Kin wants to be the permission layer between your AI agents and your bank account

Kin launched on Product Hunt today with a tagline that reads like a protest sign: “The AI labs want to own you. Make them answer to you.” The product is a [security layer for AI agents](https://www.producthunt.com/products/kin-6), filed under Security software, AI Workflow Automation and AI Agents. You connect GitHub, Gmail or Stripe once, add Kin to ChatGPT, Claude or Cursor, and give each action a rule. Allow. Ask me. Or Block. When an agent hits an “Ask me” rule, Kin pings your web browser or your phone and waits for your OK.

That is the whole pitch, and it is a sharper one than most agent-security launches manage. The mechanism is legible: a per-action permission gate sitting between a general-purpose agent and the services that hold your money, your code and your mail. The three-state rule (allow, ask, block) is the same grammar macOS and Android use for app permissions, and it is the right grammar. The launch has drawn 63 followers so far. It is free, at least in part.

Here is the problem. Kin is trying to sell you a lock for a door the labs are still building.

The agent permission gap is real

The instinct behind Kin is correct and the timing is not accidental. Agents in 2026 do not just draft text. They open pull requests, send email, issue refunds and move money through Stripe. The tools that grant them that reach, from ChatGPT’s connectors to Claude’s tool use to Cursor’s terminal access, were designed for a world where the human is watching every step. They were not designed for a world where you hand an agent a task, walk away, and come back to a merged PR and a chargeback.

So a product that intercepts each action and asks “is this what you meant?” fills a genuine hole. The “Ask me waits for your OK on the web or your phone” detail matters. It means the approval loop does not depend on you sitting at the same machine the agent is running on, which is the failure mode of most human-in-the-loop designs. If you kick off a coding agent on a cloud box and go to lunch, the approval should find you at lunch.

But the layer is the wrong layer

The trouble is that Kin is a third party bolting rules onto agents it does not control. It has to be added to ChatGPT, Claude or Cursor, which means it sits inside someone else’s runtime, subject to someone else’s tool-calling semantics. When the lab ships a new connector, or changes how an agent chains actions, Kin’s rules have to keep up. That is a maintenance treadmill, and the lab sets the pace.

There is a deeper structural point. The launch line is “the AI labs want to own you.” But the labs are not the ones who will decide whether agent permissions work. The services are. GitHub, Google and Stripe each already have their own OAuth scopes, API keys and rate limits. The durable place to put an agent permission is at the resource, not in a wrapper around the model. Stripe can scope a key to read-only. GitHub can scope a token to one repo. A middleware layer that sits above all three has to reimplement a security model that each of them already owns, and it has to do it without their cooperation.

Kin is betting that convenience beats architecture: one dashboard, one rule set, three services, three agent hosts. That bet can pay off for individual developers who want a single kill switch. It is a much harder bet for a company that needs an auditable, enforceable policy across dozens of engineers and agents.

What would make this real

The interesting question is not whether Kin’s launch page converts. It is whether the “Ask me” pattern becomes a standard or stays a feature. Two paths.

One: the agent hosts build this themselves. OpenAI, Anthropic and Cursor each have every incentive to own the approval surface, because it is where trust and telemetry live. If ChatGPT ships native per-action rules, Kin’s value collapses to a cross-host dashboard, which is a thinner product.

Two: an open standard emerges for agent permissions, the way OAuth standardized delegated access. Then Kin could be an implementation rather than a walled garden. Nothing in the launch materials suggests Kin is pushing a standard. That is a missed opportunity, and it is the one move that would make the tagline true instead of aspirational.

There is also the question the launch page does not answer: what does Kin see? To gate an action it has to inspect it, which means it reads the payload. A permission layer that logs every agent action across your Gmail, your repos and your Stripe account is a very attractive target and a very sensitive dataset. The launch lists Privacy as a tag. It does not list an architecture, an audit model or a data-retention policy. For a security product, that is the specification that matters most, and it is absent.

The permission layer is the right idea. The question is whether a startup can own it before the labs and the platforms do.

What this means for builders

If you are shipping agents, the lesson from Kin is that approval is now a product surface, not an afterthought. Your users will expect to see what the agent is about to do and to stop it, on their phone, before it happens. Build that in, or someone else will build it around you and charge for the privilege.

If you are building the tooling, the lesson is harder. The most valuable real estate in the agent economy is the moment between “the model decided” and “the action happened.” Kin is standing in that gap with a three-button UI. The labs want that gap too. So do Stripe and GitHub, for that matter.

Kin’s 63 followers will not settle this. The next twelve months of native agent permissions from the major labs will. Watch whether OpenAI, Anthropic or Cursor ships an “Ask me” toggle of its own. If they do, Kin’s launch becomes a proof of concept that the platforms absorbed. If they do not, the startup has a real window, and a real responsibility to publish the security architecture it has so far left off the page.