← All customer stories
Customer story
worksfusion

Building a sovereign digital workforce on Kimss

A production multi-agent team that runs headless on Azure — without binding engineering to an IDE or direct cloud AI SDKs. Every worker routes cognition through KimssClient; every Git and telemetry action flows through a self-hosted MCP tool plane authenticated with Microsoft Entra ID.

The challenge

Modern teams want AI that ships work: reviews code, fixes incidents, drafts content, triages support — not chat in a sidebar. They also need governance: one model gateway, auditable actions, human approval where it matters, and no scattered API keys in scripts.

worksfusion set out to operate Kimss with a persistent digital workforce: specialized agents, clear ownership per task, and orchestration that survives beyond a single developer session.

The solution

worksfusion built a multi-agent, multi-service architecture on three pillars:

1

Kimss SDK for all cognition

Every worker uses kimss.KimssClient for chat, agents, and vector stores. No direct OpenAI or Azure AI SDK calls in application code — a runtime guard enforces that policy.

2

Dedicated tool plane (MCP)

Git, GitHub, logs, and repo introspection run through a self-hosted MCP server on Azure Container Apps, authenticated with Microsoft Entra ID. Secrets never reach agent containers.

3

LangGraph for orchestration

Durable, checkpointed Digital Employee graphs run on Azure Container Apps. Private PostgreSQL holds run state and handoffs; per-agent Slack apps provide ingress and human-in-the-loop approval.

How the fleet runs

Ingress, orchestration, cognition, tools, and state — separated by design.

Ingress
Slack
Agent router
Orchestration
LangGraph
Cognition
Kimss SDK
Tools
Azure MCP
State & HITL
PostgreSQL
Slack approval

Hover or scroll to see each layer highlight in sequence.

Who does what

A Command Hub Slack app routes natural language; specialized Digital Employees collaborate via secure handoffs — each with its own least-privilege Slack identity.

🎯

Orchestrator

Ingress router — replies or delegates across the Digital Employee fleet.

🛡

Guardian

Architecture review and controlled merges to staging.

🔧

SRE / DevOps

Log-driven triage and fix pull requests with human approval gates.

QA

Staging validation and PR feedback.

📝

Writer

API documentation from route changes.

💬

Support

Ticket triage with autonomous handoff to DevOps when code fixes are needed.

📊

Telemetry

Usage and FinOps digests posted to Slack.

📰

Social pipeline

Daily content drafts with approval, then scheduled publishing.

Sovereign by design Models and agents flow through Kimss workspaces, not ad-hoc provider clients.
Safe GitOps Autonomous agents open PRs to staging; only the Guardian merges. Production branches are protected at the tool layer.
Secure handoffs Capability-scoped agent-to-agent handoffs — Support can escalate triage, never merge production PRs.
Enterprise-ready ops Entra auth, Key Vault secrets, private PostgreSQL checkpoints, and per-employee Slack apps with least privilege.

Operational outcomes

Daily
Social content drafts with human approval before publish
Headless
Workers on Azure Container Apps — not IDE-bound demos
Zero
Autonomous merges to production — Guardian-gated staging only
1 channel
Command Hub routes to the full Digital Employee fleet
"Kimss gave us a sovereign control plane for a fleet of agents that actually ships work — with governance we could put in front of our platform team."

Executive sponsor, worksfusion

Replace with approved customer quote before publish.

Built with

Kimss SDK Kimss API LangGraph Azure MCP Microsoft Entra ID PostgreSQL Slack Azure Container Apps

Run your workforce on Kimss

Start with the SDK or talk to us about enterprise governance and dedicated Azure capacity.