Kakunin

Kakunin is a cryptographic identity and behavioral monitoring platform that brings Know Your Customer (KYC) compliance to AI agents, issuing X.509 certificates with scoped permissions and generating regulator-ready audit trails.

What is Kakunin?

Kakunin provides a trust layer for autonomous AI agents in regulated industries. Its core function is to certify agent identity via X.509 certificates (RSA-2048, issued through AWS KMS), stream every agent action as an immutable event (1,000 events/second, p99 200ms latency), score agent behavior on a rolling 30-day window, and auto-revoke certificates when risk exceeds a configurable threshold (default 0.85, enforcement under 60 seconds). The platform outputs compliance reports mapped to MiCA Articles 67–75, EU AI Act Annex III, NIST AI RMF, and ISO 27001—delivered as signed PDF and JSON. It is a cloud-hosted, API-first product built by Kakunin (company details not specified on page) and accessible via REST API or TypeScript SDK.

Key Features

• X.509 Cryptographic Identity — Bind agent identity, operator, permitted actions, and financial scope (e.g., maximum transaction size) into tamper-proof certificates issued through AWS KMS. Private keys never leave KMS.
• Real-Time Event Streaming — Ingest agent actions at 1,000 events/second with p99 200ms latency. Each event is timestamped, signed, and stored in an immutable append-only audit log (WORM-enforced).
• Behavioral Risk Scoring — Continuous 30-day rolling risk score per agent. When the average crosses the 0.85 threshold (configurable), the certificate is cryptographically auto-revoked under 60 seconds, triggering webhooks and email alerts.
• Content-Risk Scoring — Evaluate agent output (not just actions) for prohibited content, prompt injections, or off-scope language per EU AI Act Art. 5. Scores (0–1) block high-risk responses and log to the audit trail.
• Compliance Reports — One API call generates a regulator-ready report mapped to MiCA, EU AI Act, NIST AI RMF, ISO 27001, and more. Output formats: signed PDF and JSON.
• Public Verification Endpoint — Anyone (regulator, counterparty) can verify an agent's identity and revocation history via api.kakunin.ai/v1/verify/{serial} with no authentication required. Returns status, scope, operator, model hash, and validity in under 500ms globally cached.
• AgentMail — Every certified agent receives a verifiable email inbox (e.g., [email protected]) tied to its identity. Inbound and outbound messages are automatically logged to the immutable audit trail.
• API-First SDK — Fully typed TypeScript SDK with Zod-validated responses, automatic retry, webhook HMAC verification, sandbox mode (100 certs/day free), and OTLP export to Datadog, Grafana, Honeycomb, and Splunk.

Who is it for?

• Compliance Officers — Generate regulator-ready audit trails and compliance reports (PDF+JSON) mapped to MiCA, EU AI Act, NIST AI RMF, and ISO 27001 with one API call.
• CTOs and Engineering Leads — Integrate via decorators like @verify_agent_scope and short-lived ephemeral certificates with under 5ms verification latency.
• API Platform Engineers — Validate agent scope at the edge gateway with sub-2ms latency using X.509 credentials to block unauthorized bots.
• AI Startup Founders — Answer “how do you govern your agent?” in enterprise security reviews with cryptographic identity, behavioral monitoring, and on-demand compliance reports.

Use cases

• Financial services – Trading bots: Exchanges verify bot identity cryptographically before executing trades; behavioral monitoring catches compromised agents in milliseconds.
• Healthcare – Diagnostic assistants on EHR: Permitted actions encoded in the certificate; read-only agents physically cannot mutate records, and HIPAA audit trail is automatic.
• Legal – Document-review agents: Cryptographic chain of custody for every file an AI parsed inside M&A data rooms; court-admissible audit trail by default.
• Public sector – Visa and tax processing: EU AI Act–compliant reporting for citizen-facing agent decisions, with transparency built in.

How does it work?

1. Register & Certify – Call kkn.agents.certify() to issue an X.509 certificate via AWS KMS in under 3 seconds, binding agent identity, operator, and permitted actions.
2. Stream Events – Every agent action (API call, decision, transaction) hits the ingest endpoint. Immutable audit log builds automatically at 1,000 events/s.
3. Score & Watch – Behavioral drift detection runs continuously; content-risk scoring evaluates what the agent said. Rolling 30-day trust score with auto-revoke at 0.85 threshold.
4. Prove & Report – One API call generates a regulator-ready compliance report mapped to NIST AI RMF, MiCA, ISO 27001, or any framework. Delivered as signed PDF + JSON.

Pros and cons

Pros

• Only platform combining cryptographic identity, behavioral monitoring, and content-risk scoring for agents.
• Mature, regulator-recognized X.509 standard (30+ years of use in global finance).
• Sub-60-second auto-revocation with webhook notifications.

Cons

• No self-hosted option at V1.0 (cloud-only; enterprise dedicated Supabase instance available for data residency).
• Requires continuous event ingestion to maintain risk scoring; agents outside the network lack monitoring.

Pricing

Free 30-day trial on every plan (credit card required, no charge until day 31). Paid tiers start after trial; exact pricing not publicly listed. Sandbox mode offers 100 free certificates per day.

FAQ

Does Kakunin replace human KYC tools like Jumio or Onfido?

No. Kakunin verifies AI agents, not humans. It is complementary to human KYC and expected to integrate with incumbents. Human KYC tools verify people; Kakunin verifies agent identity, behavior, and model lineage.

Is Kakunin a model governance tool like Credo AI?

No. Model governance scores the model pre-deployment; Kakunin issues identity to a specific deployed agent and watches its runtime behavior. Together they cover both halves of EU AI Act obligations.

What happens when an agent misbehaves?

A rolling 30-day risk score is tracked continuously. When the average crosses the 0.85 threshold (configurable), the certificate is auto-revoked under 60 seconds, a webhook fires, and the compliance officer receives an email. All steps are written to the audit log.

Where are private keys stored?

In AWS KMS only. Kakunin never has access to plaintext private key material; signing operations are performed by KMS directly.

Can I self-host Kakunin?

Not at V1.0. Self-hosting would undermine the network effect of a single trusted certificate authority. Enterprise customers can request a dedicated Supabase instance for data residency.

How does the free trial work?

30-day free trial on every plan. Credit card is required but you are not charged until day 31. Kakunin provisions your tenant, certifies first 5 agents in a working session, wires your event stream, and delivers the first compliance report within 30 days.