Kelpie AI
In designAI governance control plane for regulated industries.
Continuous visibility into every AI agent, model, and tool in your stack, plus the audit-ready AI-BOM, NIST AI RMF, and MITRE ATLAS documentation regulators require. Where my 12 years of security ops meets the agentic era.
Kelpie AI is what happens when 12 years of security operations meets the AI-DLC. Regulated industries are about to be hit with mandates around agent inventories, model BOMs, and ongoing risk assessment for every tool an agent can call. Nobody has the puzzle solved end to end yet. The pieces exist, they are just scattered across a dozen dashboards that were never built to talk to each other.
The problem
When an organization in healthcare, finance, or government starts running AI agents in production, a question shows up fast that nobody can answer cleanly: which agents are running, what models do they call, what tools and data can they reach, and who signed off on any of it. Auditors are starting to ask. The frameworks are landing. Most teams are answering with spreadsheets that go stale the moment someone ships a new prompt.
What Kelpie does
Kelpie is a control plane, not a sidecar. It gives security and compliance teams continuous visibility into every AI agent, model, and tool in their stack, and it produces the artifacts regulators want as a byproduct of how the agents already run:
- an AI-BOM, the bill of materials for every model, tool, and dependency an agent touches
- NIST AI RMF mappings tied to real systems, not a policy PDF
- MITRE ATLAS coverage so adversarial risk gets described in a shared language
The word “continuous” is the whole bet. A point-in-time audit is wrong the next day. Kelpie is designed to keep the inventory and the documentation true as the agents change underneath it.
Why me
I spent twelve years in security operations. EDR, SIEM, SOAR, the daily discipline of knowing exactly what is running in your environment and who is allowed to touch it. That is the muscle the agentic era needs and mostly does not have yet. Kelpie is me pointing SOC instincts at a problem that is about to be everyone’s problem.
Where it is
In design. Healthcare is the anchor. I am watching the regulatory tape closely and talking to people who feel this pain today. If that is you, or you are building in AI governance and want to compare notes, find me on X. No pitch, just the work.