Security

Built to survive a security review.

An agent that can install anything, call anything and write anywhere is only safe if the walls are real. In Kortix they sit below the agent, in the platform, where a prompt cannot talk its way past them.

One sandbox per session · Connector keys never enter it · Nothing merges itself

Isolation
One sandbox per session
Secrets
AES-256-GCM, key per project
Principals
People and service accounts
Path to main
Change request, default-deny merge
Isolation

Nothing is shared, because nothing is shared.

A session is not a tab in a shared runtime. It is a machine of its own, and the database will not let two sessions have the same one. Separating two of your own sessions is the same mechanism as separating two different customers.

inside one session

  • Its own sandbox, with its own filesystem and its own lifetime
  • A clone of the project repo on a branch named after the session
  • The tools, dependencies and runtime the project declares
  • Only the secrets that session is granted, placed there at boot
sandbox

never crosses in

  • Another session — same project, same team, or another customer
  • Connector credentials, which are resolved server-side
  • Kortix’s own upstream provider keys, which no sandbox may hold
  • Write access to main; a session can only propose
One sandbox per session
A session gets exactly one machine, enforced in the database rather than by convention. Sessions never share a filesystem with each other, and the machine has a bounded lifetime rather than living forever.
microVM where you ask for it
On Kortix’s own Platinum compute a sandbox is a Cloud Hypervisor microVM. Daytona and E2B are also supported. The provider is a deployment choice, and we will tell you which one you are on rather than blur them together.
One branch per session
The machine clones the repo and cuts a branch named after the session. Every edit and commit that session makes lives on that branch and nowhere else.
Disposable by design
The machine is not precious. A bad install or a wiped directory goes away with it. Only what the session commits survives.
Credentials

A key is granted to a session, not pasted into a prompt.

A tool needs a real credential to do real work, so the honest question is not whether the machine ever holds one. It is which machine holds which key, who decided that, and what never gets in at all.

  1. 01

    Stored

    Encrypted with AES-256-GCM under a key derived per project.

  2. 02

    Granted

    The person’s role and the agent’s declared grant must both allow it.

  3. 03

    Delivered

    Placed in the session at boot, by name, on tmpfs at mode 0600.

  4. 04

    Used

    The tool reads it from the environment. It is not written into the prompt.

  5. 05

    Shredded

    The file is wiped on shutdown and the machine is destroyed with it.

Encrypted per project
Values are sealed with AES-256-GCM. The key is derived per project with HKDF-SHA256, so one project’s ciphertext cannot be opened with another project’s key. The envelope is versioned, so the scheme can move forward without a flag day.
Two gates, not one
An agent declares in kortix.yaml which secrets it may ever be given. A session receives the intersection of that grant and the role of the person who started it — so an agent can never reach past its own declaration, or past the human behind it.
Connector credentials never enter the machine
3,000+ apps in a click, plus MCP, OpenAPI, GraphQL and raw HTTP. The third-party credential is held and resolved server-side; the machine holds one scoped Kortix token and calls through it. The same rule covers Kortix’s own provider keys, which no sandbox is allowed to hold.
What we will not claim
A runtime secret a session is granted is a real environment value inside that session, because that is how a tool uses it. We would rather say so than tell you it is invisible. The controls that matter are the two gates above, and the fact that the machine is destroyed with it.
Identity & permissions

An agent is a principal, not a loophole.

Most AI tools give the agent whatever the person who started it can reach. Kortix does not. An agent identity carries its own policies, evaluated on their own, so it cannot inherit its way up to something you never granted it.

principal

persongroupservice account
may

resource type

accountprojectsandboxtriggerchannelmembergroup

Permissions attach to a principal, for an action, on a resource type.

Built-in roles — on every plan

account

  • Owner. Full account control.
  • Admin. Manage members, groups, roles and tokens.
  • Member. Baseline account membership.

project

  • Manager. Full project control, including members and delete.
  • Editor. Create and edit project content, run sessions.
  • Member. Read, run sessions and fire triggers. The project floor role.

Enterprise

  • SAML 2.0 SSO. Provider config, just-in-time provisioning, and group-claim mapping. One identity provider per account today.
  • SCIM 2.0. Directory sync over /scim/v2, with tokens you mint and revoke. Built against Okta and Microsoft Entra.
  • Custom roles. Your own roles and fine-grained policy bindings beyond the presets.
  • Groups. Grant to a group once instead of to twenty people twenty times.

Available on Enterprise, and on a self-hosted instance with an Enterprise licence. The built-in roles above are free on every plan.

