The Open-Source Security Cage
for AI Agents

Why AKIOS

Quickstart (3 minutes)

Install AKIOS and run your first sandboxed AI workflow. You'll see kernel-level isolation, PII redaction, and audit logging — working out of the box.

# Install
pip install akios

# Initialize a project
akios init my-project
cd my-project

# Run the sample workflow
akios run templates/hello-workflow.yml

Expected output:

[akios] environment: native linux (kernel-hard)
[akios] sandbox: seccomp-bpf, cgroups v2
[akios] pii: redaction enabled (53 patterns)
[akios] audit: Merkle trail initialized
[akios] workflow: completed successfully in 1.2s

Security guarantees (every run)

The cage enforces these controls for every agent:

• Process IsolationKernel controls (cgroups v2 + seccomp‑bpf) enforce hard boundaries between every agent process.
• Syscall FilteringDefault‑deny policy on network and filesystem. Only explicitly allowed calls pass.
• PII Redaction53 patterns detect and redact sensitive data in real time — on all inputs and outputs.
• Tamper-Proof AuditEvery action is cryptographically signed into a Merkle chain. Logs can't be altered after the fact.
• Cost & Loop Kill-SwitchesHard budget limits per workflow. Runaway agents are terminated, not throttled.
• Sandbox-First ExecutionThe sandbox is enforced before any tool call. No code runs outside the boundary.

Core agents

Four built-in agents cover typical workflows, all running inside the security cage:

Trusted across regulated industries

See how organizations use AKIOS to integrate AI securely and stay compliant — from healthcare to government.

Frequently asked