Kyro agent

Overview

Kyro is the AI agent in StackGuardian. You talk to it in plain language, and it answers questions about your organization, plans changes and builds them with you.

Kyro works with your organization's own data: workflows, runs, stacks, policies, templates and their logs and outputs. It acts with your role, and before it changes or removes anything, it stops and asks you.

What Kyro does

• Answers questions about your organization. Kyro searches workflows, workflow runs, stacks, policies and library templates. It reads run logs, outputs and artifacts, and tells you what uses a given resource.
• Reports on posture. Kyro summarizes your organization's posture and lists the most-misconfigured resources.
• Shows answers as dashboards when it helps. Kyro can draw an answer as charts, tables and other dashboard blocks.
• Plans changes before making them. In Plan mode, Kyro drafts the steps for a change without changing anything.
• Creates resources. In Build mode, Kyro creates workflows, stacks, policies, secrets and templates.
• Runs, updates and deletes with your approval. In Build mode, Kyro asks before it runs a workflow or stack, updates a resource or deletes one.

Modes

Kyro starts in Ask mode. An organization admin turns on Plan and Build in AI Settings.

Mode	What Kyro can do	Changes anything?
Ask	Search, read and report on your organization	No
Plan	Draft a step-by-step plan for a change and ask you to approve it	No
Build	Everything in Plan, plus create, run, update and delete	Yes. Creating runs straight away; running, updating and deleting wait for your approval

In Ask and Plan, Kyro doesn't have the tools that change things, so it can't call them at all. Approvals only happen in Build.

Ask

Ask is the default mode. Kyro searches and reads your organization and answers your questions, for example which workflow runs failed this week or what uses a given workflow. It can't change anything.

Plan

In Plan, Kyro works out how to make a change and writes it up as a plan: the steps it will take and what they affect. It still can't change anything while it plans.

When the plan is ready, Kyro always shows an approval card for it. You can:

• Approve it with Yes, and turn on Build mode. Kyro switches to Build and carries out the plan.
• Choose No, keep planning to keep refining it with Kyro.
• Type a message to tell Kyro what to change.

Build

In Build, Kyro carries out the work. Creating runs straight away; running, updating and deleting wait for your approval.

Turn on Plan and Build (admins)

1. Go to Organization Settings > AI Settings.
2. Turn on Plan and Build for Kyro.

Users then switch modes from the mode menu in the Kyro chat.

Permissions and approvals

Kyro never has more access than you do. It acts with your role, and in Build mode it stops before anything that can change or remove something.

Your role sets the limits

If your role can't do something, Kyro can't either. For example, if your role is read-only and you ask Kyro to create a workflow, it tells you your role doesn't allow it.

What waits for approval

Action in Build mode	What happens
Create a workflow, stack, policy, secret, template or template revision	Runs straight away
Check an integration's credentials	Runs straight away
Run a workflow or a stack action, plan runs included	Waits for your approval
Update a workflow, stack, policy, template or secret value	Waits for your approval
Delete a workflow, stack, template or secret	Kyro first shows what still uses it. If you go ahead, it waits for your approval
Replace a workflow's Terraform state file	Waits for your approval
Reject, revoke or cancel a workflow run in progress	Waits for your approval

The approval card

When a call needs approval, Kyro shows a card with the tool it wants to run and what it applies to. The options on the card depend on the action, and you can always type a message to tell Kyro what you want instead. Typing never counts as approval.

Each card can be answered once and expires after a week. Secret values are masked on the card.

What Kyro never does

• Approve workflow runs. Kyro doesn't release approval gates. You approve runs yourself in StackGuardian.
• Change approval gates. Kyro refuses calls that would change who approves a run. It refuses them straight away, so you're never asked to allow something that would then be blocked.
• Run new tools without asking. A tool added later that isn't marked read-only waits for approval by default.

Get started

1. An organization admin turns on Kyro, and Plan and Build, in Organization Settings > AI Settings.
2. Click the Kyro button in the bottom-right corner of any page to open Kyro.
3. Ask your first question. Kyro starts in Ask mode.
4. To plan or build, switch modes in the chat. If Plan and Build aren't available, ask an admin to turn them on in AI Settings.

Example prompts

Mode	Try asking
Ask	"What's our compliance posture?"
Ask	"Which workflow runs failed this week?"
Ask	"What uses the payments-networking workflow?"
Plan	"Plan how to add a policy that blocks public S3 buckets"
Build	"Create a workflow called payments-api in the payments group"
Build	"Delete the old-sandbox workflow"