Rules everyone shares
What holds across the whole company — its policies and the knowledge every brand relies on.
The widest scope
Architecture
Governed AI, built as structure.
What OS iXanagi can do is on the Platform page. This page is what sits underneath: how data is protected, how the AI is governed, and where Apps, add-ons and connectors plug in — the skeleton of the system, from a builder's point of view.
Where the design starts
Protection is not being careful. It is the shape of the path.
Hiding a button on screen, forbidding something in the terms, catching it in review — none of these is a mechanism. In OS iXanagi every request takes one path with checks on it, and nothing happens without going through it.
The whole picture
Many ways in. One way through.
Screens people use, the API, AI chat, automations, external AI tools — every request goes through the same Kernel and can only run registered operations. Below it, Apps are lenses on one shared layer of meaning, and connectors only carry things in and out.
One request, step by step
The same checks, in the same order, every time.
Who is asking is decided from the sign-in and a verified membership — never from what the request says about itself. A check that cannot decide does not let the request through.
Identity cannot be claimed
The company a request acts for comes from a verified membership. Writing another company's name into the request changes nothing.
Not yours means not there
A brand or site you do not own answers “not found” (404). Having no permission on your own data is a different answer (403).
Permission lives on the operation
The permission an operation needs lives on the operation itself, so the decision is the same whether it is called from a screen, the API or the AI.
Could not decide, so stop
When the data a check needs cannot be read, the request is stopped (503). Not knowing is never treated as allowed.
Governing the AI
The AI works only inside the asker's permissions.
The AI uses the same registered operations people use — there is no back door for it. Every operation declares what it does — read, write internally, send outward, publish, move money, delete, issue credentials, decide — and on the AI's path that decides how it is handled.
Reading and internal writes run with the asker's permissions, and internal edits keep the previous version. Sending outward, publishing, moving money and deleting happen only with a person's approval, or within a scope, budget and time limit a person set when delegating to the AI. The AI cannot issue credentials, and decisions are made by people. Only a person can delegate to the AI, and the work stops once it goes beyond the scope, the budget or the time limit. After approval, it is not the AI that runs the work but code with a fixed procedure.
How data is protected
Separated by company and by brand — in the structure.
Each one is how the data is held, not a promise to be careful.
The shared layer of meaning
Meaning lives in one place. Apps are lenses on it.
Products, customers, knowledge and strategy sit in one layer every App shares — never copied per App. Activating an App adds a lens on what is already there. Activate it once for the company and it works on the meaning of every brand, so a change made through one App counts in the others. The knowledge the AI reads comes from this layer too, through a single seam, and the meaning calculations for search run inside the OS iXanagi environment.
Knowledge and strategy
What the brand knows, who it serves and how it positions itself. Add-ons are activated, and connectors connected, brand by brand.
Brands never mix
The pages people see
The structure of one brand's website. One brand has one site.
The narrowest scope
Indexing, not training
Not taught to the AI. Indexed, and looked up.
There are two ways to let an AI use your mail and your articles: training (fine-tuning) and indexing. OS iXanagi uses indexing only. Switch between the two to see the difference.
Training (fine-tuning) dissolves the text into the model’s weights. Once dissolved, a reply cannot be taken back out: when it goes stale it cannot be removed, and nobody can tell which sentence came from which person. The model itself has changed.
Redacted before it goes in
What enters the index is a piece of text with the greeting name, e-mail addresses and phone numbers redacted. A piece that cannot be cleaned is not indexed, and the number left out is reported.
Turned into a coordinate of meaning
The embedding model turns each piece into 384 numbers. “It doesn’t work” and “it won’t start” are different words, but they land close together.
The question is turned into one too
A new question is turned into the same kind of coordinate and the nearest pieces come back first. The distance is a number, so a draft can show how close each past reply was.
Left in place, so it can be removed
The model itself never changes, so a reply can be taken out of the index. When someone asks for their data to be erased, their replies alone are removed.
How it extends
Apps, add-ons and connectors plug in at different places.
Each has a fixed place to plug in, so none of them needs a change to the Kernel. A new App joins by what it declares — and the checks above apply to it as they are.
App — a lens on meaning
Knowledge, Website, Commerce and the rest. Activated once for the company, an App works on the shared meaning of every brand. It declares its scope, its operations and the objects it handles.
Add-on — a capability
Payment links, LINE sales, voice capture and more — capabilities added brand by brand as they are needed. A capability is registered as data and combined with others.
Connector — a route in and out
LINE, email, payments. Holds no meaning of its own; a conversation that arrives lands in an App as a lead or a case. Activated in two steps: a contract for the company, a connection for the brand.
Adding an App
Adding an App, without touching the Kernel.
Declare it
Its scope (company, brand or site) and the name its operations live under. The ownership check starts working from here.
Register its operations
Give each one its input shape and what it does — read, write internally, send outward, publish, move money, delete, issue credentials, decide — and declare the permission it needs.
Tie it to meaning
What each piece of work came from, and how its effect will be measured — so results flow back into knowledge.
Activate it
Activate it for the company. Nothing is copied — the meaning is already there.
How we verify
What is protected, machines check every time.
Before every release, the protections we claim are checked by machine. Each check is itself proven by breaking what it guards and watching it turn red. Protection we do not have, we do not claim to have.
Audit gates
What a gate is.
A gate is a check script that ends in failure when a rule is broken. A rule that is written down but checked by no one is not kept — so every protection we claim has a gate behind it.
What has been built
In numbers.
Counted from the source and its history, as of October 2026. Lines of code include comments and blank lines.
1,000,000+ lines
of code — PHP, JavaScript, SQL and more.
4,375commits
of changes since April 2026.
69gates
of audit gates that every release passes.
More numbers
And behind them.
As of October 2026.
7
The code relies on outside PHP libraries for seven things only: payments (Stripe), sending mail, reading received mail, connecting to Google, making PDFs and passkey sign-in. No web framework and no ORM (a general-purpose database layer) — the Kernel, data layer, permissions and workflow engine are written in-house.
1,289
Ways of breaking a rule on purpose, each checked to turn its gate red — across 64 gates.
41
Not in a test of the gate — in day-to-day development a gate turned red and stopped a faulty change, 41 times since September 22, 2026. Each one was fixed before it could ship.
1,359
Each with an input shape and what it does (read, write internally, send, publish …); data changes go through them. Active in the development environment.
13,000+
Every button, heading and message in the console is kept as a pair — Japanese and English — in its dictionaries, so the same screens work in either language. A word that exists in only one of them is stopped by a machine check.
102
Each versioned, with its history kept; 66 of them are tied to the gates that check them. Active in the development environment.
How it is built
People design it. We write it with AI.
About three in four commits — 3,299 of 4,375 — record Claude as a co-author, and AI also helped with some that carry no such record. That is exactly why the time went less into writing fast and more into what checks every change, whoever or whatever wrote it: the gates and the probes above.
Related pages
Read on.
Built
Know how it works, then hand it the work.
Start by defining your business with the AI — the structure on this page is what it runs on. Questions about the architecture are welcome through the contact form.