Service accounts

A service account is a first-class machine identity the account owns, not a human token wearing a hat. Policies attach to it directly, and a request it makes is evaluated purely against its own policies — it never inherits the reach of whoever created it.

Scope a team to specific agents

A person or a group can be narrowed to named agents and skills inside a project: marketing may use this agent and that skill, and nothing else. Anything you leave unscoped stays project-wide, so narrowing is something you opt into rather than something you have to undo.

Control

Decide what needs a human before it happens.

Approval is not a setting buried in an admin panel. It is a block in kortix.yaml, versioned with everything else, that says which tool calls run, which stop for a person, and which are refused outright.

kortix.yaml
# reads run; writes and destructive calls stop for a humanpolicy:  default_mode: risk policies:  # a name-only rule cannot gate the target — conditions can  - match: gmail.send_email    action: require_approval    conditions:      - arg: to        match: /@example\.com$/   # anything else through this tool is refused outright  - match: gmail.send_email    action: block   # whole connectors can be gated with one glob  - match: stripe.*    action: require_approval
  • Three actions

    always_run, require_approval, block. A rule matches a glob over fully-qualified tool paths, so one line can cover a single call or a whole connector.

  • Gate the target, not just the tool

    "May the agent send email" is not a guardrail. Conditions match the arguments, so the rule can be "only to these addresses". An argument that cannot be evaluated fails closed.

  • No blanket "allow always"

    Every gated call is approved on its own, with its arguments in front of you. There is no session-wide grant a later call with different arguments can hide behind — that shortcut was removed at the enforcement point, not just from the UI.

  • Set the default you want

    default_mode: risk makes reads run and sends writes and destructive calls to a person. A project with no policy block keeps the permissive legacy default, so set this explicitly.

How work lands

Opening a change request and merging it are different powers.

An agent can write as much as it likes on its own branch. Landing that work on main is a separate capability it does not have unless you hand it over deliberately — and handing it over is itself a change someone has to approve.

  1. 00

    The session works on its branch

    Every edit lands on the branch cut for that session. Nothing the agent does is visible to any other session, or to main.

  2. 01

    It commits and opens a change request

    When the agent wants something to survive the machine, it commits and opens a change request pointed at main. That is the only door.

  3. 02

    A person reads the diff

    A change request is a diff. An agent rewriting its own prompt is reviewed the same way a code change is — because it is one. A change request whose manifest does not validate cannot merge at all.

  4. 03

    Merging is default-deny

    Merge is a capability of its own, refused to every agent unless an admin grants it. That grant lives in kortix.yaml — so an agent cannot widen its own reach without a change request someone else approves.

Audit

Recording is never the thing you pay for.

Every account action and every agent action is captured on every plan. The plan decides who may read, export, or stream that record — not whether it exists.

Account audit log
Membership, roles, policies, tokens, groups and IAM changes are recorded as they happen, on every plan.
Every gated tool call
Each call an agent makes through a connector is a row: the action, the actor, the session, the risk class, whether it ran, was denied, or waited for a person, and who resolved it. Arguments are stored as a preview built by subtraction, so a credential cannot end up in the record.
Export it or stream it
Pull the log as CSV or JSONL, or have every event posted to your own SIEM over a webhook signed with HMAC-SHA256. Read, export and streaming are Enterprise entitlements.
The repo is its own history
Configuration is files. Who changed which agent, which skill and which policy, and who approved it, is git history you already know how to read.
Deployment & posture

Run it where your policy says it has to run.

The same product ships as managed cloud, as a stack inside your own network, and as an isolated deployment. Open source, so what you are trusting is code you can read.

Kortix Cloud

The managed service. We run the control plane and the compute; you run the company.

Self-hosted

One Docker Compose stack on your box, from the same images the managed cloud runs. Your database and your files sit on disk you control.

Your VPC or on-prem

A single-tenant deployment inside your own network. Air-gapped and other isolated topologies are scoped with us rather than self-served.

Where we actually stand

SOC 2 Type I
In progress
SOC 2 Type II
In progress
GDPR
Operated

We do not hold ISO 27001 or HIPAA, and we do not imply that we do. When a report lands, this line changes that day and not before.

Responsible disclosure

Found something? Tell us privately.

Please do not open a public issue for a vulnerability. Mail the security contact with the affected version or commit, the reproduction, and the impact.

security contact

security@kortix.com

We credit reporters who want it, once a fix has shipped.

Acknowledgement
Within 3 business days
Triage & severity
Within 5 business days
Coordinated disclosure
Agreed with you, 90 days by default
Talk to us

Bring us your security review.

Send the questionnaire, the architecture questions, the deployment constraints. We would rather answer them properly than have you guess from a marketing page.

Kortix Security | Kortix