KIRA · Early development

Give the agent a result—not a standing credential.

KIRA lets an agent perform a specific operation on a connected service without receiving the destination credential. It checks identity, a short-lived authority envelope, policy, and approval, then returns a filtered result.

Explore the decision path Discuss the problem
Early development Actions, not secrets Fail closed Approval bound to the request
The gap

A token in the agent is a token an attacker can reuse.

Secrets in environment variables, prompts, and plugins authenticate a process. They do not constrain the next action an agent takes, and they survive prompt injection.

Secrets in the agent

Memory, logs, traces, and prompts can expose a reusable GitHub or Slack token.

Approval that does not match the action

A login or a prior “yes” does not authorize a different comment, channel, or repository.

Shared credentials

Revoking one token interrupts every app that used it, and may not stop an agent that already holds it.

Authorization path

Decide at the level of an action.

KIRA evaluates a bounded request. It does not hand a general-purpose credential to the model.

01 / IDENTIFYWho is asking?User, distinct agent identity, and proof of possession
02 / AUTHORIZEIs the envelope still valid?One-level delegation, policy, and a fresh revocation check
03 / APPROVEDoes a person confirm it?The exact request, when the floor or the policy requires it
04 / EXECUTECall only what is allowlistedA separate process holds the destination credential
05 / RETURNGive back a filtered resultRedacted secrets and one correlation id
Control model

Authority follows the request.

An agent can have a legitimate task without holding every capability of its user or its connection.

Distinct agent identity

The agent is not the user, the workload, or the connection.

Short-lived envelope

Operations, resources, lifetime, and use count can only narrow. Depth above one is rejected.

Approval floors

Destructive actions, credential reads, and public writes stay approval-gated. Tenant policy can add approvals. It cannot remove these.

Result guard

Oversize bodies and recognized secret material are withheld before the agent sees them.

Kill switch

New work from an agent, a connection, or the whole deployment can be stopped without rotating unrelated credentials.

Evidence

Identity, delegation, decision, approval, and outcome share one correlation id. Raw credentials are not written to the log.

First adapters

GitHub and Slack first.

The first proof is two constrained adapters, not a generic API proxy. Deleting a repository, reading a GitHub secret, changing branch protection, dispatching a workflow, and posting to a channel the bot has not joined are not catalogue operations.

GitHub

Read an allowlisted repository or pull request. Comment on a pull request, with approval when the repository is public or its visibility is unknown.

Slack

Read recent messages in a channel the bot already belongs to. Draft a message locally. Send stays approval-gated.

Threat model

Assume the agent is compromised.

A compromised agent can send any request the protocol allows. It still cannot read the destination credential, widen its envelope, or run while policy or revocation cannot be checked.

  • Two processes: control and execution.
  • Credential on a pipe for one call, not in the agent environment.
  • Fail closed within a 60-second revocation window.
  • Classified parameters stay in the customer execution boundary.
  • Raw credentials never enter the audit log.
Current status

Specifications are written. The runtime is not shipping yet.

Phase 0 locks the architecture, threat model, and interface specs. The Go library now covers request digests, proof of possession, envelope validation, and fail-closed policy. The gateway, broker, adapters, approval screen, and connection UI come next.

Now

Product spec, threat model, and GitHub/Slack vendor contract. Library tests for identity, envelopes, and policy.

Next

Local two-process package: control plane, execution plane, GitHub and Slack adapters, approval, and audit.

Later

Hybrid deployment: Horizon Labs control plane, customer-hosted execution plane. Not in the first release: a generic HTTP proxy or multi-level sub-agents.

KIRA

What would you require before an agent could act on a connected account?

KIRA is in early development. We are validating identity, approval, brokerage, and evidence with security and platform teams.

Share your requirements Explore the portfolio