Kindo × Deloitte
Thursday Session · Deep Dive
Session Prep

Three Topics, One Direction

Thursday covers agent telemetry & SOC for AI, observability, and Swimlane transition. This document lays out where we are on each, our proposed direction, and what we need from this session to move forward.

Topic 1 · Agent Telemetry & SOC for AI

Sprint 2 Progress & Recommended Direction

Sprint 2 advanced the SOC for AI architecture across telemetry, platform research, and discovery frameworks. The agent telemetry alpha is architected to graduate toward production — it represents the starting point for requirements finalization. Full details at sprint2-review.pages.dev.

Alpha

Agent Telemetry

Trace export, LLM judges, eval configuration, span detail, error diagnostics. Built natively inside Kindo. Shaped for requirements finalization — your input refines it.

Research Complete

Platform Compatibility

Five platforms mapped — Anthropic, Azure AI Foundry, MS Copilot, ServiceNow, AWS Bedrock. Per-platform API capabilities documented for discovery and governance.

Architecture Defined

Three-Pillar Framework

Platform integrations, LLM gateway, network monitoring. Co-designed at the Jul 10 session. Three complementary approaches to AI governance.

The Five Governance Objectives

Each objective from the Jul 7 scope definition connects to a different part of the architecture. Objectives 1 and 2 require discovery of AI activity outside Kindo — the enterprise-wide challenge. Objectives 3–5 are addressable through the telemetry alpha.

1. Unauthorized Agent Deployment
Pillar 1 platform discovery probes external platforms to find AI activity outside Kindo. Once discovered and routed through Kindo, telemetry provides ongoing governance. Pillar 1 + Telemetry
2. Unauthorized Tool/Data Connections
Pillars 1 + 3 surface unauthorized connections via API probing and network-level detection. For sanctioned workloads, MCP Gateway enforces real-time tool access policies. Pillars 1 + 3 + Gateway
3. Agent Behavioral Drift
LLM Judges score every agent run against standard operating procedures defined in natural language. Alpha ready — criteria to be co-defined. Alpha
4. Guardrail/Policy Changes
Configuration visibility per agent. Change tracking and audit trail on roadmap. Roadmap
5. Cross-Tenant Contamination
Organization-isolated workspaces with per-org trace storage. Demonstrated in alpha. Alpha

Proposed Direction for Sprint 3

Recommendation

Lead With Shadow AI Discovery — Pillar 1 First

Enterprise-wide visibility before deep governance
Objectives 1 and 2 are about AI activity happening outside Kindo — agents and connections that aren't known or sanctioned yet. We propose Sprint 3 focuses on building a working Pillar 1 integration that discovers, enumerates, and classifies AI activity on at least one external platform. Azure AI Foundry is our recommended starting point given its enterprise relevance and full API surface. Agent telemetry alpha continues to be refined in parallel — particularly LLM Judges, which need your SOC behavioral criteria to finalize.

Sprint 3 deliverable: Working discovery integration against Azure (or Anthropic as fast-start alternative). Discover → enumerate → classify → route into Kindo. Judges configured with co-defined eval criteria.

Refine together: Does this sequencing align? Which platform should we start with? What eval criteria should the judges use?

Three-Pillar Architecture

1

Platform Integrations

Reach into Anthropic, Azure, Copilot, ServiceNow, Bedrock via admin APIs. Enumerate agents, audit usage, inspect configs. The discovery layer.

2

LLM Gateway

Kindo as inference proxy. Real-time governance at the choke point. Kush endorsed Jul 16. For sanctioned workloads.

3

Network Monitoring

Shadow AI beyond managed platforms. Network and endpoint-level discovery. Requires detection engineering expertise to scope.

Topic 2 · Observability

Current State & Proposed Direction

Observability has been a consistent priority from the program sessions. The upcoming Kindo platform release introduces foundational changes to the telemetry infrastructure. Here's where things stand and where we propose to go.

