOUR IT TEAM

How it's actually built.

Below is the real architecture — the same picture we draw for a CIO. Plain language stays; the parentheses carry the precise terms.

01One company, one dedicated machine

YOUR MACHINE MAYA ARJUN RIYA a dedicated machine per company own workspace and private network per Kin Agent CONTROL PLANE operations only — walled off from your business data row-level isolation in the database (organization + agent) other companies — separate machines, separate everything

Every company gets its own dedicated machine — your Kin Agents work there and nowhere else, each in its own workspace with its own private network. No other company's agents touch that machine, because no connecting path exists. Isolation is enforced again inside the database (row-level security keyed to organization and agent), so a fault in one layer doesn't open the next. The platform layer that operates the machines is itself walled off from your business data — and isolated per organization all the way down.

02Your logins never enter the machine where your Kin Agents work

CONTROL PLANE credentials vaulted WHERE KIN AGENTS WORK browser session signed-in session injected at the gateway · never stored where the Kin Agents work password never crosses HELD sensitive action — waits for approval agent proposes · Control Plane disposes

Passwords live in a vault the agent has no access to. When a task needs a login, the platform signs the agent’s session in at the boundary — the password itself never enters the machine where your Kin Agents work, is never visible to the AI, and is never stored where the agent works. An agent cannot leak what it never held. Anything designated sensitive stops and waits for a human yes before it happens.

03One gate for everything that leaves

WHERE KIN AGENTS WORK sealed on every side no second door — by construction web email messages uploads EGRESS GATEWAY policy record hold within rules — proceeds HELD sensitive — held for your approval single controlled exit (inspecting gateway) everything that leaves lands on the record

Everything a Kin Agent sends out — every web request, message, file — passes through one gate the platform controls. The gate applies your rules and records the result. Sensitive payloads wait at the gate for approval. There is no other route out of the machine where your Kin Agents work; the gate isn’t a checkpoint on one road, it’s the only road.

3bWhat the AI is allowed to see

your passwords task content sensitive actions the gate never present — vaulted outside where Kin Agents work goes to the AI through the one gate, on the record HELD held for your approval before they happen AI MODEL Resident & Sovereign tiers add payload classification — content checked against your rules before anything leaves, with routine thinking on your own hardware

The AI inside a Kin Agent only ever sees what the structure lets through. Your passwords can’t reach it — they’re vaulted outside the machines where Kin Agents work, and are never part of what the AI reads. Everything that goes out passes one gate and lands on the record, and any action that commits you to something waits for your yes. On the Resident and Sovereign tiers, the gate goes further: content itself is classified against your rules before anything leaves, and routine thinking happens on hardware you own.

04The record, and what waits for you

task assigned agent works sensitive steps wait for your yes agent completes the task and responds anything sensitive stops and waits for a human yes who · what · when · on whose approval auditable any time append-only record every approval attributed

Anything sensitive waits for a human yes before it happens. And every action — the Kin Agent’s and yours — is written to a permanent record: what was done, when, and on whose approval. Any day, any task, any decision can be audited after the fact.

Ask us the hard questions.

How do you know the agent can't exfiltrate data? What happens when it's wrong? Who can see what? These are the right questions — and the architecture above is built to answer them with proof, not policy. Bring your IT team; we'll walk them through it.

Hire a Kin Agent, onboard it, and watch it dry-run your real work — free. You pay only when you put it on the job.