Use case · Banks and fintech
Run AI agents on financial code and data inside sealed machines, with a record you can verify.
Updated 2026-10-31
kosa8 is an AI agent sandbox for banks and fintech teams: each agent runs in its own microVM, with its own kernel, on your own Mac or Linux hardware. The agent sees one folder, reaches only the hosts you allow and never holds the real API key, and every action lands in a hash-chained audit log that kosa8 audit verify checks.
01The problem: agents with more reach than the task
Banks and fintech companies put agents on fraud and AML triage, report drafting and coding work on payments and core-banking code. Run with a developer's shell, an agent can read every file and credential that person can, and connect to any host. The failures that matter most are usually not attacks: a helpful agent quotes an account number to an external model, or fetches a build script from the internet that turns out to steal keys.
Supervisors and assessors then ask three questions: where did the data go, who approved the change, and where is the record? PCI DSS Requirement 10 is about logging and monitoring access to system components and cardholder data. DORA, Regulation (EU) 2022/2554, sets ICT risk management, incident and third-party requirements for EU financial entities. kosa8 does not satisfy a framework on its own; it supports evidence for the controls these frameworks ask about.
02One machine per agent, one folder in view
Each sandbox is a microVM with its own kernel, so an agent never shares the host's kernel or sees your home directory. Share only the repository or data set the task needs, read-only if the agent does not need to write.
03A network closed except for named hosts
The allow-list is enforced on the host, in the userspace network every frame from the VM crosses, so root inside the sandbox cannot lift it. DNS is answered by the host for listed names only, and refused attempts are written to the audit log. kosa8 sandbox egress shows the rule in force and what it passed and refused.
04API keys stay outside the machine
kosa8 agent run reads the model provider's key from your own environment and hands it to a broker on the host, which adds it to requests on their way out. The sandbox holds a placeholder, so an agent that is tricked into printing its environment has no real key to leak. Add --dry-run to see the plan first.
05Separation of duties with signed approvals
An org policy can list named approvers and rules such as "a network change needs two people from security". The requester is never counted, and each approval names the request by the digest of its signed bytes, so it cannot be moved onto a different action. The flow is built from files, so it also works between machines that share nothing.
06A record an examiner can check
Every state-changing action is written to a hash-chained, HMAC-authenticated log with the actor marked human, agent or tool. Export it as JSON lines or CEF for your SIEM, or cut a signed evidence package for one sandbox that the recipient verifies with nothing but the package.
07A restore point before the risky step
A checkpoint saves the whole running machine, processes included. If a migration or a refactor goes wrong, rewind puts the sandbox back to that point instead of you cleaning up by hand.
08How to start
Start on one workstation with one agent and one repository, then widen.
Install kosa8 on an Apple silicon Mac or x86-64 Linux, then start the daemon.
Run a coding agent in its own sandbox with one folder mounted. Print the plan with
--dry-run, then run it and check the log.
09Questions
Does kosa8 make an AI workflow meet PCI DSS or DORA?
No tool does that on its own: meeting a framework is a property of your whole environment and your assessment. kosa8 supports evidence for controls those frameworks ask about, such as restricted network paths, separation of duties and tamper-evident logs.
Does customer data leave our machines?
kosa8 has no telemetry. Sandboxes, files, commands, snapshots and audit logs stay on the machine kosa8 runs on, and traffic from inside a sandbox goes only to hosts you allow. To keep prompts in-house too, serve a local model with kosa8 model serve, which offers OpenAI- and Anthropic-compatible APIs on the same machine.
Can a person approve their own request?
No. The requester is never counted toward the approvals a rule needs, however many keys they hold, and each approval is bound to the exact request it was signed for.
Can our SIEM read the audit log?
Yes. kosa8 audit export writes JSON lines or CEF, the ArcSight format many SIEMs read, and the daemon can forward entries to syslog, Splunk HEC or an HTTPS endpoint while it runs.
10Further reading
- How do I restrict an AI agent's network access to an allow-list?
- How do I give an AI agent API keys without exposing them?
- How do I require human approval before an AI agent runs a risky command?
- How do I undo what an AI coding agent did?
- AI agents in banks and fintech: securing fraud, code and data
- What an audit log for AI agents should record
11Sources
12Get kosa8
Install kosa8 on one workstation, run one agent and verify its log. Plans start at $29 a month; Enterprise terms are on the pricing page.