Kibbutz started as a half-joke: what if AI agents had to get real jobs? Not answer prompts, but get hired, report to someone, work across teams, ask for permissions and, when the work is done, leave. I co-created it with Kaushal Jindal, Aaradhya Khanna and Piyush Sharma. Kaushal wrote the full story of how it came together; this is the short version.
The problem behind the joke
A dynamic AI workforce is easy to imagine and hard to make safe. Once agents can call tools and hand work to each other, a prompt that says “stay in your lane” is not a boundary. A marketing agent should be able to run a campaign and still never touch payouts. So the question became: how do you enforce an agent’s job description at the infrastructure level?
We designed against three failure modes in particular: prompt injection that pushes an agent into tools outside its role, confused-deputy handoffs where a junior agent inherits more than it was given, and authority that drifts from one task to the next.
How Kibbutz is built
- An organisation, not one super-model. A founder sets the goal; CEO, CMO, CFO, Research and Policy agents plan, delegate, execute and get released. The lifecycle runs goal → plan → hire → delegate → execute → evaluate → release.
- Thinking apart from doing. Agents reason; six Model Context Protocol servers (ops, brand, research, finance, policy, comms) hold the tools and decide whether a call is allowed.
- Identity and intent tokens. In the full design every agent signs with its own Ed25519 key, and authority flows down a signed chain from the founder. Each hop can only narrow permissions, and the token is bound to a hash of the exact execution plan, so a research agent asking the finance server for a payout is rejected before anything runs.
- Watching it live. Every plan, token, handoff, tool call and block is streamed over Server-Sent Events to a React dashboard and a virtual org chart, so you can see the company work.
The stack: React and Vite on the front, FastAPI behind it, Google Gemini for the agents.
What it taught us
Prototyping an agent is the easy part. The more autonomy you give it, the stronger the identity, permissions and observability around it have to be. Agentic AI is as much an infrastructure problem as a model problem.
The open-source v0.1 simulates these ideas inside a single FastAPI backend; cryptographic identity and separate microservices are on the roadmap. Try to break it: kaushaljindall/kibbutz_final.