Enterprise Management preview: one policy for every Kiro client

Kiro Enterprise Management is in preview. It is available to newly created Kiro profiles in US East (N. Virginia) (us-east-1): create a profile there and the Controls page is already in your console, with no setup step. Support for existing profiles and for profiles in Europe comes later. Administrators write one policy in the AWS console, and every developer on the profile gets it in the Kiro IDE, Kiro CLI, Kiro Web, and Kiro Crew LTS. Kiro IDE users need version 1.4.154 or later; Kiro CLI users need version 3.1.0 or later. A policy has three parts: rules that allow, deny, or ask before Kiro uses a model, runs a shell command, reads or writes a file, searches the web, or calls an MCP tool; settings such as the default model, prompt logging, and usage reports; and the steering files, Skills, and Powers you choose to distribute to developers. A rule can apply to everyone on the profile, to one group, or to one user. It works with IAM Identity Center, Okta, or Microsoft Entra ID as the identity source.

Models, API keys, and Kiro Crew messaging and network access are denied until a rule allows them; files, shell, web, MCP, and Kiro Crew scheduled jobs keep Kiro's own default until a rule names them.

Learn more ->

Kiro Crew LTS is the Kiro Crew edition for organizations that govern Kiro with Enterprise Management, and it applies two layers of rules. The first is the same policy every Kiro client gets: your rules for models, shell commands, file reads and writes, and MCP tool calls apply inside Crew too. The second is specific to Crew: which messaging channels the agent may connect to, whether it may message people, which approval modes a user may pick (auto-approve stays off unless a rule allows it), whether scheduled jobs run, which hosts its fetch tool may reach, whether the agent may drive its web browser, whether the dashboard may be opened from other devices on a Tailscale tailnet, and whether users may install third-party dashboard themes. Feature Previews and Debug tools stay off. It installs beside the regular Kiro Crew app and updates only from its own lts channel.

Before you open Kiro Crew LTS, sign in with Kiro CLI through your organization's single sign-on (IAM Identity Center or your external identity provider), not a personal account. Kiro Crew LTS has no sign-in dialog of its own: if you are not signed in, you may see a gateway error that tells you to sign in from the CLI. Sign in, then choose Retry. It needs a Kiro profile created in US East (N. Virginia) with Enterprise Management on.

Replace 0.1.0 with latest in the desktop app links for the newest LTS app build. To install Kiro Crew from the command line on the LTS channel:

Learn more ->