Entitlements that survive the air gap.
Some customers will never let your control plane phone home. Kaiten Edge is the agent we are building for them: it will run inside their perimeter, answer every flag and entitlement question locally, and hand you back a usage ledger you can verify.
Kaiten Edge is in private preview, by invitation. The design below is where it is heading, and nothing on this page is billable yet.
THE PROBLEM
Your best-paying customers are the ones you cannot reach.
Defense, health, banking, industrial sites: the deployments with the strictest contracts are the ones behind an air gap, on an intermittent link, or inside a network that resolves nothing outbound. Today the answer to “what is this customer entitled to?” is a config file someone edited by hand, and the answer to “how much did they consume?” is an invoice argument.
The plan stops being enforced
A control plane that cannot be reached cannot gate anything. Enforcement quietly falls back to trust.
Usage stops being measurable
No telemetry means no metering, so the contract is renegotiated on anecdote rather than on numbers.
Every site drifts on its own
Hand-edited config diverges per deployment, and nobody can say which version of the deal is actually running.
HOW IT WILL WORK
Three artifacts, and a reconciliation that cannot double-count.
A signed bundle
Kaiten will export the customer’s license, entitlements and flag manifest as one signed bundle. The agent will verify the signature before serving anything, so a bundle edited in transit will be refused rather than obeyed.
A quota lease
The bundle will carry a lease: a bounded amount of a metered entitlement, valid for a bounded window. The agent will enforce that ceiling locally, and stop at it — offline is not a license to consume without limit.
A hash-chained ledger
Every local decision will be appended to a tamper-evident log, each entry chained to the hash of the one before. The chain leaves the site on any medium you like — a file, a USB key, a weekly sync.
Idempotent import
Kaiten will replay the ledger, verify the chain, and fold the usage in. Importing the same ledger twice will change nothing, so a retried transfer cannot double-count what the customer owes.
WHAT ALREADY EXISTS
The foundations already ship.
A quota lease over a lifetime counter is meaningless: you cannot lend out a slice of a number that never resets. That objection blocked Edge until windowed quotas landed — and they ship today.
Windowed quotas
Entitlements carry a reset period and an anchor, calendar or license start. A window is a real bounded quantity, which is exactly what a lease needs to slice.
Gap-free period history
Rollover is evaluated lazily and materializes one closure per closed window, including the empty ones a dormant meter skipped. An imported ledger will land in a timeline with no holes.
Transactional event delivery
Business writes and their events commit together, and the pipeline’s consumers deduplicate on an inbox key — the idempotent pattern the reconciliation will reuse.
An audit trail that is already the record
Every change commits its event in the same transaction, and the audit trail is written from those events. Edge entries will join that trail, not a parallel one.
WHAT IS LEFT
What we still owe you before this is real.
- The three domain objects — bundle, lease, ledger entry — do not exist in the schema yet.
- The import event is not among the 55 domain events the API publishes today.
- There is no agent binary, and no signing story chosen.
If an air-gapped deployment is what stands between you and a contract, tell us — a named customer moves this up the list faster than anything else.
Air-gapped, and still under contract.
Tell us which deployment you cannot reach.
The private preview is by invitation: tell us about your perimeter, and we will tell you where Edge stands for it.