Kiro Crew LTS is the Kiro Crew edition for organizations that govern Kiro with Enterprise Management. This page is for a developer whose organization asked them to use it. At the end you have Kiro Crew LTS installed, signed in through your organization's single sign-on, and running under your organization's controls. Kiro Enterprise Management is in preview for new Kiro profiles created in US East (N. Virginia) (us-east-1); Kiro Crew LTS needs a profile created there with Enterprise Management on.
Kiro Crew LTS fetches your organization's Enterprise Management controls when it starts and applies them while you work. Beyond that:
- It installs beside the regular Kiro Crew app.
- It updates only from its own
ltschannel. The regular app's stable, insider, and nightly channels do not apply. - Feature Previews and Debug tools stay off.
- There is no setting that switches a regular install to LTS or turns LTS off.
- A Kiro profile created in US East (N. Virginia) with Enterprise Management on. Your administrator can confirm this at Kiro > Controls in the AWS console.
- Kiro CLI 3.1.0 or later on the same machine, signed in through your organization's single sign-on (IAM Identity Center or your external identity provider), not a personal account.
- A desktop platform listed in the download table below.
Download the build for your platform, or install the CLI on the LTS channel.
| Platform | Download |
|---|---|
| macOS (universal) | KiroCrew-LTS.dmg |
| macOS (Apple silicon) | KiroCrew-LTS-arm64.dmg |
| Linux (x86_64) | KiroCrew-LTS-x86_64.AppImage |
| Windows | KiroCrew-LTS-Setup.exe |
| Python wheel | kirocrew_lts-0.1.0-py3-none-any.whl |
Replace 0.1.0 with latest in the desktop app links for the newest LTS app build. To install Kiro Crew from the command line on the LTS channel:
curl -fsSL https://download.crew.kiro.dev/cli.sh | sh -s -- --channel lts
Kiro Crew LTS has no sign-in dialog of its own. It uses the Kiro CLI sign-in on your machine.
- In a terminal, run
kiro-cli loginand sign in through your organization's single sign-on. - Open Kiro Crew LTS.
- If you were not signed in, you may see a gateway error that tells you to sign in from the CLI. Finish step 1, then choose Retry.
You are signed in when the dashboard opens with no gateway error. If the error stays after you sign in, run kiro-cli login again and confirm you used your organization's single sign-on, not a personal account.
Kiro Crew LTS applies two layers of rules from your organization's policy. The first layer is your organization's policy for every Kiro client. The second layer covers what only Crew does.
| Layer | Capability | What it governs in Crew | With no rule |
|---|---|---|---|
| Every client | model_use | Which models the agent may use | Denied; the controls Kiro creates for a new profile allow every model |
| Every client | shell | Shell commands the agent runs | Crew's own default: under the normal approval mode, commands that are not read-only ask you first |
| Every client | fs_read, fs_write | Files the agent reads and writes | Crew's own default: under normal, each write asks you first |
| Every client | mcp | MCP tool calls | Crew's own default |
| Crew | messaging_channel | Which messaging channels (Slack, Discord, Telegram, and others) the agent may connect to | Denied |
| Crew | messaging | Whether the agent may send messages to people | Denied |
| Crew | permission_mode | Which approval modes you may pick | yolo (auto-approve) is off; normal, trust, and trust_reads stay available unless a rule denies them |
| Crew | cron | Whether scheduled jobs run | They run until a rule denies them |
| Crew | network_egress | Which hosts the fetch tool may reach | Denied |
| Crew | browser_use | Whether the agent may drive its web browser | On until a rule denies it |
| Crew | tailnet_origin | Whether your dashboard may be opened from other devices on your Tailscale tailnet | On until a rule denies it |
| Crew | theme_install | Whether you may install third-party dashboard themes | On until a rule denies it; built-in and installed themes keep working |
One setting is Crew-specific: crew_sandbox_min_level sets the loosest sandbox level your machine may run spawned processes at. Kiro Crew LTS takes the strictest of your organization's value and its own, so the organization can only raise the level.
Whatever the policy says, the agent cannot read or write ~/.aws or ~/.ssh. No rule or setting turns that off.
How rules combine is on the KGL reference, with the full list of capabilities and settings.
Kiro Crew LTS acts on your behalf within your organization's controls: it runs shell commands, edits files, calls MCP tools, connects to messaging channels, and runs scheduled jobs only where a rule or Crew's own default allows it. Under the normal approval mode it still asks you before commands that are not read-only and before each file write; auto-approve stays off unless your organization allows it. You cannot loosen a control from the app; your administrator changes it at Kiro > Controls in the AWS console, and the change reaches you when Kiro Crew LTS next fetches the controls.
- Kiro Crew LTS needs a Kiro profile created in US East (N. Virginia) with Enterprise Management on. Support for existing profiles and for profiles in Europe comes later.
- Rules for
web_searchandweb_fetchare decided by the Kiro service on every client, not by Crew; Crew's own fetch tool is governed bynetwork_egress. See Enforcement status by capability.
Start your first chat with the Kiro Crew quick start. Your administrator writes the rules; point them at Get started with Enterprise Management.
Kiro Crew LTS