Kaegis AI: Designing an Enterprise AI Operating System
2026-07-28 · 3 min read
The Enterprise AI Governance Gap
Calling an LLM API is easy. Deploying AI in an enterprise — where it must be auditable, access-controlled, policy-compliant, and observable — is hard. Most teams build this governance infrastructure from scratch for every AI project.
Kaegis AI is my attempt to build it once, correctly, and open-source it.
The Four Problems It Solves
1. Model Access Control
Not every team member should be able to call every AI capability. A customer service rep shouldn't be able to invoke the same LLM endpoint as the data science team. Kaegis wraps LLM API access with role-based control:
@require_role("senior_engineer", "ai_team")
def invoke_gpt4(prompt: str, context: dict) -> str:
"""Only accessible to senior engineers and the AI team."""
return openai_client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": prompt}],
).choices[0].message.content
2. Immutable Audit Trails
Every AI decision must be traceable. Kaegis logs every LLM invocation, tool call, and agent action to an immutable audit store:
@dataclass
class AuditEvent:
event_id: str
timestamp: datetime
user_id: str
role: str
model: str
prompt_hash: str # hash, not raw prompt — for PII compliance
response_hash: str
latency_ms: int
tool_calls: list[ToolCallRecord]
policy_checks: list[PolicyCheckResult]
The prompt and response are stored as hashes by default — you can retrieve the raw content if you have audit access, but the hash is what's logged in the immutable trail.
3. Agentic Governance Workflows
Some AI actions are too high-stakes to be autonomous. Kaegis supports human-in-the-loop approval chains:
@requires_approval(
approvers=["team_lead", "security_officer"],
timeout_hours=24,
on_timeout="reject",
)
async def send_bulk_email_via_ai(campaign: Campaign) -> None:
"""AI-generated email campaigns require two approvers before sending."""
content = await generate_email_content(campaign)
await email_service.send_bulk(content, campaign.recipients)
The agent prepares the action, the approval workflow notifies the approvers, and the action only executes after both approve within 24 hours.
4. Policy Engine
A configurable rule engine that intercepts AI actions and checks them against enterprise policies before execution:
policies = [
Policy(
name="no_pii_in_prompts",
check=lambda prompt: not contains_pii(prompt),
on_violation="block",
message="PII detected in prompt — request blocked.",
),
Policy(
name="rate_limit_per_user",
check=lambda user_id: get_hourly_calls(user_id) < 100,
on_violation="rate_limit",
message="Rate limit exceeded.",
),
Policy(
name="content_safety",
check=lambda response: safety_classifier(response).is_safe,
on_violation="filter",
message="Response filtered by content safety policy.",
),
]
The Observability Dashboard
The AI Operations dashboard shows:
- Active agent sessions — who's running what, for how long
- Model usage breakdown — cost and token consumption by team and model
- Policy violation log — what was blocked, filtered, or rate-limited and why
- Approval queue — pending high-stakes actions waiting for human sign-off
Why Open Source?
Enterprise AI governance is too important to be a proprietary moat. Teams building their own from scratch make the same mistakes — insufficient audit trails, coarse-grained access control, no policy layer. An open standard for enterprise AI OS means the community can audit, extend, and improve the governance layer together.
What's Next
The current version covers the core four. Next priorities:
- Model routing — route to cheaper models when quality requirements allow
- Prompt injection detection — flag adversarial inputs before they reach the LLM
- Compliance presets — GDPR, HIPAA, SOC2 policy bundles pre-configured