Current State

What Exists Today

  • No central log collection in Kindo out of the box
  • Makeshift hourly log retention on bastion host as stopgap
  • Token cost attribution not yet available
  • No native failure alerting — separate products required
Coming

Next Platform Release

  • Clickhouse-backed telemetry storage — structured trace data
  • OTel-based pipeline — Kindo ingests traces from any AI workload
  • Foundation for the SOC for AI eval and governance layer
  • Brandon to present roadmap details
Recommendation

Three Observability Priorities for Sprint 3

Address the active blockers
Based on the program sessions, three observability requirements surfaced as highest priority. We propose addressing these in Sprint 3 alongside the SOC for AI work — they strengthen the telemetry foundation that both efforts depend on.

1. Token cost attribution — Critical for EBITDA visibility and Swimlane transition costing. Required for any cost comparison with existing tooling.

2. Failure alerting — Notifications without depending on separate products. Email, Jira ticket creation, webhooks. SOC workflows need immediate failure notification.

3. Central logging — Replace the bastion host stopgap with the Clickhouse-backed pipeline from the upcoming release.

Refine together: Are these the right priorities? Anything missing that should come first?
Topic 3 · Swimlane Transition

What We've Learned & Where We Need Your Input

We've been working with Zun and Matthew's team to understand the full scope of the potential Swimlane-to-Kindo transition. The scope is substantially larger than the triage handoff in production today. We'd rather size this together than guess at it.

Timeline

November 2026
Decision point. Go/no-go on Swimlane replacement. Enough has to be validated by this point to make the call.
December 2026
Contract renewal window. Swimlane contract renewal notice deadline. Decision needs to be made before this.
Mid-January 2027
Migration complete. If transitioning, migration needs to be finished by this date.
February 2027
Swimlane contract end. Current contract expires.

What We've Learned From Discovery Sessions

Scale

Production Usage Is Extensive

Swimlane handles client alert injection, normalization, and all SOC workflows. Heavy daily volume — hundreds to thousands of events across clients. Email ingestion, format transforms, Jira integration. The scope goes well beyond the triage handoff currently running in Kindo.

Architecture

Kindo's Approach

Kindo is an agent-first platform. Rather than native deterministic flow control, the direction is agents orchestrating deterministic code in sandbox environments — without tokens entering the LLM context window. Agent as control layer, not deterministic engine. Inference costs drop with each generation.

Recommendation

Size the Transition Together Before Committing

Scope first, then roadmap
The transition scope is larger than initially visible. We propose using this session to align on three things: the full inventory of Swimlane workflows that would need to migrate, the token economics of running those workflows through Kindo (inference cost is a factor in the EBITDA calculation), and a realistic timeline given the November decision point. We'd rather present a credible plan than an optimistic one.

What we propose for Sprint 3:

1. Workflow inventory — Complete mapping of Swimlane workflows, classified by complexity and migration effort.

2. Token economics model — Per-workflow cost comparison: Swimlane (zero marginal cost) vs. Kindo (inference cost per run). Including the agent-compiled deterministic execution path where applicable.

3. Proof point — One representative workflow migrated end-to-end. Validates the pattern before committing to full migration.

Refine together: What's the right level of detail for the November decision? Which workflow should we migrate first as proof point?
Open Question for Krishna

Token economics — inference cost as a factor in the EBITDA calculation. Did this surface in the original due diligence or later in implementation? The context shapes how we frame the cost model.

Next Steps

What We Need to Start Sprint 3

Your input from this session directly shapes Sprint 3 scope across all three topics.

SOC for AI

  • Eval criteria — which SOC behavioral rules should judges evaluate?
  • Platform priority — Azure, Anthropic, or another platform first?
  • Discovery scope — how deep into shadow AI for Sprint 3?

Observability

  • Confirm priority ordering — cost attribution, alerting, logging
  • Alerting requirements — email, Jira, webhooks, other?
  • Coordinate with Brandon on platform release timing

Swimlane

  • Time allocation — how much of Thursday on Swimlane vs. other topics?
  • Workflow access — for inventory and complexity classification
  • Token economics context — EBITDA calculation inputs
Sprint 2 Review

Full Sprint 2 delivery details, platform compatibility matrix, architecture documentation, and current status at sprint2-review.pages.dev.