tl;dr: What if business users could describe the changes they need, and AI could create those customizations without getting unrestricted access to the application? I have an idea.
Let’s talk about customizations.
If you’ve developed business applications, especially SaaS applications, you’ve probably run into this. Your application has its core functionality and configuration, but different customers have different needs.
You can add more customization options to the application, trying to cover the most common requests. Or you can let customers build extensions outside the application, using its events and APIs. Both approaches are useful, but they also have limits. The first requires you to anticipate what customers will need; the second can be more complex and may not fit changes that need to happen inside the application’s own flow.
And there are good reasons why customers can’t just change your SaaS application’s code. You need to maintain its security, reliability and performance, which means controlling what code runs in it.
What happens when AI comes into the picture, and generating code becomes much easier?
There are discussions about more “dynamic” applications, where customers ask for changes and AI builds them. But AI doesn’t change the need to control what runs inside your application. Can you trust customer-initiated, AI-generated code to run there? If we want to make this possible, we need better boundaries.
I’ve been thinking about agent guardrails for a while now. It started with BEAR, an attempt to create cages for agents to write code in. I’ve moved away from that concept for general development, but recently it struck me: maybe it fits this problem, where we do need a controlled space for an agent to operate in.
The idea is this:
The application doesn’t need to implement each customization. It provides reusable capabilities, and the agent can combine them into behaviors the application developer didn’t specifically anticipate.
For example, in a task management application, a user could ask: “When I complete a task in this project, create a follow-up task.” The application decides whether an extension is allowed to read the task and create another one. The agent can propose the behavior, but it doesn’t get to invent new application capabilities.
The point isn’t that checks and simulations can guarantee that a customization does exactly what the user intended. It’s that the application defines the boundaries for what an extension can access and do, and Keir helps enforce those boundaries.
Keir is an open-source framework with an extension language, a compiler and runtimes for Java and Node. It’s meant to let applications offer AI-assisted customization while keeping control over how extensions run.
There’s also a task management demo application that shows how a host can integrate Keir. It includes a customization studio where an agent helps a user create and try a customization. Task management is just the demo domain; the idea isn’t limited to it.
If this sounds interesting, take it for a spin! I’d be happy to get feedback.
* Why KEIR? Because it allows two spelling mistakes in one! KEIR = Kontrolled Extension Intermediate Representation. Praise Keir!