An enterprise adopting what its AI-native people are already using bottom-up, now with IT and compliance in the room. The requirement is awkward but reasonable: keep the velocity the individuals have found, and add the governance the organisation demands.
Regulated firms are the same story with less slack in it - the questions arrive earlier and the answers have to be recorded rather than asserted - so everything below applies to both, and the regulated case is called out where it goes further.
Kythene is built so this layers on rather than replacing how people work. The provenance and scoping spine is there from the first publish; the governance surfaces sit on top of it.
The question IT and compliance actually ask
Not "where is the data". They ask: which shared knowledge did this output rely on, and who agreed it?
Every artifact and memory records who and which instance produced it, and what it drew on. Reads of shared work are recorded too, so you can ask which instances actually read a given piece of work. Put together, the lineage is a record rather than a reconstruction:
Compliance: Where did the assumption in this model come from?
Claude: It cites team memory "Capital treatment - retail book", approved by the workspace owner on 12 July, which itself links to "PRA rule interpretation" published 3 July. Both are in the audit trail with authors and approvers.
That's the thing an AI-native team normally cannot answer, and it's why provenance is designed in rather than bolted on.
Approval gates with recorded approvers
Where work must be signed off before it counts, mark the collection as needing review. Approvals record the approver and the exact revision, and clear automatically when a new version lands - so a sign-off can never silently apply to a state nobody reviewed.
Promotion of a finding into team memory goes through the same gate. "Who approved this becoming something every instance applies?" has a recorded answer, with a name and a timestamp.
Access expressed the way people already work
Projects are delineated and access-controlled by tag: internal-only, private to named members, password-protected, or opened to a specific outsider by share code. The compliance boundary is the same mechanism your people already use for organising work, so it doesn't rot the way a parallel access model does.
Two controls matter particularly here:
- Derived-memory provenance. An instance that reads restricted material and then writes a memory from it would otherwise store an open summary - a paraphrase of private content that ordinary recall could later hand to someone with no right to the source. With provenance on, the memory inherits the tightest restriction of what the session read, erring towards over-restricting. On by default on hosted; self-host operators set
memory_provenance. Leave it on anywhere the workspace holds restricted material, and treat it as mandatory in a regulated install. - Oversight. Owners and admins can review content members have kept private, through one dedicated surface and nowhere else - never through Artifacts, recall or MCP. Every access is audit-logged. See Oversight.
Sign-in and roles
Sign-in is through your identity provider. Named OAuth providers work today - GitHub and Google on hosted; GitHub, Google, Microsoft and Apple configurable on self-host - and local email/password sign-in covers an air-gapped install with no external IdP at all.
Generic OIDC works now (Okta, Entra ID, Keycloak and any other OIDC provider): point the install at your issuer with a client id and secret, endpoints are auto-discovered, and an SSO button appears - optionally locked to your own email domains. See the "Generic OIDC" section of Self-hosting. SAML directories and SCIM provisioning are not available yet. They're a planned enhancement. We'd rather tell you that now than during your security review.
Members carry a role - owner, admin, member or viewer - and sign-in can be restricted to your own domain.
Data sovereignty and self-hosting
Run the whole product on your own infrastructure under a signed offline licence: no phone-home, no dependency on our servers, and validation that works with no network egress at all. Suitable for data-sovereign, regulated and genuinely air-gapped deployments.
The individuals' workflow is identical - publish, recall, review, memory. Only the deployment changes. See Self-hosting.
Getting your data out
The escape hatch is a first-class feature, not a support ticket. An owner or admin can export a workspace's full knowledge and governance state as a deterministic archive: markdown and YAML for everything textual, byte-for-byte for binaries. A human can read it in any editor, an AI can ingest it without a parser, and grep works.
It's also restorable - the archive can be imported into a fresh workspace with ids and timestamps preserved, so citations and links keep working. See Exporting your data and Importing.
For most procurement conversations, "here is the format your data leaves in, and here is it going back in again" settles the lock-in question faster than any clause.
What's here today, and what isn't
In place now: provenance and lineage, approvals with recorded approvers, tag-level access control, private projects, audit-logged oversight, derived-memory provenance, full export and restore, self-host under an offline licence, named OAuth providers, generic OIDC SSO and local auth.
Not yet: SAML directories and SCIM provisioning, a compliance-grade audit and export UI over the raw record, and retention and legal-hold controls. These are on the Enterprise track.
If your environment needs one of those on a timeline, talk to us rather than assuming either way.
Tips
- The hosted Enterprise tier carries the full governance posture, so adopting it does not mean taking on an install. Regulated and data-sovereign firms usually want self-host instead, and get the same surfaces either way.
- Because provenance is designed in, adopting Kythene later doesn't cost you the trail - it starts recording from the first publish, and imports preserve what came before.
- Put "what does not belong here" in the workspace guide. It's the one instruction every connecting instance reads before it writes anything.