Early AccessFoundation
API-to-AI action conversion
Convert existing APIs and OpenAPI definitions into agent-ready actions and manifests.
Runtime GovernanceKeyRunner 2.0 notes
KeyRunner Roadmap
From governed API execution to the enterprise control plane for AI agents.
Product north star
The runtime governance control plane for enterprise AI agents
Discover agents, understand what they can access, authorize and execute actions safely, observe outcomes and spend, continuously optimize permissions, and revoke risky capabilities in real time.
Discover→
Understand→
Authorize→
Execute→
Observe→
Optimize→
Revoke
Roadmap controls
Filter delivery commitments by status, priority, ownership area, and window.
48 of 48 roadmap itemsPublic delivery evidence is linked on released items.
Current Foundation
Available to qualified teams through the KeyRunner early access program.
11 itemsRequest access
Early AccessFoundation
Runtime policy enforcement
Apply governance controls before actions are exposed or executed.
Runtime GovernanceKeyRunner 2.0 notes
Early AccessFoundation
Runtime secret injection
Keep credentials out of agents and inject them only at execution time.
CredentialsKeyRunner 2.0 notes
Early AccessFoundation
Sensitive data redaction
Redact PII, PHI, PCI, secrets, keys, and other sensitive data before it reaches a model.
Data ProtectionKeyRunner 2.0 notes
Early AccessFoundation
Human approvals
Require human approval for sensitive or high-risk actions.
Runtime GovernanceKeyRunner 2.0 notes
Early AccessFoundation
Execution auditability
Maintain execution history and governance evidence for actions and policy decisions.
ComplianceKeyRunner 2.0 notes
Early AccessFoundation
Agent Graph
Map agents, identities, policies, tools, APIs, and governed relationships.
Discovery and GraphView product capability
Early AccessFoundation
Agent Fleet
Provide central visibility and operational control across enterprise agents.
Discovery and GraphView product capability
Early AccessFoundation
Spend management foundation
Track and govern AI usage and costs.
FinOpsView product capability
Early AccessFoundation
Compliance and analytics foundation
Provide governance insights, evidence, and operational analytics.
ComplianceView product capability
Early AccessFoundation
Agent kill switch
Immediately disable an agent, capability, tool, or execution path.
Runtime GovernanceView governance scenarios
Delivered
10 items
ReleasedFoundation
Node.js SDK for KeyRunner
Official SDK to integrate KeyRunner into Node.js applications.
Developer PlatformView npm package
ReleasedFoundation
Datadog integration
Forward audit and access logs to Datadog for observability.
IntegrationsView integrations
ReleasedFoundation
Playground V2
Conditions, loops, scripts, test-result export, and enhanced request-flow testing.
Developer PlatformView v1.0.88
ReleasedFoundation
SIEM integration
Export enterprise audit events to SIEM tools such as Splunk and Elastic.
IntegrationsView integrations
ReleasedIntegration
Kafka integration
First-class Kafka connections, message production and consumption, topic handling, SASL authentication, AWS MSK IAM, and SSL support.
IntegrationsView v1.0.94
ReleasedIntegration
1Password integration
Credential-management integration for smoother secret retrieval and use.
IntegrationsView v1.0.92
ReleasedFoundation
Published mock servers
Publish private and public mock servers with explicit access tokens, rotation, and revocation.
Developer PlatformView v1.0.93
ReleasedFoundation
Response schema validation and type generation
Compare actual responses with expected schemas and generate typed definitions across supported languages.
Developer PlatformView v1.0.97
ReleasedIntegration
Secrets ecosystem expansion
Secure credential and key access across AWS KMS, HashiCorp Vault, 1Password, AWS Secrets Manager, and Google Cloud KMS.
CredentialsView supported integrations
ReleasedIntegration
Kubernetes agent and workload identity
Run and identify Kubernetes-based agents and workloads as governed identities within KeyRunner.
IntegrationsView supported integrations
Next Release
5 items
PlannedP0
Shadow Agent and MCP Discovery MVP
Discover unmanaged agents, MCP servers, tools, OAuth grants, service identities, and AI workloads. Show governed, unmanaged, and drifting capabilities.
Discovery and Graph
PlannedP0
Human to Agent to Tool Attribution
Create a complete identity chain from the initiating human through agent and workload identity to policy, tool, target system, and result.
Identity and Attribution
PlannedP0
Agent Graph relationship expansion
Show human, agent, identity, tool, API, and system relationships in a single governed graph.
Discovery and Graph
PlannedP0
Fleet governance status
Add explicit governed, unmanaged, and high-risk status across Agent Fleet.
