Hoshin Kanri for IT departments: can our AI agents connect, and on what terms?

Each agent keeps its own access to its own systems, through their MCP servers, and all of them read the same X-Matrix through Hoshin's. Hoshin holds no credential for your ERP, QMS or project tool and never calls them. When an agent needs a figure from production, it reads it from your system with its own rights and writes the reading into Hoshin with its source.

Every Hoshin tool calls Hoshin's own REST API with the caller's credential. The API contract is public (OpenAPI 3.0 and Swagger 2.0 on the developer page), so what an agent can do is what the API allows, nothing more.

People sign in with a single-use link valid 15 minutes, or through your company's SSO (OpenID Connect). There is no password to steal. With SSO, each email domain is proven by a DNS record, one verified domain belongs to one organization, and the SSO can be made mandatory for everyone but the owners, who keep an emergency access.

Inside the organization, roles go from viewer to owner, and a matrix can be restricted to named editors. A restriction only ever narrows rights; it never raises anyone above their role.

Agents connect in two ways. Through OAuth 2.1 (claude.ai, Cursor, Claude Desktop), with PKCE required, dynamic client registration and client metadata documents: the agent acts as the person who consented, within the scopes read or read and write, capped by that person's role. Through an API token created by an admin, limited to read or to read and write. Tokens and public links are stored as hashes, never in clear; SSO secrets are encrypted (AES-256-GCM). Inviting a member stays a human act in the app: no agent can do it.

Hoshin serves a fixed list of tools. Each declares in its MCP annotations whether it only reads, writes, or can remove something, so a client that reads these annotations can let members read freely and hold writes behind an approval. Deleting a matrix requires its exact name.

Deactivating a member cuts every connection opened in their name at the next request: each call checks that the person and the organization are still active. An admin revokes an API token in the app. An OAuth access token lasts 15 minutes and its refresh token rotates at each use; the server implements token revocation (RFC 7009). An MCP session belongs to the credential that opened it: another credential cannot reuse it.

The application, its database and our audience measurement run in France, at OVH, on a server we operate ourselves. Audience is measured without cookies, with truncated IP addresses.

Subprocessors, as listed in our privacy policy: OVH for hosting; Resend for transactional email (United States); Google for our team's mailbox (United States); and animam.ai with Anthropic only for the assistant on public pages, text pasted into the free builder, and drafts of replies to mail sent to us. None of them receives your matrices to run the service.

Your data is never sold and never used to train a model. Any member can export the organization's matrices and ideas as JSON through the API; on request, an account or an organization is erased within 30 days.

Four things can leave. The public page and the external picture of a matrix both go through the same external reading, so neither shows what the other hides.

• A public share link, only if someone creates it: read-only, behind a hashed token, revocable, not indexed. Elements marked internal never reach it, nor do their correlations, and the link can be made without figures.
• The morning webhook, if an admin sets one up: signed, https only, sent to public addresses only, carrying counts and never a title.
• Emails: sign-in links and invitations to members, and review reminders to admins if they are set up.
• Whatever your own agent reads and passes to its model provider, which is between you and that provider.

For data that must not leave a machine, the open-source MCP server (MIT) runs in a local mode: the matrix stays as JSON files in a folder you choose, with the same tools and no account. Public sharing is refused there. Self-hosting the full application (rights, SSO, reviews) is not offered today; see keeping client strategy data in your own environment for the four levels between the two.

An IT review finds these anyway; better that you read them here. Some are on the public roadmap, where each request counts toward building them.

• SAML single sign-on and SCIM provisioning: not built. OpenID Connect is.
• Certifications (ISO 27001, SOC 2): none.
• Encryption at rest: matrices are not encrypted at rest, because the service reads them to compute the score, the cascade and the shared pages. Our technical team can reach the database to operate the service, and only does so for that or at your request.
• Backups: daily (kept 5 days) and weekly (kept 4 weeks), stored on the hosting server, with no off-site copy.
• Audit trail: a server-side log records sensitive operations, but it is not readable by customers, and two agents sharing one connection are not told apart in it.
• Connected agents: there is no screen yet listing the OAuth connections of a member so they can be cut one by one; deactivating the member, or waiting for the client to drop its tokens, is the way today.
• Client-side encryption and an on-premises installation of the application: not built.

Write to security@hoshin.app, listed in our security.txt (RFC 9116). The message reaches the founder directly; unlike other mail we receive, it is never passed to an assistant to draft a reply. The scope and the rules (no load testing, your own accounts only) are in the security policy of the public repository.