Merlin
Merlin
This page explains what Merlin is and the principles that govern it — not a feature list or a status report. For what Merlin can actually do today, and how thoroughly each surface has been validated, see Capabilities.
What Merlin Is
Merlin is not a chatbot added to KEEP. It's the single AI identity inside KEEP — the same name, the same authority model, and the same voice wherever it appears, so a Director or technician never has to learn a new mental model of what Merlin is allowed to do when it shows up on a new screen. (Source: Merlin architecture documentation)
Merlin exists to make the person who's already responsible for a decision faster and better-informed at making it — not to make the decision itself. That's consistent with KEEP's own positioning: KEEP is not a certification authority and does not substitute for human judgment, and Merlin inherits that constraint directly. (Source: Merlin architecture documentation)
Philosophy
Merlin discovers. The Director decides.
True on every surface Merlin appears on. The corollary governs every interaction, with one named exception: Merlin is an advisor by default, and an executor only when a human authorizes it — except for a duress-PIN trigger, which is immediate and automatic by design. (Source: Merlin architecture documentation)
Independent of Any Single AI Provider
Merlin is KEEP's governed orchestration and policy layer — not the underlying language model. The AI provider behind Merlin's reasoning is a replaceable implementation detail, not part of Merlin's identity. Replacing that provider never changes Merlin's identity, governance, authority, or its audit requirements — a provider swap is an implementation update, not a governance event. (Source: Merlin architecture documentation)
That independence extends to how it's purchased: bring your own provider account, or use KEEP-managed AI, at the same price either way. The provider is a configuration choice, not a product dependency. (Source: Merlin architecture documentation)
Where Merlin Shows Up
Two surfaces today, a third built and waiting.
Merlin's current focus is Device Diagnosis and Incident Coordination. Onboarding Scan Analysis is also built and available, but deprioritized relative to the other two for the current evaluation focus.
Device Diagnosis
Evaluation CapabilityReviews a device's open incidents, work log, and event history to produce a plain-English diagnosis. Analysis only — it does not take action.
Incident Coordination
Evaluation CapabilityReads an incident's full thread to suggest next steps and keep a Director informed, logged permanently to the incident record.
Onboarding Scan Analysis
Evaluation CapabilityReads every completed onboarding scan for a new client and correlates the findings into a prioritized remediation brief.
Built and available today; deprioritized for the current evaluation focus.
For current status and how each has been validated, see Capabilities. (Source: Merlin architecture documentation)
How Merlin Is Governed
Authority always belongs to the human.
- 01Credentials never reach Merlin's reasoning. When a human authorizes an action that actually requires one, the credential is entered directly into KEEP and used by KEEP's own server code — Merlin's reasoning and any credentialed action are always two separate steps.
- 02No standing authority of its own. Merlin only ever acts within whatever the requesting or authorizing person is already permitted to do — it never assumes broader access than that, and a Director decides, surface by surface, how much authority Merlin is granted.
- 03Some actions are never permitted. Altering or deleting an audit record, for example — Merlin is never permitted to take, regardless of who asks or what authority they hold.
- 04Changing anything is logged, no exception. Any action that changes something outside KEEP's own logs — shutting down a port, for example — is recorded as part of KEEP's permanent record. Producing information, like a diagnosis or a brief, doesn't carry that same requirement, since nothing on the network changed.
(Source: Merlin architecture documentation)
Frequently Asked Questions
Is Merlin a chatbot?
No. Merlin is an identity that appears across KEEP's existing screens — it doesn't compete with the rest of the product as a separate way of working, it reasons about the same real state those screens show.
What AI does Merlin use, and can that change?
The underlying provider is an implementation detail that can change without changing what Merlin is, how it's governed, or what it's allowed to do.
Can Merlin take action on my network without my approval?
No. Merlin is an advisor by default and only ever executes an action when a human has authorized it, in the moment — the one named exception is a duress-PIN trigger, which is immediate and automatic by design.
Does Merlin ever see my passwords or keys?
No. Merlin's reasoning only ever receives descriptive information — never a credential.
What can Merlin do today?
See Capabilities for the current, conservatively classified list.
(Source: Merlin architecture documentation)