Secure by construction.Agents reach your tools only through gates you control.
A person grants an agent access. The agent runs as itself on its own isolated computer. Kortix decides which keys reach that computer, and checks every app call, model call and change it makes.
Choose which agent may run, and grant it access.
Acts as itself, never with your role.
Run a commandChecked by the runtime, before the tool runs.
Reached only after the check.
The runtime checks allow, ask or deny before every tool runs.
One computer per session. Connector logins and Kortix’s model keys never enter it.
Four guarantees. They hold whoever runs the agent.
Its own computerEvery session runs isolated.
- One cloud computer per session
- Its own branch of the repository
- Nothing shared with another session
Its own identityAn agent never borrows your role.
- Grants are deny-by-default
- It cannot grant itself more
- You choose who may run it
Logins stay outConnector logins never enter the computer.
- Kortix makes each app call
- Secrets encrypted per project
- Enforced secrets swapped outside
Checked and recordedRules first, then the audit log.
- Allow, Ask or Block per action
- One approval per exact call
- Every action on record
How it works.One layer at a time.
Identity and roles
People sign in with SAML single sign-on, or a password with two-factor.
Each person holds an account role and a role in each project. Groups grant a project to many people at once.
- Owner
- Admin
- Member
- Manager
- Member
- SAML 2.0 SSO
- SCIM 2.0
- Two-factor
- Session timeout
What enforces each rule. All but one run outside the computer.
| Rule | Enforced by | On deny |
|---|---|---|
| A valid credential | Kortix API | 401 |
| A role that allows the action | Kortix API, IAM | 403, or 404 if hidden |
| The agent’s own permissions | Kortix API, IAM | 403 |
| No self-granted permissions | Kortix API, IAM | 403 agent_grant_escalation |
| Tool, command and path rules | Runtime, inside the computer | Ask waits, deny refuses |
| Connector rules | Connector broker | 202 held, 403 denied |
| No connector calls to private addresses | Connector broker | connector_egress_blocked |
| Enforced secret, listed hosts only | Secret broker | Not swapped |
| Push only to its own branch | Kortix git | 403 |
Merge needs project.gitops.merge | Kortix API | 403 CR_SELF_MERGE_REFUSED |
- A valid credentialKortix API
401 - A role that allows the actionKortix API, IAM
403, or 404 if hidden - The agent’s own permissionsKortix API, IAM
403 - No self-granted permissionsKortix API, IAM
403 agent_grant_escalation - Tool, command and path rulesRuntime, inside the computerAsk waits, deny refuses
- Connector rulesConnector broker
202 held, 403 denied - No connector calls to private addressesConnector broker
connector_egress_blocked - Enforced secret, listed hosts onlySecret brokerNot swapped
- Push only to its own branchKortix git
403 - Merge needs
project.gitops.mergeKortix API403 CR_SELF_MERGE_REFUSED
Run it where your policy says.And read every line of what you run.
Kortix Cloud
We run the control plane and the computers.
Self-hosted
The app, API and database on your server.
Your VPC or on-prem
A single-tenant deployment, scoped with us.
Open source
Read it, fork it, audit it.
SAML 2.0 and SCIM 2.0
Your identity provider decides who gets in.
Any model
Your own provider keys, or Kortix-managed.
- Bring us your review
SOC 2 Type I verified
GDPR operated. We hold no other certification and imply none.
Security questions.Answered from the code.
Anything else, write to the team.
How does an agent authenticate to Kortix?
Each session computer gets KORTIX_TOKEN. It acts as that session’s agent, limited to its project, and ends with the session. It holds the agent’s permissions, never the role of the person who started it.
Which API keys and tokens exist?
Every credential names its kind in its prefix: kortix_pat_ acts as you, kortix_sa_ as a service account, kortix_oat_ as a person who approved an app for 1 hour, kortix_gw_ reaches only the LLM gateway, and kortix_scim_ only directory sync. A missing or invalid token gets 401. A valid one without the permission gets 403.
Can an agent read our connector logins?
No. Kortix stores the login and makes each call itself. The login never enters the session’s computer.
Can code in a session read a secret?
A secret delivered as an environment variable is a real value, so code in the session can read it. Mark a web API key Enforced and the computer gets a stand-in instead. Kortix swaps in the real value outside the computer, only on requests to the hosts you list, and an echoed value comes back as [REDACTED].
Does Kortix filter outbound network traffic?
Not today. A computer can reach the internet directly, for example to install packages. What Kortix enforces: enforced secrets go only to listed hosts, connector calls never reach private addresses, and a copied session token gets no enforced secret outside its own computer.
Who can approve a held action?
A project manager, or the person who started the session. An approval covers one exact call. A held call expires after 24 hours unless the project sets another time, from 5 minutes to 30 days.
Can an agent merge its own changes?
Only with the project.gitops.merge permission. Without it, the merge answers 403. The built-in kortix agent holds every Kortix permission, so remove the merge permission from it to require a person every time.
What does the audit log record, and can we export it?
Who did what, when, how they signed in, and whether it was allowed, refusals included. When an agent acts, the row names the person it acted for. Events stay readable for 90 days and sit in a locked archive to day 365. Reading, exporting and streaming the log is an Enterprise feature.
Do the models keep our data?
Kortix-managed models run only through inference providers with zero data retention. With your own provider key, your agreement with that provider applies.
Where does a self-hosted Kortix run sessions?
The web app, API and database run on your server. Sessions still run on Platinum cloud computers, which call back to your server, so it must be reachable from the internet.