Enterprise

Secure-Environment Deployment

Want this shaped to your perimeter, or have questions? Kovanex can be tailored to your environment — and if you’d like hands-on help, the author takes on audit & refinement work ↗.

You want an AI agent building software — you can't let it roam your protected network. Kovanex resolves the tension with a boundary, not a promise. The agent, the kovanex control plane, and its CI runner run in a sandbox outside your guarded corporate perimeter. Across the boundary, in one direction, through a single narrow git port, moves only code — and it reaches your internal production only after passing your code review, under your regulations.

SECURITY PERIMETER OUTSIDE THE PERIMETER kovanex sandbox — isolated VM / segment GUARDED CORPORATE PERIMETER your internal network Claude Code / dev agent kovanex-server + task board CI runner test builds + QA tasks build push: code only GIT PORT Internal enterprise repo code built by agent + kovanex Code review per your enterprise regulations Merge → internal production review merge
The agent never joins your network. The only thing that crosses the perimeter is source code — one direction, one git port, gated by your review.
For your CISO

The perimeter stays whole

  • The agent has zero inbound network access to internal systems — the trust boundary is a reviewed git push, not a live connection or a VPN.
  • Only source code crosses, in one direction, through a single git port. No agent process, runtime, or production secret moves inward.
  • Nothing reaches internal production without passing your code review under your regulations.
  • Every action carries a signed, tamper-evident audit trail (who / what / when).
  • Air-gap capable — the sandbox can be locked to the git port and a self-hosted model, with no other egress.
For your architects

Four steps to stand it up

  1. Provision the sandbox outside the perimeter — a dedicated VM or an isolated network segment. Agent, kovanex-server, and the CI runner live here.
  2. Open one git port from the sandbox to your internal development repository. That is the only channel across the boundary.
  3. Develop, build, and QA entirely in the sandbox. The runner produces validated builds; the board tracks every task.
  4. Push → review → merge. Validated code is pushed to the internal repo, where your existing branch protections and reviewers gate it into production.
Work inside the perimeter proceeds under all of your accepted security standards and regulations. Kovanex contributes to them directly — signed audit logs, role-based access control, encrypted transport, and vault-managed secrets — so the controls you already require are reinforced, not bypassed.

FAQ

Where does the agent actually run?

In an isolated sandbox outside your guarded perimeter — a dedicated VM or a segmented network. The agent, the kovanex control plane, and the CI runner all live there. None of them join your protected internal network.

What crosses the perimeter, and in which direction?

Only source code, only outbound-to-inbound through a single git port. No agent process, no runtime, and no production secrets cross. The boundary carries commits, nothing else.

How does code get into our internal systems?

The sandbox pushes to your internal development repository — the code the agent and kovanex produced — over the git port. From there your existing branch protections, reviewers, and merge gates apply exactly as they do for any other contributor.

Who reviews the code before it ships?

Your engineers, under your regulations. Nothing merges to internal production without passing your review. Kovanex adds its own signed audit trail on every action, so the review has a complete, tamper-evident record to work from.

What happens to secrets and keys?

Production secrets stay inside your perimeter. The sandbox holds only what it needs to build and test; secrets it does use are held in kovanex's vault, and nothing from the guarded network is exported to it.

Does the sandbox need internet access?

That is your call. It can be locked down to just the git port plus a model endpoint, or run fully air-gapped with a self-hosted model. Kovanex has no cloud dependency of its own.

How is this different from giving an agent VPN access?

A VPN puts the agent inside your network. This does the opposite: the agent never gets a route to internal systems. The only thing that ever reaches you is a reviewed git push — a boundary your security team already knows how to govern.