Discovery and Graph
PlannedP0
Graph and Fleet kill-switch controls
Expose agent and capability revocation directly from Agent Graph and Agent Fleet.
Runtime Governance
Control Plane Launch
2 items
PlannedP0
Governance analytics upgrade
Control Plane capability that brings policy blocks, approvals, risky actions, spend, and sensitive-data events into one analytics view.
Control Plane
PlannedP1
Continuous least-privilege recommendations
Control Plane capability that recommends removal of unused tools, stale permissions, excessive scopes, and unnecessary write capabilities from observed behavior.
Control Plane
Upcoming
5 items
PlannedP0
Model Gateway Governance MVP
Govern model access with provider and model allowlists, routing policy, data rules, budgets, prompt and response controls, and fallback policy.
Model Governance
PlannedP0
AI spend attribution
Attribute model and tool spend by agent, user, team, workflow, provider, and model.
FinOps
PlannedP0
Budget thresholds and enforcement
Apply budgets and automated enforcement actions to agent, team, workflow, model, and tool usage.
FinOps
PlannedP1
Explainable Agent Risk Score
Score agents using identity strength, privilege, data access, environment, blast radius, external connectivity, spend, and behavior.
Risk
PlannedP1
MCP inventory and drift detection
Inventory MCP servers and tools, attach policy, identify capability drift, isolate credentials, and support risk and kill-switch controls.
MCP Governance
Later Roadmap
5 items
PlannedP1
Policy simulation and blast-radius analysis
Preview which agents and workflows a policy change affects before enforcement and identify who can perform sensitive actions.
Risk
PlannedP2
Compliance evidence packs
Generate auditor-ready evidence for identity, policy, tools, credential source, approvals, data exposure, history, spend, and kill-switch state.
Compliance
PlannedP1
Context-driven automated revocation
Revoke agent access when identity, employment, permission, ownership, or risk context changes.
Access Governance
PlannedP1
Flagship identity-platform integration
Use workforce and permission context from an identity platform as live agent-governance signals.
Identity and Attribution
PlannedP2
Regulated-industry governance templates
Package enterprise governance templates for healthcare, finance, and other regulated environments.
Compliance
Integration Roadmap
5 items
PlannedIntegration
Identity and workforce signals
Integrate systems such as Rippling, Okta, Microsoft Entra ID, and Workday for employment, role, ownership, app-access, and permission context.
Integrations
PlannedIntegration
Observability and SIEM ecosystem
Connect Splunk, Datadog, Microsoft Sentinel, and Elastic for discovery signals, analytics, and audit export.
Integrations
PlannedIntegration
Cloud identity context expansion
Use AWS IAM, Azure Managed Identity, and GCP IAM as agent, workload, and environment signals.
Integrations
PlannedIntegration
AI and model-provider governance
Connect OpenAI, Anthropic, Azure OpenAI, and Google Vertex AI for model routing, spend, and data controls.
Integrations
PlannedIntegration
MCP and agent-framework ecosystem
Support MCP servers, LangGraph, CrewAI, AutoGen, and similar runtimes with inventory, policy, audit, and kill-switch controls.
Integrations
Future Exploration
5 items
ExploringP2
Local AI assistance with Ollama
Provide local help for API exploration, request generation, and testing without a cloud dependency.
Developer Platform
PlannedP2
Java SDK
Enterprise-ready Java SDK with KeyRunner support.
Developer Platform
PlannedP2
Python SDK
Lightweight Python SDK for secure KeyRunner integration.
Developer Platform
PlannedIntegration
SQS integration
Send alerts and governance events to Amazon SQS queues.
Integrations
PlannedIntegration
Apigee OAuth integration
Connect governance context with OAuth controls for Apigee-managed APIs.
Integrations
How progress is measured
Product success metrics
Time to convert an enterprise API into a governed agent action
Percentage of discovered agents that are governed
Agent actions with complete human, agent, and tool attribution
Excessive permissions removed through least-privilege recommendations
Policy block, approval, and override rates
Sensitive-data redactions and prevented credential exposure
Mean time to revoke a risky agent or capability
AI spend attributed to an owner, team, and workflow
Compliance controls with continuously generated evidence
Deliberately out of scope for now
- Generic chatbot or agent-builder functionality
- Full workforce provisioning or HRIS functionality
- A broad replacement for enterprise SIEM platforms
- Workflow automation unrelated to governance
- Large numbers of shallow integrations before the core control loop is complete
Never miss an update
Take control of your business
Find out about our latest product changes as we continue improving KeyRunner to enable your team to collaborate better.