Iron Lake builds infrastructure for autonomous work in the places where a wrong action has a cost — clinics, law practices, regulated suppliers. The machine does the work. A licensed professional approves it. Every step leaves a record that survives being asked about.
▸ Two systems in production. One runtime being extracted from them.
A model can read a probate corpus and tell you which emails are privileged. It can read a practice's calendar and tell you which patient to call. Neither is the reason this work isn't automated. The reason is that a wrong answer is a malpractice exposure, a HIPAA incident, or a person who took a half-day off for an appointment that was never booked. The bottleneck is accountability, and no amount of model quality dissolves it.
An attorney should not read 8,000 emails to find 300. They should read 300 and disagree with 12. A front desk should not reconstruct where a patient came from. The machine does the volume; the licensed human does the judgment and takes the liability, which they were always going to take anyway. That division is not a compromise on the way to full autonomy. It is the product.
Every unit of work in our runtime declares what it touches before it can run: its risk class, which data classes it may see, whether a human must approve, whether the effect is idempotent. Undeclared means unrunnable. A stochastic program never inherits ambient authority because a prompt asked nicely.
The path that writes a real appointment into a real clinic's system exists, is tested, and is disabled by default. It returns a refusal and writes an audit row. Turning it on is a business decision with a signature attached, not a deploy flag someone flips on a Thursday. We would rather ship a capability disarmed than discover its blast radius in production.
A privilege log is defensible or it is worthless. An appointment either has provenance or it doesn't. We write the audit row before the external call, not after, because the failure that matters is the one where we acted and cannot account for it. Everything else is recoverable.
An AI revenue agent for private practices.
Riley answers every inquiry a practice receives, works out who the person already is, and hands the front desk one decision instead of an afternoon. Underneath it is a desired-state reconciliation control plane. It compares what a practice wants (a full book, every inquiry answered) against what is observed (an appointment feed, a lead inbox, provider hours) and emits the deltas between them. Deltas become plans, plans lower into typed sagas, and each step is a declared capability that states its own authority before it runs.
;; a capability declares its own authority before it can run
(capability book-consultation
(kind act_external)
(risk-class high)
(approval operator_required)
(phi-classes (limited_phi))
(redaction staff_safe_summary)
(idempotency required)
(side-effects (creates_appointment))
(metrics (booked_consults)))
;; omit any line above and the plan will not lower.
;; undeclared is unrunnable.The declaration is the enforcement. A capability that has not named its risk class, its data classes, and its approval requirement cannot be lowered into a saga, so it cannot execute. That is the whole idea, and it is why a non-engineer can safely describe a workflow in plain language: the runtime refuses anything under-specified rather than guessing at the missing half.
Status, plainly. The reconciliation loop, capability registry, typed saga lowering, PHI seams, approval interrupts and audit trail run today. The outbound clinical write path is built and shipped disarmed. Iron Lake's substrate work — the general runtime PAOS is the first consumer of — is research in progress and is not claimed as a shipping product.
Trial prep for the firms the market skipped.
The privilege work taught us where the ceiling actually is. A small firm's case rarely dies on the law — it dies in the reading. An ordinary dispute generates tens of thousands of emails, exhibits and filings; one side meets them with an eDiscovery platform and a floor of associates, the other with an inbox and nights. Firms already buy this work by the hour, at attorney rates. Throughput is the complaint.
So the machinery under the privilege service is growing into a trial-prep engine: the chronology, the entity map, the contradiction report, the research memo — with the case law behind it drawn from the now-open public record, and every generated claim pinned to the documents and passages that support it. It runs overnight, because nobody needs a chronology in two hundred milliseconds. They need it by morning, checked.
;; a proposition of law may not leave the system unverified
{
"proposition": "trustee compensation must be reasonable
under the circumstances",
"cite": "Fla. Stat. § 736.0708(1)",
"quote_found": true, ;; the passage exists in the source
"supports": true, ;; and says what the memo claims
"still_good": true, ;; no negative treatment found
"decided_by": "reviewing_attorney"
}
;; fail any line and the memo does not export.Courts have sanctioned lawyers for filing fluent, fabricated citations, and the profession learned the lesson: it never rejected AI, it rejected unverifiable AI. That is the failure mode this design refuses. A proposition that cannot be traced to its source passage, in a case that is still good law, does not leave the system. The standard is not "sounds right." The standard is work product that survives a judge asking how do you know that.
Status, plainly. The document-review core is deployed on a live matter — that story is on legal. The research engine and the citation-verification layer are being built against the open Florida corpus and are not claimed as a shipping product.
Two systems, two regulated domains, same shape. Both predate the runtime and are the reason it exists.
Client identities, volumes and commercial outcomes are omitted deliberately. They are our customers' business data, not our marketing.
A home for agents.
Autonomous work needs somewhere to execute that is cheap, isolated, and does not assume a human at a console. An agent reads a skill file, makes four HTTP calls, and its workload boots in a Firecracker microVM on our own metal with a public URL inside thirty seconds. Slurm schedules. Rust serves. Cost metadata rides on every response, and budget enforcement lives in the scheduler rather than the API, because the race condition matters.
$ curl -X POST https://api.kingdom.sh/v1/jobs \
-H "Authorization: Bearer $KINGDOM_KEY" \
-d '{"image": "ghcr.io/you/yourapp:latest",
"ingress_port": 8080}'
{
"id": "kj_01HW8Z3N5K...",
"state": "BOOTING",
"public_url": "https://hello-a4b9.kingdom.sh",
"cost": {
"this_request_usd": 0.00,
"period_total_usd": 0.00,
"budget_remaining_usd": null
}
}Kingdom opens Q2 2026. Owned hardware, published pricing formula, permanent free tier, self-serve only. The economics are in vision.
For the people who ask "but what is it actually made of."
If you run regulated work that a machine could do and a professional must sign, we want to hear about it. We'll also email you once when Kingdom opens the first wave of accounts, and for no other reason. We don't sell your address or enrich it. If we ever have to, we'll delete it and apologize.