What you can do
Everything it takes to own the AI you're renting.
Point your OpenAI and Anthropic calls at Kolm - no SDK rewrite. Kolm captures the behavior you already use, compiles it into a signed .kolm model in one portable file, and runs it on your own hardware. Here is exactly what you can capture, compile, deploy, and verify offline.
- Domains
- 8lifecycle
- Channels
- 17families
- Ingress
- 12modes
- Export
- 10modes
What you get out of the box
01 · The path
From your live calls to a model you own, in eight moves.
Each stage takes the stage before it as input and hands its output to the next, so you can trace one record end to end. Below, follow a single capture - one production redaction call - as it moves through all eight stages.
Bring in what you use
Point your traffic at Kolm; it records the real call - prompt, tool calls, outcome.
12408calls recordedfeeds → 1 raw record with source + timestampKnow what you captured
Tag each record's source, schema, tenant, environment, and sensitivity.
PIIfield flaggedfeeds → a labeled record the rules can act onDecide what is allowed
Redaction, retention, allowed providers, export boundaries, budgets.
redacton PII fieldfeeds → a governed record, safe to reuseCatch regressions first
Build evals and drift checks; lock a regression set; block bad releases.
98%pass, 1 heldfeeds → a locked eval gate the compile must clearGet one portable file
Bundle model, recipe, evals, and receipt into one signed artifact.
142MB .kolmfeeds → a signed artifact ready to runRun on the hardware you have
Ship to the smallest runtime that fits - laptop, edge, server.
71ms p50, laptopfeeds → a live endpoint plus its receiptProve what you shipped
Each release carries a receipt, checksum, version, and eval result.
Ed25519verifiedfeeds → a receipt anyone can check offlineStay in control after launch
Audit events, connector health, cost controls, exports, owners.
100%changes loggedfeeds → back to Capture as drift is found01b · Each stage, in detail
What each of the eight stages actually does.
Every step does real work and leaves proof behind - so you can trace exactly how your traffic became a signed .kolm model on your own hardware. See the end-to-end picture on the compiler overview, the file itself in the .kolm spec, and where it runs in runtime targets.
Bring in what you already use
Point your traffic at Kolm and it captures the real behavior: provider logs, gateway events, app traces, agent tool calls, labels, failures, warehouse rows, CI events, and custom API records.
Know exactly what you captured
See the source, schema, tenant, environment, sensitivity, retention window, and owner of every record - and catch anything with an unknown shape before it moves on.
Decide what is allowed before it runs
Set redaction, retention, and purge rules, pick which providers and models you allow, draw export boundaries, scope keys, and cap budgets and rate limits.
Catch regressions before your users do
Build evals, threshold checks, and drift checks, route edge cases to human review, lock a regression set, and block any release that does not pass.
Get one portable file you own
Compile your behavior into a signed artifact - model, recipe, evals, and receipt - with source hash, output hash, approval state, and the runtime it fits.
Run it on the hardware you have
Ship to a laptop, your private cloud, the edge, a server, or a managed host - the smallest runtime that fits, with the limits shown up front.
Prove what you shipped
Every release carries a verifier receipt, checksum, artifact and policy version, eval result, and runtime target - so anyone can check it without trusting us.
Stay in control after launch
Keep audit events, admin analytics, connector health, cost and usage controls, exports, owner assignments, and incident-ready logs at hand.
02 · Coverage
Capture from the tools you already use.
Bring in your traffic from the sources you already run, take your proof out to the systems your team already trusts - with each one's state shown plainly.
03 · Every capability, provable
Nothing ships without proof you can check.
Every action you take leaves a trail you can follow end to end - what went in, what controlled it, what came out, and the proof that ties it together.
- Input · what data came in, which tenant owns it, which environment it ran in, and where it came from
- Control · the policy, role, retention, redaction, eval, budget, and release gate that ran on it
- Output · the artifact, report, receipt, export, runtime target, or audit event you got back
- Proof · the checksum, receipt ID, version, route, and test that let anyone verify the claim
04 · Built for the whole team
Controls your team can delegate, audit, and revoke.
When the AI bill and the trust story are yours to own, you need controls you can hand out, watch, export, and pull back - without a ticket queue.
Hand out access, take it back
Create, scope, rotate, expire, and revoke API keys and service accounts by tenant, workspace, project, environment, and connector.
Know who owns every source
See source health, connector owner, allowed source type, ingress mode, retention window, redaction rule, and export scope at a glance.
Set the rules for every call
Pick which providers and models you allow, route traffic, cap budgets and rate limits, draw data-use boundaries, and set fallback behavior.
Send your proof where it lives
Push to webhooks, your warehouse, SIEM/GRC events, CI status, admin analytics, evidence bundles, and verifier receipts.
An audit trail for every change
Every write leaves an audit event, every claim ships with proof, and anything still in progress is shown plainly - never hidden.
05 · Who it is for
Whatever you own, you get the controls for it.
Everyone who has to sign off gets exactly what they need to say yes - the controls and the proof, in one place.
Platform engineering
You wire it up and keep it running. Sources, keys, environments, quotas, connector health, ingress modes, and runtime targets.
AI & ML teams
You make sure the behavior holds. Traces, labels, evals, regression sets, drift checks, compile runs, and release gates.
Security
You draw the boundaries. Retention, redaction, unknown-schema handling, provider policy, access scope, audit events, and purge workflows.
Compliance
You need proof you can hand over. Receipts, evidence bundles, versions, audit trail, status, and anything still in progress, stated plainly.
Developers
You want to ship fast. API docs, OpenAPI, examples, test payloads, a CLI path, clear errors, and verification you can repeat locally.
Ready to own what you're renting?
Start with one capture. Own the model it makes.
Pick one source, one policy, one eval gate. Capture it, compile it into one signed .kolm model, and run it on your own hardware - then do it for everything else.
Next: how it works · the .kolm spec · runtime targets · pricing