Iron Lake builds infrastructure for autonomous work in the places where a wrong action has a cost — clinics, law practices, regulated suppliers. The machine does the work. A licensed professional approves it. Every step leaves a record that survives being asked about.
▸ Two systems in production. One runtime being extracted from them.
A model can read a probate corpus and tell you which emails are privileged. It can read a practice's calendar and tell you which patient to call. Neither is the reason this work isn't automated. The reason is that a wrong answer is a malpractice exposure, a HIPAA incident, or a person who took a half-day off for an appointment that was never booked. The bottleneck is accountability, and no amount of model quality dissolves it.
An attorney should not read 8,000 emails to find 300. They should read 300 and disagree with 12. A front desk should not reconstruct where a patient came from. The machine does the volume; the licensed human does the judgment and takes the liability, which they were always going to take anyway. That division is not a compromise on the way to full autonomy. It is the product.
Every unit of work in our runtime declares what it touches before it can run: its risk class, which data classes it may see, whether a human must approve, whether the effect is idempotent. Undeclared means unrunnable. A stochastic program never inherits ambient authority because a prompt asked nicely.
The path that writes a real appointment into a real clinic's system exists, is tested, and is disabled by default. It returns a refusal and writes an audit row. Turning it on is a business decision with a signature attached, not a deploy flag someone flips on a Thursday. We would rather ship a capability disarmed than discover its blast radius in production.
A privilege log is defensible or it is worthless. An appointment either has provenance or it doesn't. We write the audit row before the external call, not after, because the failure that matters is the one where we acted and cannot account for it. Everything else is recoverable.
An AI revenue agent for private practices.
Riley answers every inquiry a practice receives, works out who the person already is, and hands the front desk one decision instead of an afternoon. Underneath it is a desired-state reconciliation control plane. It compares what a practice wants (a full book, every inquiry answered) against what is observed (an appointment feed, a lead inbox, provider hours) and emits the deltas between them. Deltas become plans, plans lower into typed sagas, and each step is a declared capability that states its own authority before it runs.
;; a capability declares its own authority before it can run
(capability book-consultation
(kind act_external)
(risk-class high)
(approval operator_required)
(phi-classes (limited_phi))
(redaction staff_safe_summary)
(idempotency required)
(side-effects (creates_appointment))
(metrics (booked_consults)))
;; omit any line above and the plan will not lower.
;; undeclared is unrunnable.The declaration is the enforcement. A capability that has not named its risk class, its data classes, and its approval requirement cannot be lowered into a saga, so it cannot execute. That is the whole idea, and it is why a non-engineer can safely describe a workflow in plain language: the runtime refuses anything under-specified rather than guessing at the missing half.
Status, plainly. The reconciliation loop, capability registry, typed saga lowering, PHI seams, approval interrupts and audit trail run today. The outbound clinical write path is built and shipped disarmed. Iron Lake's substrate work — the general runtime PAOS is the first consumer of — is research in progress and is not claimed as a shipping product.
Two systems, two regulated domains, same shape. Both predate the runtime and are the reason it exists.
Client identities, volumes and commercial outcomes are omitted deliberately. They are our customers' business data, not our marketing.
A home for agents.
Autonomous work needs somewhere to execute that is cheap, isolated, and does not assume a human at a console. An agent reads a skill file, makes four HTTP calls, and its workload boots in a Firecracker microVM on our own metal with a public URL inside thirty seconds. Slurm schedules. Rust serves. Cost metadata rides on every response, and budget enforcement lives in the scheduler rather than the API, because the race condition matters.
$ curl -X POST https://api.kingdom.sh/v1/jobs \
-H "Authorization: Bearer $KINGDOM_KEY" \
-d '{"image": "ghcr.io/you/yourapp:latest",
"ingress_port": 8080}'
{
"id": "kj_01HW8Z3N5K...",
"state": "BOOTING",
"public_url": "https://hello-a4b9.kingdom.sh",
"cost": {
"this_request_usd": 0.00,
"period_total_usd": 0.00,
"budget_remaining_usd": null
}
}Kingdom opens Q2 2026. Owned hardware, published pricing formula, permanent free tier, self-serve only. The economics are in vision.
For the people who ask "but what is it actually made of."
If you run regulated work that a machine could do and a professional must sign, we want to hear about it. We'll also email you once when Kingdom opens the first wave of accounts, and for no other reason. We don't sell your address or enrich it. If we ever have to, we'll delete it and apologize.