For developers and cloud architects

Chat assistants are useful for infrastructure work right up until someone pastes a storage connection string. K9 AI assumes people will paste real config, so it deals with what’s in it before any model sees it.

Before you press send

Your browser scans the message for 52 kinds of credential, in prose and inside code blocks. The list follows the work engineers actually paste: AWS access keys and session tokens; Azure storage and Cosmos DB keys, SAS signatures, Service Bus and Event Hubs keys, Entra ID client secrets, Functions keys and az login passwords; GCP service account keys; GitHub, GitLab, Slack, Stripe, OpenAI, Anthropic, npm, PyPI and Vault tokens; JWTs and PEM private keys; passwords in connection strings; and secret values in .env files, YAML and Kubernetes Secrets.

Only the value goes. AccountKey=... becomes AccountKey=[SECRET_1], so the model can still read the connection string and tell you what’s wrong with it. Credentials are never written back into the answer, and the server runs the same detector again as a second layer.

A review dialog lists what was found, already selected for removal, before anything leaves the browser. For a live key it also says how to rotate that kind of credential. Rotate it anyway. Keeping it from the model doesn’t undo the copy in your shell history.

Cloud identifiers become placeholders, then come back

Tenant IDs, subscription and resource IDs, private endpoint names, AWS account IDs and ARNs aren’t secrets, but together they map out your estate. K9 replaces each one with a numbered placeholder. The model reasons about [IDENTIFIER_1] and [IDENTIFIER_2] as two different subscriptions, and your browser puts the real values back into the reply.

What you paste (made-up values):

targetScope: /subscriptions/6f1c2a9e-4b7d-4e2a-9c1f-2d8b7e5a3c10/resourceGroups/rg-payments-prod
storage: DefaultEndpointsProtocol=https;AccountName=stpaymentsprod;AccountKey=q7Vx2...Kp9w==

What the model receives:

targetScope: [IDENTIFIER_1]
storage: DefaultEndpointsProtocol=https;AccountName=stpaymentsprod;AccountKey=[SECRET_1]

Detection is pattern-based, and IDs are recognised by the label or URL around them. A bare GUID on a line by itself won’t be caught, which is why the review step exists.

Code isn’t treated like a letter

Redaction rules written for prose do strange things to code. A class called GraceHopper looks like a person; a release date looks like a date of birth. Inside code blocks and pasted config, K9 switches off its rules for names, dates of birth, street addresses, coordinates, unlabelled phone numbers, internal hostnames and IP addresses. Credentials, email addresses and identifiers that can be validated, such as TFNs, Medicare numbers and card numbers that pass the Luhn check, are still caught.

Large pastes turn into a block in the message box showing the language and line count, so a 400-line manifest doesn’t bury your question. They’re sent as fenced code, which is what lets these code rules apply.

Your organisation’s classification settings decide when the review step runs and what is redacted automatically. See how classification and redaction work.

Checks on your infrastructure code

When a message contains Bicep, ARM templates, Terraform, Azure Policy definitions, Kubernetes manifests, Dockerfiles, GitHub Actions workflows or Azure DevOps pipelines, K9 runs 55 fixed rules over it on its own servers before the model answers. 32 are for Azure, 7 for AWS, 6 for Kubernetes, 4 each for Dockerfiles and pipelines, and 2 catch secrets left in code. It also flags ARM apiVersions that are in preview or behind K9’s list of recent GA versions, and runs bicep lint where the Bicep CLI is installed.

Each finding has an ID like AZ-STG-001 and references ISM control IDs from the September 2026 release, plus Microsoft cloud security benchmark controls. The model is given the findings and cites them by ID, so you can see which points came from a deterministic check and which are the model’s own opinion.

Be clear about what this is. A rule set can’t see your Policy assignments or a value set in another module, and a clean result doesn’t mean the code is secure. Mapping a finding to an ISM control helps you write the justification. It doesn’t make a deployment ISM-compliant, and K9 doesn’t claim it does.

KQL for SOC teams

Code blocks are highlighted for KQL, Bicep, HCL, PowerShell and Dockerfiles. When your message includes a KQL query, K9 checks it for the mistakes that cost time in Sentinel and Defender XDR: no time filter, contains where has would do, join with no kind, a single = in a where, Timestamp and TimeGenerated mixed up across Defender and Log Analytics tables, Resource Graph differences, and columns used after summarize has dropped them.

Ask it to translate a Splunk search or a Sigma rule into KQL and the model also gets K9’s mapping notes. There’s no translation engine behind this. The model writes the query, and you should run it against your own workspace before you trust it.

Microsoft Learn citations, off by default

An administrator can let K9 ground Azure and Microsoft answers in Microsoft Learn. When it’s on, K9 builds a short search from Microsoft product terms in the question (for example “Key Vault soft delete”), sends only that search to learn.microsoft.com, and gives the model the excerpts with their URLs to cite. Your message, files and redacted values are never sent. It’s always off for OFFICIAL: Sensitive conversations and for the stricter private labels.

K9 AI is currently operated for information up to OFFICIAL: Sensitive. PROTECTED handling is not available in production.

Testing your own prompts and evals

Every message is screened for prompt injection, and system prompts, eval sets and jailbreak test strings look a lot like attacks. Put that material in a closed code fence and add a sentence of your own saying what you want done with it. Text inside the fence is treated as quoted material. It’s still screened, but a lower-confidence match there won’t block the message the way it would in your own words. High-confidence attacks are still blocked, and so is a message that tells the model to follow whatever is in the block.

Your settings, K9’s model choice

Custom instructions, temperature, top_p and maximum output length can be set per conversation and saved as presets. K9 still decides which model runs. Your instructions go through the same guardrail as your messages and are added after K9’s own rules, so “use the azurerm 4.x provider” works and “ignore your redaction rules” doesn’t.

Prompts to try

For an Azure architect: “Here’s our hub-and-spoke Bicep. Check the private endpoints and NSG rules, and list the findings with the ISM controls they reference.”

For a SOC analyst: “This Sentinel query times out over 30 days. Why, and what should I change?” with the query in a code block.

For a platform engineer: “Our GitHub Actions workflow logs in to Azure with a client secret. Show me how to switch it to OIDC federated credentials.”

The Trust Centre lists where data is stored and who processes it, and plans and pricing has the current tiers.