Last updated: August 16, 2026
Why CISOs ask for a dual-layer gateway
An LLM cannot enforce your directory roles. The control plane must authenticate the application key and the human SSO principal before any internal tool executes.
Teams that paste a provider key into a microservice skip both gates. Kimss binds every inbound call to a workspace-scoped API key and, for internal MCP tools, to iam.mcp_tool_grants rows that match Entra oid, group, or workspace role.
Failed Gate 1 drops the call. Failed Gate 2 blocks execution and logs a warning. Authorized execution is the only path that reaches your MCP server.
The Hermis orchestration loop
Hermis is Kimss’s orchestrator—not a static DAG runner. The physical pause is the security product: the model may request a tool; Hermis decides whether that tool ever runs.
One chat turn: normalize Kimss state for the vaulted endpoint; intercept tool_call; evaluate the administrative kill switch; decrypt MCP auth_headers in memory via Azure Key Vault; execute; drop plaintext from RAM; write the Article 12-oriented row to tenant audit_log.
What these diagrams do not claim
Kimss does not host your models. Foundry, Azure OpenAI, or any OpenAI-compatible endpoint remains the data plane. Kimss does not replace Apache Airflow for batch pipelines.
Read Security & Trust Architecture for envelope encryption and metadata-only telemetry. Read Routing Internal MCP Servers for vault, SSRF, and grant semantics.
Frequently asked questions
Why do identity-blind models need a dual-layer gateway?
Foundation models do not know your Entra groups. Kimss authenticates the scoped API key first, then matches the human SSO payload to iam.mcp_tool_grants in PostgreSQL before any internal MCP tool runs.
What is Hermis?
Hermis is Kimss’s proprietary orchestration loop. It is not Apache Airflow. When the model emits a tool_call, Hermis pauses the turn, evaluates the kill switch, unwraps vaulted auth headers in memory, executes the tool, then writes an Article 12-oriented audit_log row.
Where do decrypted MCP credentials live?
Plaintext MCP auth_headers are decrypted with Azure Key Vault only in process memory for that hop, then dropped. List and GET APIs never return decrypted headers.
Where is the interactive architecture view?
The visual system map is at /docs/architecture. Security reviewers should also read /docs/security_trust_architecture and /trust.