Gate 1
Runtime and identity
Pin Crew, Kiro CLI, host, service user, Gateway bind, authentication, tunnel, channels, users, sessions, data directory, encryption, backups, update channel, and incident owner.
Independent persistent-agent gate
Kiro Crew Security Readiness
Describe one Crew deployment, its Gateway, users, state, tools, channels, persistence, approvals, budgets, monitoring, and recovery. Generate a checklist without treating documented controls or open source as a security certification.
Four readiness gates
Gate 2
Data and tools
List repositories, files, memory, lessons, artifacts, prompts, credentials, MCP tools, commands, web access, CI, cloud accounts, messaging data, retention, and deletion controls.
Gate 3
Actions and persistence
Define approvals, denied actions, sensitive paths, schedules, webhooks, heartbeats, skills, subagents, cost limits, idempotency, retries, checkpoints, scope changes, and emergency stop.
Gate 4
Evidence and recovery
Test sandbox and policy boundaries, prompt injection, credential redaction, log integrity, restart, revoked users, changed channels, duplicate effects, state corruption, restore, rollback, and access removal.
Classify the deployment
Ready for local evaluation
One user, synthetic or low-sensitivity data, minimal tools, no unattended external effects, local-only access, bounded model spend, and a tested reset path.
Ready for supervised pilot
Identity, least privilege, approvals, persistence, channels, logs, budgets, monitoring, recovery, and source-version review pass for one bounded workflow.
Not ready
The Gateway is broadly exposed, identities share authority, secrets enter memory, schedules lack owners, retries are not idempotent, or vendor controls have not been independently tested.
Minimum acceptance evidence
Run low-sensitivity fixtures that attempt prohibited commands, sensitive paths, secret disclosure, prompt injection, unapproved network calls, changed channel identity, duplicate external effects, schedule replay, scope expansion, log tampering, restart, lost credentials, corrupted state, restore, rollback, and emergency shutdown. Verify actual effects outside Crew rather than relying only on the activity view.
Review the Crew decision path
Crew workspace overviewUnderstand the runtime, sessions, persistence, Apps, and authority model.Gateway installationChoose local, container, or remote topology and secure its state.Persistent operationsControl memory, schedules, webhooks, heartbeats, retries, and subagents.
Official facts checked August 19, 2026 against Kiro's Crew launch and documentation. Recheck releases, installation, identity, channels, tools, model usage, state, controls, licensing, and support.
Frequently Asked Questions
It creates a checklist from the runtime, users, data, tools, persistence, approvals, schedules, channels, costs, monitoring, and recovery facts you provide. It does not inspect Crew, test controls, connect an account, or certify security.
Not necessarily. Model calls, web access, MCP tools, repositories, CI, messaging channels, and external APIs can move data outside the host. Map every connection and its policy.
No. Verify what is logged, how integrity and access are protected, whether failures are recorded, how alerts are generated, and who responds. Logs do not stop an unauthorized action.
No by default. Give each recurring job the minimum data and actions it needs, plus explicit duration, budget, approval, monitoring, retry, and disable controls.
No. It enables inspection. Assurance still depends on the exact source and binaries, dependencies, configuration, host, credentials, integrations, tests, operations, and patch response.