Start Building

Secured Enterprise Agent Platform

Every agent. One secure plane.

Kimss is the control plane for governed AI agents: portable definitions, tenant isolation, audit-ready telemetry, and model routing on Azure AI Foundry — or your own OpenAI-compatible endpoint. Build your AI product on Kimss; the runtime is yours to choose.

Start Building Watch overview Why Kimss Architecture Azure Marketplace

Powered by secure Azure infrastructure — Managed Identity, no static credentials.

control plane story

From shadow agents to a governed plane

Four steps every board asks about — discovery, risk, the gateway, and audit-ready outcomes. Select a step or scroll; the console shows the data Kimss surfaces.

kimss://audit/discovery LIVE

Agent discovery

How many agents run here — and who owns them?

Detected 0
Unowned 0
Workspaces 0
  • Cursor / Claude Code coding agents
  • Copilot Studio assistance
  • n8n / Make autonomous
  • Azure AI Foundry enterprise
overview

What is Kimss

A two-minute walkthrough: Studio for agents, then the Admin Console that governs fleet, models, spend, audit, alerts, roles, and traffic — with one key for developers.

~2:16 · 1080p Read the docs · Create a workspace
platform

Why Kimss?

A single control plane for model and agent traffic: operators govern workspaces, billing, and audit sinks while developers keep one API key from prototype through production. CTO brief →

sdk

Zero-Friction SDK

The Kimss Python SDK exposes chat and agent calls against Kimss-hosted endpoints so your application does not embed long-lived provider keys. Install once, configure a workspace key, and call models through the same client in CI, local, and production.

gateway

One Gateway. Two Playgrounds.

Multiplex fast text-inference and full agentic flows through one authenticated edge. Routing targets Foundry projects per workspace; the gateway enforces model allow lists, spend limits, and shared trace identifiers.

control_plane

Enterprise Control, Wired

Billing profiles, Redis credit pools, execution logs, and optional Log Analytics export. Managed Identity for Foundry — soft and hard spend caps without a separate metering plane.

azure_security

Azure-Native Security

Managed Identity for Foundry and Key Vault. Human access via Microsoft Entra ID — zero-trust for the AI gateway path. Security & architecture →

tenancy

Strict Tenant Isolation

Workspace and Entra keys partition PostgreSQL so one customer cannot read another's agents, sessions, or billing artifacts. Isolation is enforced server-side.

data_plane

Zero-Retention Execution

Kimss routes prompts to customer-scoped Foundry projects; operational logs focus on metadata — tokens, latency, identifiers — not on retraining from customer content.

customer success

Building a sovereign digital workforce on Kimss.

Modern teams want AI that ships work — reviews code, fixes incidents, drafts content — with governance: one model gateway, auditable actions, and human approval where it matters.

worksfusion runs a production Digital Employee fleet headless on Azure: specialized agents orchestrated by LangGraph with Postgres checkpoints, cognition through KimssClient, and tools through a self-hosted MCP server.

Sovereign by design All model and agent calls flow through Kimss workspaces — no shadow OpenAI or Azure AI clients.
Safe GitOps Workers open PRs to staging; only the Guardian merges. Production branches are protected at the tool layer.
Workforce that scales HR hiring packages define new workers as JSON; dynamic workers execute without redeploying per role.
Enterprise-ready ops Microsoft Entra ID, Key Vault, private PostgreSQL, and human-in-the-loop approval in Slack.
Read the full story

Digital worker fleet

Slack ingress, Kimss cognition, MCP tools, Airflow orchestration.

Production
1

Slack → Digital Employees

Command Hub routes natural language to the right LangGraph Digital Employee.

2

Employees → Kimss + MCP

Reasoning via KimssClient; Git, GitHub, and telemetry via Entra-authenticated MCP.

3

Checkpoints + human approval

PostgreSQL holds durable run state; sensitive actions wait for Slack sign-off.

product

Run the platform from one dashboard

Agents, governed integrations, Developer Hub with live telemetry, plans and billing, and usage — in a single control plane.

AI agents overview Developer Hub - governed integration console Manage agents dashboard Models catalog Plans and billing Usage reporting dashboard
architecture

How Kimss works

Client → optional Azure APIM → FastAPI core → PostgreSQL & Redis → Azure AI Foundry. Gateway logs, token metrics, and application audit hooks share identifiers end to end.

Client Layer
APP
Azure APIM
Gateway
FastAPI Core
Python App
Data Layer
PG & Redis
AI Foundry
Agents
System Overview
Select any stage in the pipeline above to see how Kimss processes, secures, and tracks your AI interactions.
billing

Transparent multi-tenant billing

Azure Monitor and Log Analytics provide immutable, regulation-ready audit trails at the API gateway. Credit pools enforce spend limits per tenant in real time via Redis.

Live Tenant Usage Tracking

Tenant ID: Acme_Corp
Current Token Usage 0 / 5,000,000
Soft Limit (80%)
PostgreSQL Logged Redis Cache Enforced
compliance

Built for regulated industries

Kimss is architected on Azure-native compliance primitives you can cite in procurement questionnaires. This is our technical design posture — not legal advice; your counsel validates fit for your sector.

EU AI Act — Article 12

Automatic, immutable AI logs

API Management diagnostic settings feed Log Analytics for gateway-level records. Token metrics use azure-openai-emit-token-metric with per-tenant dimensions for cost and governance dashboards.

GDPR — Data residency

Regional AI processing

Tenant slug maps to the correct Azure AI Foundry region via APIM backends and Named Values — no client-supplied region header. Project paths stay under /api/projects/{tenant}/… for a consistent data model.

Zero-trust

Managed identity to models

Gateway backends authenticate to Foundry with Managed Identity — no long-lived API keys in APIM policies for model traffic. Optional SDK-side PII scrubbing before traffic reaches the gateway.

Request our compliance pack
tooling

Dynamic tool registry

Equip your agents with custom, secure functions. Kimss strictly enforces access control, ensuring agents only call registered backend tools.

get_project_quote
Fetches dynamic pricing for clients
{
  "agent_id": "agt_19283",
  "action": "execute_tool",
  "parameters": { "scope": "enterprise" }
}
get_order_status
Queries live DB for logistics tracking
{
  "agent_id": "agt_55421",
  "action": "execute_tool",
  "parameters": { "order_id": "ORD-882" }
}
fetch_audit_logs
Admin tool for compliance reporting
{
  "role": "admin",
  "action": "telemetry_recent",
  "parameters": { "limit": "100" }
}

Ship agents your auditors approve.

One Kimss key from your IDE to production — tenant isolation, audit-ready telemetry, and Managed Identity included from the first call.

Start Building Documentation

Powered by secure Azure infrastructure.