Let agents act. Keep the controls.
OrchStack is the operating system for the AI-native company. At its core is OrchKernel: one gate between every agent and everything it touches, on your infrastructure.
What security asks before agents act
Once an agent can send email, issue refunds or change records, two questions matter. Who is it acting for, and who said it could?
Who holds the keys?
Who approved it?
What does it know?
Can you prove it?
Every action passes one gate
Agents propose. Rules decide. The kernel applies. The gate runs the same checks, in the same order, for every agent.
- 01 Kill switches
- Has someone switched this off?
- 02 Arguments
- Are the inputs valid for this tool?
- 03 Delegation
- Does the person it acts for allow this?
- 04 Budgets
- Is there budget left for the agent, team and task?
- 05 Rules
- Does a company rule allow, hold or deny it?
- 06 Risk against trust
- Is the risk within this agent's trust tier?
Example: a $240 refund waits for an admin, who sees the exact payload. Once approved, it runs exactly once.
Delegation only narrows
Trust is earned
Budgets and kill switches
Proof an auditor can check
Know what happened, show it, and change the rules the way you change code.
A tamper-evident log
People, agents and systems write to one event log. Each event is chained to the one before, and ok audit verify names the first break.
Replay any run
Any agent run can be replayed from the log, so a question about what happened has a checkable answer.
Policy as code
Export rules, budgets and kill switches to Git. Check them in CI and apply changes through review.
Policy dry run
Ask the kernel to explain what a rule change would allow, hold or deny before you apply it.
Runs where your data lives
You host the kernel. You pick the models. You decide which hosts it may call.
Self-hosted
One binary and one database file, with Docker and Kubernetes assets.
Your model providers
Each model is cleared for a data class. Restricted data reaches only the models cleared for it.
Sealed secrets
Vendor credentials are sealed at rest. Agents never hold them; the kernel runs each approved action with its own credentials.
Checked outbound traffic
Every outbound request is checked against your list of allowed hosts.
Agents you already use
Claude, Cursor or your own code get their own identity and act only through the gate.
Multi-tenant hosting
A kernel per tenant, under a commercial license from OrchStack.
Enterprise questions
Put one real workflow through the gate
Design partners run OrchKernel on their own systems, with a direct line to the engineers building it.