AI governance
Responsible AI
Kurahi is the runtime your agents work in, so it is where oversight can be built in. This page describes the mechanisms Kurahi provides. Whether an AI system is used responsibly also depends on how your organisation configures and uses it.
Human oversight
Tool classes can require a human approval before they run, in the terminal or over a chat channel.
One command stops every agent immediately; running jobs are cancelled and the stop survives a restart until it is released.
Source:Security overview
Transparency
Every job can be exported as a signed evidence bundle of inputs, tool calls and outputs, verifiable offline.
Source:Evidence bundles
The AI inventory lists every agent with its models, tools, policy rules and channels, as a signed file.
Source:AI inventory
Accountability
Every policy decision is written to a hash-chained audit log with the clause that decided it.
Source:Policy as code · Security overview
The policy itself is signed by an owner key; an unsigned or altered policy is refused in enforce mode.
Source:Policy as code
Privacy
The context guard replaces personal data in tool results with placeholders before the model sees it. Images are not inspected, and the detectors are patterns.
Source:Context guard
You choose where models run, including on the same machine or with a Japan-hosted model service, and no telemetry is sent.
Safety and security
A signed policy limits each agent's tools, models, channels, paths and budgets.
Source:Policy as code
With explicit credential isolation, each agent sees only the credentials granted to it.
Ransomware detection stops every agent when mass encryption is detected. It is detection, not complete protection.
Japan's AI Guidelines for Business
The AI Guidelines for Business (AI事業者ガイドライン, version 1.2, 31 March 2026) are published by Japan's Ministry of Internal Affairs and Communications and Ministry of Economy, Trade and Industry. Kurahi is designed to support several of their common guiding principles. This is not a claim of compliance or certification.
| Guiding principle | How Kurahi is designed to support it |
|---|---|
| Human-centric (人間中心) | Human approvals for consequential tool classes; a kill switch. |
| Safety (安全性) | Signed policy limiting tools, models and budgets; ransomware detection. |
| Privacy protection (プライバシー保護) | Context guard; choice of where models run; no telemetry. |
| Ensuring security (セキュリティ確保) | Credential isolation; boot integrity gate; external adapter contract. |
| Transparency (透明性) | Signed evidence bundles; AI inventory. |
| Accountability (アカウンタビリティ) | Hash-chained audit log of policy decisions with the deciding clause; signed policy. |
| Fairness (公平性) | Not addressed by the runtime. It depends on the models and data you choose and how you use them. |
AI Guidelines for Business (Ministry of Internal Affairs and Communications)
In the product
Controls that show up on the screen
The governance described on this page, as people see it in the Kurahi console, shown with sample data.
Policy checks that stop
A failed blocking check — here, a suspected bank-change fraud — stops approval and records the policy version that decided it.
Decisions only people make
Required approvers and separation of duties on every route; agents cannot approve.
Autonomy under human control
Levels change only by a person's decision on evidence; the watchdog can only lower them.
Evidence for every run
Each run records what was read, what the model proposed and each decision, verifiable offline.
